PT-2017-2230 · Sudo+5 · Sudo+5
Stephane Chazelas
·
Publicado
2017-06-02
·
Atualizado
2024-06-15
·
CVE-2017-1000368
CVSS v3.1
8.2
Alta
| Vetor | AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
sudo versions 1.8.20p1 and earlier
Description
The issue is related to insufficient input validation, specifically embedded newlines, in the
get process ttyname() function. This can result in information disclosure and command execution. A remote attacker may exploit this to execute arbitrary commands and gain access to information.Recommendations
For sudo versions 1.8.20p1 and earlier, consider restricting access to the
get process ttyname() function until a patch is available. As a temporary workaround, limit the execution of commands that utilize this function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Red Hat
Suse
Ubuntu
Sudo