Veracode Vulnerability DatabaseVERACODE:12518

HistoryJan 15, 2019 - 9:18 a.m.

Arbitrary Command Execution

2019-01-1509:18:06

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

28.7%

JSON

sudo is vulnerable to arbitrary command execution attacks. The vulnerability exists as Todd Miller’s sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution.

CPENameOperatorVersion
sudoeq1.7.2p1__9.el5_5
sudoeq1.8.6p3__7.el6
sudoeq1.7.4p5__9.el6_2
sudoeq1.8.6p3__20.el6_7
sudoeq1.6.9p17__3.el5
sudoeq1.7.2p1__14.el5_8.4
sudoeq1.8.6p3__28.el6_9
sudoeq1.8.6p3__27.el6
sudoeq1.6.9p17__5.el5
sudoeq1.7.2p1__14.el5_8.2

Name	Operator	Version
sudo	eq	1.7.2p1__9.el5_5
sudo	eq	1.8.6p3__7.el6
sudo	eq	1.7.4p5__9.el6_2
sudo	eq	1.8.6p3__20.el6_7
sudo	eq	1.6.9p17__3.el5
sudo	eq	1.7.2p1__14.el5_8.4
sudo	eq	1.8.6p3__28.el6_9
sudo	eq	1.8.6p3__27.el6
sudo	eq	1.6.9p17__5.el5
sudo	eq	1.7.2p1__14.el5_8.2

Rows per page:

1-10 of 371

References

access.redhat.com/errata/RHSA-2017:1574

access.redhat.com/security/updates/classification/#moderate

Arbitrary Command Execution

References

Related