PT-2018-4982 · Sudo+5 · Sudo+5

Florian Weimer · Published 2016-11-17 · Updated 2024-06-15 · CVE-2016-7076

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions sudo versions prior to 1.8.18p1

Description The issue allows a local user to bypass the sudo noexec restriction. This can happen when an application run via sudo executes the wordexp() C library function with a user-supplied argument. As a result, a local user permitted to run such an application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges.

Recommendations For versions prior to 1.8.18p1, update to version 1.8.18p1 or later to resolve the issue.

Exploit

Fix

Command Injection

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-77

CWE-184

Related Identifiers

ALT-PU-2017-1056

CESA-2016_2872

CVE-2016-7076

DLA-707-1

MGASA-2016-0389

OPENSUSE-SU-2024:11413-1

RHSA-2016:2872

RHSA-2016_2872

SUSE-SU-2016:2891-1

SUSE-SU-2016:2893-1

SUSE-SU-2016:2904-1

USN-3968-1

USN-3968-3

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Sudo

References · 115

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/sudo_password_bypass.rb · Exploit
• 🔥 https://github.com/t0kx/privesc-CVE-2015-5602 · Exploit
• 🔥 https://github.com/t0kx/privesc-CVE-2010-0426 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2337 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2016-7076 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0389.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1646 · Security Note
• https://bdu.fstec.ru/vul/2015-01940 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2777 · Security Note
• https://bdu.fstec.ru/vul/2015-08594 · Security Note
• https://bdu.fstec.ru/vul/2015-08839 · Security Note
• https://bdu.fstec.ru/vul/2015-09415 · Security Note
• https://bdu.fstec.ru/vul/2015-09414 · Security Note
• https://bdu.fstec.ru/vul/2015-03065 · Security Note
• http://rhn.redhat.com/errata/RHSA-2016-2872.html · Vendor Advisory