PT-2023-8568 · Sudo+2 · Sudo+2

Mohammad Tausif + 1 · Published 2023-12-23 · Updated 2024-02-08 · CVE-2023-7090

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions sudo (affected versions not specified)

Description A flaw was found in sudo in the handling of ipa hostname, where ipa hostname from /etc/sssd/sssd.conf was not propagated in sudo. This leads to a privilege mismanagement issue in applications, where client hosts retain privileges even after they have been retracted. The vulnerability may allow a remote attacker to bypass existing security restrictions and maintain privileges after they have been revoked.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2024-01198

CVE-2023-7090

DLA-3732-1

Affected Products

Astra Linux

Red Os

Sudo

References · 40

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-7090 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28486 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-7090 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-7090 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03866 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0830SE17 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-7090 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=319139257 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-7090 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-7090 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03867 · Security Note
• https://security-tracker.debian.org/tracker/DLA-3732-1 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2255723 · Patch