Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 26

Export CSV
CVE-2021-23239

sudo: possible directory existence test due to race condition in sudoedit

The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path.

CVSS 3.1 · 2.5 Low EPSS 1.0% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 2 more
Products
Debian Linux Fedora Cloud Backup and 4 more
CVE-2019-18684

sudo: privilege escalation via write access to file descriptor 3 of the sudo process

Sudo through 1.8.29 allows local users to escalate to root if they have write access to file descriptor 3 of the sudo process. This occurs because of a race condition between determining a uid, and the setresuid and openat system calls. The attacker can write "ALL ALL=(ALL) NOPASSWD:ALL" to /proc/#####/fd/3 at a time when Sudo is prompting for a password. NOTE: This has been disputed due to the way Linux /proc works. It has been argued that writing to /proc/#####/fd/3 would only be viable if you had permission to write to /etc/sudoers. Even with write permission to /proc/#####/fd/3, it would not help you write to /etc/sudoers

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Sudo Project
Products
Sudo
CVE-2019-18634

sudo: Stack based buffer overflow when pwfeedback is enabled

In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.

CVSS 3.1 · 7.8 High EPSS 19.3% KEV · Not listed
Vendors
Debian Redhat Sudo Project
Products
Debian Linux Enterprise Linux Rhel E4s and 1 more
CVE-2019-14287

sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.

CVSS 3.1 · 8.8 High EPSS 63.8% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 18 more
CVE-2016-7076

sudo: noexec bypass via wordexp()

sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges.

CVSS 3.0 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Sudo Project
Products
Enterprise Linux Sudo
CVE-2005-4890

coreutils: tty hijacking possible in "su" via TIOCSTI ioctl

There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Redhat Sudo Project
Products
Debian Linux Shadow Enterprise Linux and 1 more