PT-2018-4982 · Sudo+5 · Sudo+5

Florian Weimer · Publicado 2016-11-17 · Atualizado 2024-06-15 · CVE-2016-7076

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions sudo versions prior to 1.8.18p1

Description The issue allows a local user to bypass the sudo noexec restriction. This can happen when an application run via sudo executes the wordexp() C library function with a user-supplied argument. As a result, a local user permitted to run such an application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges.

Recommendations For versions prior to 1.8.18p1, update to version 1.8.18p1 or later to resolve the issue.

Exploit

Correção

Command Injection

Incomplete List of Disallowed Inputs

Enumeração de Fraquezas

CWE-77

CWE-184

Identificadores relacionados

ALT-PU-2017-1056

CESA-2016_2872

CVE-2016-7076

DLA-707-1

MGASA-2016-0389

OPENSUSE-SU-2024:11413-1

RHSA-2016:2872

RHSA-2016_2872

SUSE-SU-2016:2891-1

SUSE-SU-2016:2893-1

SUSE-SU-2016:2904-1

USN-3968-1

USN-3968-3

Produtos afetados

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Sudo

Referências · 115

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/sudo_password_bypass.rb · Exploit
• 🔥 https://github.com/t0kx/privesc-CVE-2015-5602 · Exploit
• 🔥 https://github.com/t0kx/privesc-CVE-2010-0426 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2337 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2016-7076 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2016-0389.html · Nota de Segurança
• https://suse.com/security/cve/CVE-2016-7076 · Nota
• https://packages.altlinux.org/ru/vuln/CVE-2016-7076 · Nota
• https://bugzilla.suse.com/979531 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1646 · Nota de Segurança
• https://bugzilla.suse.com/966755 · Nota
• https://security.netapp.com/advisory/ntap-20181127-0002 · Nota
• https://bdu.fstec.ru/vul/2015-01940 · Nota de Segurança
• https://suse.com/security/cve/CVE-2021-23240 · Nota
• https://lists.centos.org/pipermail/centos-announce/2017-June/071944.html · Nota