Heap-Based Buffer Over-Read

2023-01-2520:13:57

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

sudo

vulnerability

crypt()

password

backend

heap-based buffer over-read

array-out-of-bounds error

local users

sudo

0.0004 Low

EPSS

Percentile

5.1%

JSON

sudo is vulnerable to Heap-Based Buffer Over-Read. The vulnerability exists in crypt() password backend, which contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that may result in a heap-based buffer over-read, that can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer.

CPENameOperatorVersion
sudo:3.15eq1.9.8_p2-r1
sudo:3.15eq1.9.8_p2-r0
sudo:3.14eq1.9.7_p1-r1
sudo:3.14eq1.9.6_p1-r1
sudo:3.15eq1.9.8_p2-r1
sudo:3.15eq1.9.8_p2-r0
sudo:3.14eq1.9.7_p1-r1
sudo:3.14eq1.9.6_p1-r1
sudo:sideq1.9.3p1-1

Name	Operator	Version
sudo:3.15	eq	1.9.8_p2-r1
sudo:3.15	eq	1.9.8_p2-r0
sudo:3.14	eq	1.9.7_p1-r1
sudo:3.14	eq	1.9.6_p1-r1
sudo:3.15	eq	1.9.8_p2-r1
sudo:3.15	eq	1.9.8_p2-r0
sudo:3.14	eq	1.9.7_p1-r1
sudo:3.14	eq	1.9.6_p1-r1
sudo:sid	eq	1.9.3p1-1