PT-2012-1033 · Todd Miller+4 · Sudo+4

Jan Lieskovsky · Published 2012-05-18 · Updated 2024-06-15 · CVE-2012-2337

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions sudo versions 1.6.x through 1.7.x before 1.7.9p1 sudo versions 1.8.x before 1.8.4p5

Description The issue allows local users to bypass intended command restrictions by executing a command on a host that has an IPv4 address, due to improper support for configurations that use a netmask syntax. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be carried out locally.

Recommendations For sudo versions 1.6.x through 1.7.x before 1.7.9p1, update to version 1.7.9p1 or later. For sudo versions 1.8.x before 1.8.4p5, update to version 1.8.4p5 or later.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2017-1056

BDU:2015-01940

BDU:2015-06936

BDU:2015-06938

BDU:2015-08838

BDU:2015-08839

BDU:2015-09671

CESA-2012_1081

CVE-2012-2337

DSA-2478-1

OPENSUSE-SU-2024:10551-1

RHSA-2012:1081

RHSA-2012_1081

SUSE-SU-2012_0641-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Sudo

References · 81

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/sudo_password_bypass.rb · Exploit
• 🔥 https://github.com/t0kx/privesc-CVE-2015-5602 · Exploit
• 🔥 https://github.com/t0kx/privesc-CVE-2010-0426 · Exploit
• https://bdu.fstec.ru/vul/2015-08594 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-2337 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1776 · Security Note
• https://errata.altlinux.org/ALT-PU-2017-1056 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09416 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3149 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2776 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1163 · Security Note
• https://bdu.fstec.ru/vul/2015-06936 · Security Note
• https://bdu.fstec.ru/vul/2015-09414 · Security Note
• https://bdu.fstec.ru/vul/2015-08838 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0151 · Security Note