PT-2017-7363 · Sudo · Sudo

Todd C. Miller · Publicado 2016-07-26 · Atualizado 2017-11-05 · CVE-2015-8239

Positive Technologies (AI Summary)

CVSS v3.1

7.0

Alta

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions sudo versions after 1.8.7

Description The issue concerns the SHA-2 digest support in the sudoers plugin, allowing local users with write permissions to parts of the called command to replace them before execution.

Recommendations For versions after 1.8.7, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2015-8239

MGASA-2016-0261

Produtos afetados

Sudo

Referências · 18

• https://bugs.mageia.org/show_bug.cgi?id=18989 · Nota
• https://advisories.mageia.org/MGASA-2016-0261.html · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2015-8239 · Aviso do Fabricante
• https://sudo.ws/repos/sudo/rev/0cd3cc8fa195 · Correção
• https://sudo.ws/repos/sudo/rev/24a3d9215c64 · Correção
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/BLFXPDF67QZECU6EMPWYU4FGK6PNZ3M4 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2016-0261 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2015/11/10/2 · Nota
• https://cve.org/CVERecord?id=CVE-2015-8239 · Nota de Segurança
• https://sudo.ws/stable.html#1.8.16 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-8239 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8239 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2015-8239 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-8239 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1283635 · Correção