PT-2019-6480 · Sudo+2 · Sudo+2

Jan Lieskovsky · Publicado 2015-11-18 · Atualizado 2020-08-18 · CVE-2005-4890

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions shadow versions 4.0 through 4.1.4 sudo versions 1.0 through 1.7.3

Description The issue allows for a possible tty hijacking via "su - user -c program". This can be exploited by using the TIOCSTI ioctl to push characters into the input buffer, which can then be read by the next process, potentially allowing the user session to be escaped to the parent session.

Recommendations For shadow versions 4.0 through 4.1.4, update to version 4.1.5 or later. For sudo versions 1.0 through 1.7.3, update to version 1.7.4 or later.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2015-2014

ALT-PU-2017-1056

CVE-2005-4890

Produtos afetados

Alt Linux

Shadow

Sudo

Referências · 64

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/sudo_password_bypass.rb · Exploit
• 🔥 https://github.com/t0kx/privesc-CVE-2015-5602 · Exploit
• 🔥 https://github.com/t0kx/privesc-CVE-2010-0426 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2016/02/25/6 · Exploit
• http://sudo.ws/repos/sudo/rev/ebd6cc75020f · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2337 · Nota de Segurança
• http://openwall.com/lists/oss-security/2013/11/28/10 · Nota
• https://errata.altlinux.org/ALT-PU-2015-2014 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-06938 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1775 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-4890 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5602 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1646 · Nota de Segurança
• https://ubuntu.com/security/CVE-2005-4890 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1776 · Nota de Segurança