Lucene search

K
freebsdFreeBSD2E8CDD36-C3CC-11E5-B5FE-002590263BF5
HistoryNov 17, 2015 - 12:00 a.m.

sudo -- potential privilege escalation via symlink misconfiguration

2015-11-1700:00:00
vuxml.freebsd.org
76

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

0.001

Percentile

26.0%

MITRE reports:

sudoedit in Sudo before 1.8.15 allows local users to gain
privileges via a symlink attack on a file whose full path is defined
using multiple wildcards in /etc/sudoers, as demonstrated by
“/home///file.txt.”

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchsudo< 1.8.15UNKNOWN

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

0.001

Percentile

26.0%