PT-2014-9013 · Sudo+5 · Sudo+5

Jakub Wilk + 1 · Published 2014-12-31 · Updated 2024-06-15 · CVE-2014-9680

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions sudo versions prior to 1.8.12

Description The issue allows local users to open arbitrary files for read access by running a program within an sudo session. This can be demonstrated by interfering with terminal output, discarding kernel-log messages, or repositioning tape drives, but it does not allow viewing file contents.

Recommendations For versions prior to 1.8.12, update to version 1.8.12 or later to resolve the issue. As a temporary workaround, consider restricting the use of sudo sessions to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2017-1056

CESA-2015_1409

CVE-2014-9680

DLA-160-1

DSA-3167-1

MGASA-2015-0079

OPENSUSE-SU-2024:11413-1

RHSA-2015:1409

RHSA-2015_1409

SUSE-SU-2015:0985-1

SUSE-SU-2015_0985-1

SUSE-SU-2016:2904-1

SUSE-SU-2016_2904-1

USN-2533-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Sudo

References · 102

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/sudo_password_bypass.rb · Exploit
• 🔥 https://github.com/t0kx/privesc-CVE-2015-5602 · Exploit
• 🔥 https://github.com/t0kx/privesc-CVE-2010-0426 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2014/10/15/24 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2337 · Security Note
• https://security-tracker.debian.org/tracker/DSA-3167-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1646 · Security Note
• https://bdu.fstec.ru/vul/2015-01940 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2777 · Security Note
• https://bdu.fstec.ru/vul/2015-08594 · Security Note
• https://ubuntu.com/security/CVE-2014-9680 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08839 · Security Note
• https://bdu.fstec.ru/vul/2015-09415 · Security Note
• https://osv.dev/vulnerability/DSA-3167-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09414 · Security Note