PT-2005-2798 · Todd Miller · Sudo

Dani Firman Syah · Published 2005-05-31 · Updated 2025-01-16 · CVE-2005-1831

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sudo version 1.6.8p7

Description The issue allows local users to potentially gain privileges by using sudo to call su, then entering a blank password and hitting CTRL-C. However, it has been noted that Sudo catches SIGINT and returns an empty string for the password, suggesting that the issue may only occur if the user's actual password was empty. SuSE and multiple third-party researchers have not been able to replicate this issue.

Recommendations For Sudo version 1.6.8p7, consider updating to a newer version that addresses this potential issue, although no specific fix has been confirmed due to the inability to replicate the problem. As a precaution, ensure that all user passwords are properly set and not empty to minimize potential risks.

Fix

Related Identifiers

CVE-2005-1831

Affected Products

Sudo

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2005-1831 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2005-05/0359.html · Note
• http://osvdb.org/20417 · Note
• http://archives.neohapsis.com/archives/bugtraq/2005-05/0349.html · Note
• https://t.me/cvenotify/107691 · Telegram Post
• http://marc.info/?l=bugtraq&m=111755694008928&w=2 · Note