PT-2002-1032 · Sudo · Sudo

Published 2002-04-22 · Updated 2024-02-02 · CVE-2002-0184

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions sudo versions prior to 1.6.6

Description The issue is caused by an off-by-one error that can result in a heap-based buffer overflow. This may allow local users to gain root privileges via special characters in the -p (prompt) argument, which are not properly expanded. The vulnerability can be exploited locally and may lead to a violation of confidentiality, integrity, and availability of protected information.

Recommendations For versions prior to 1.6.6, update to version 1.6.6 or later to resolve the issue. As a temporary workaround, consider avoiding the use of special characters in the -p (prompt) argument until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-131

Related Identifiers

BDU:2015-07828

CVE-2002-0184

Affected Products

Sudo

References · 19

• 🔥 https://exploit-db.com/exploits/21420 · Exploit
• http://redhat.com/support/errata/RHSA-2002-072.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=101975443619600&w=2 · Patch
• http://linuxsecurity.com/advisories/other_advisory-2040.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=102010164413135&w=2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0184 · Security Note
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000475 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2002-071.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07828 · Security Note
• http://linux-mandrake.com/en/security/2002/MDKSA-2002-028.php3 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=101979472822196&w=2 · Patch
• http://debian.org/security/2002/dsa-128 · Vendor Advisory
• http://novell.com/linux/security/advisories/2002_014_sudo_txt.html · Vendor Advisory
• http://securityfocus.com/bid/4593 · Note
• http://kb.cert.org/vuls/id/820083 · Note