PT-2017-7363 · Sudo · Sudo

Todd C. Miller · Published 2016-07-26 · Updated 2017-11-05 · CVE-2015-8239

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions sudo versions after 1.8.7

Description The issue concerns the SHA-2 digest support in the sudoers plugin, allowing local users with write permissions to parts of the called command to replace them before execution.

Recommendations For versions after 1.8.7, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2015-8239

MGASA-2016-0261

Affected Products

Sudo

References · 18

• https://advisories.mageia.org/MGASA-2016-0261.html · Security Note
• https://osv.dev/vulnerability/CVE-2015-8239 · Vendor Advisory
• https://sudo.ws/repos/sudo/rev/0cd3cc8fa195 · Patch
• https://sudo.ws/repos/sudo/rev/24a3d9215c64 · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/BLFXPDF67QZECU6EMPWYU4FGK6PNZ3M4 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0261 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-8239 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-8239 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8239 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-8239 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-8239 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1283635 · Patch
• https://ubuntu.com/security/CVE-2015-8239 · Vendor Advisory
• https://sudo.ws/repos/sudo/rev/397722cdd7ec · Patch
• https://bugs.mageia.org/show_bug.cgi?id=18989 · Note