Vulnerability-Lookup

BDU:2017-01283 (CVE-2017-1000367)

Vulnerability from fstec – Published: 2017-06-05 – Updated: 2021-03-23 – View on bdu.fstec.ru Fixed

Title

Уязвимость функции get_process_ttyname программы системного администрирования Sudo может позволить нарушителю повысить привилегии до уровня суперпользователя и выполнить произвольный код

Summary

Уязвимость функции get_process_ttyname программы системного администрирования Sudo связана с недостаточной проверкой вводимых данных. Эксплуатация уязвимости осуществляется путем создания символической ссылки на исполняемый файл Sudo, которому присваивается специальным образом сформированное имя (пробел, после которого следует число). При запуске такого файла, расположенного по адресу /proc/[pid]/stat, Sudo пытается определить tty-номер устройства, но поскольку в качестве разделителей в адресе также используются пробелы, запуск через ссылку с пробелом в имени файла позволяет подставить произвольный номер устройства, не связанный с каким-либо существующим устройством в каталоге по адресу /dev. Если Sudo не находит терминал в каталоге по адресу /dev/pts, она осуществляет поиск в каталоге по адресу /dev. Уязвимость позволяет нарушителю создать фиктивный терминал и, в процессе поиска устройства, когда проверка по адресу /dev/pts уже завершена, а проверка по адресу /dev еще не начата, установить на него символическую ссылку. После этого данный файл будет восприниматься Sudo как текущий терминал. Эксплуатация уязвимости может позволить нарушителю, действующему локально, повысить привилегии до уровня суперпользователя и выполнить произвольный код

Severity

6.9 (Medium) CVSS 2.0


                      
                        AV:L/AC:M/Au:N/C:C/I:C/A:C

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Being clarified

Incidents

Being clarified

Remediation

Being clarified

CWE

CWE-20 - Недостаточная проверка вводимых данных

Aliases

CVE-2017-1000367, USN-3304-1, DSA-3867-1, RHSA-2017:1381, RHSA-2017:1382, SUSE-SU-2017:1450-1

References

12 references

URL
http://www.securitylab.ru/news/486457.php
https://www.sudo.ws/alerts/linux_tty.html
https://access.redhat.com/security/cve/cve-2017-1000367
https://security-tracker.debian.org/tracker/CVE-2017-1000367
https://www.suse.com/security/cve/CVE-2017-1000367
https://www.ubuntu.com/usn/usn-3304-1/
https://bugzilla.redhat.com/show_bug.cgi?id=1456884
https://bugzilla.suse.com/1015351
https://bugzilla.suse.com/1024145
https://bugzilla.suse.com/1039361
https://bugzilla.suse.com/981124
https://access.redhat.com/security/updates/classification/#important

Impacted products

6 products from 7 vendors

Vendors

Canonical Ltd., Red Hat, Inc., Todd C. Miller, Fedora Project, Novell Inc., Сообщество свободного программного обеспечения

Products

Ubuntu, Red Hat Enterprise Linux, Sudo, Fedora, SUSE Linux Enterprise, Debian GNU/Linux

Versions

14.04 LTS (Ubuntu), 5 (Red Hat Enterprise Linux), 6 (Red Hat Enterprise Linux), 7 (Red Hat Enterprise Linux), 17.04 (Ubuntu), 16.10 (Ubuntu), 16.04 LTS (Ubuntu), от 1.8.6p7 до 1.8.20 включительно (Sudo), 25 (Fedora), Desktop 12 SP1 (SUSE Linux Enterprise), Desktop 12 SP2 (SUSE Linux Enterprise), Server 12 SP1 (SUSE Linux Enterprise), Server 12 SP2 (SUSE Linux Enterprise), Server 12-LTSS (SUSE Linux Enterprise), Server for Raspberry Pi 12 SP2 (SUSE Linux Enterprise), Development Kit 12 SP1 (SUSE Linux Enterprise), Development Kit 12 SP2 (SUSE Linux Enterprise), SAP 12 (SUSE Linux Enterprise), 7.1 (Debian GNU/Linux), 8.3 (Debian GNU/Linux)

Product types

Operating system, Application software

Platforms

Сообщество свободного программного обеспечения Linux .

Mitigations

Использование рекомендаций: https://www.sudo.ws/alerts/linux_tty.html

Credits

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": null,
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Canonical Ltd., Red Hat, Inc., Todd C. Miller, Fedora Project, Novell Inc., \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "14.04 LTS (Ubuntu), 5 (Red Hat Enterprise Linux), 6 (Red Hat Enterprise Linux), 7 (Red Hat Enterprise Linux), 17.04 (Ubuntu), 16.10 (Ubuntu), 16.04 LTS (Ubuntu), \u043e\u0442 1.8.6p7 \u0434\u043e 1.8.20 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Sudo), 25 (Fedora), Desktop 12 SP1 (SUSE Linux Enterprise), Desktop 12 SP2 (SUSE Linux Enterprise), Server 12 SP1 (SUSE Linux Enterprise), Server 12 SP2 (SUSE Linux Enterprise), Server 12-LTSS (SUSE Linux Enterprise), Server for Raspberry Pi 12 SP2 (SUSE Linux Enterprise), Development Kit 12 SP1 (SUSE Linux Enterprise), Development Kit 12 SP2 (SUSE Linux Enterprise), SAP 12 (SUSE Linux Enterprise), 7.1 (Debian GNU/Linux), 8.3 (Debian GNU/Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439: https://www.sudo.ws/alerts/linux_tty.html",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "30.05.2017",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "23.03.2021",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "05.06.2017",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2017-01283",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2017-1000367, USN-3304-1, DSA-3867-1, RHSA-2017:1381, RHSA-2017:1382, SUSE-SU-2017:1450-1",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Ubuntu, Red Hat Enterprise Linux, Sudo, Fedora, SUSE Linux Enterprise, Debian GNU/Linux",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "\u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux . ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 get_process_ttyname \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Sudo \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0441\u0443\u043f\u0435\u0440\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (CWE-20)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 get_process_ttyname \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Sudo \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0443\u0442\u0435\u043c \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0441\u0438\u043c\u0432\u043e\u043b\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b Sudo, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043f\u0440\u0438\u0441\u0432\u0430\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0438\u043c\u044f (\u043f\u0440\u043e\u0431\u0435\u043b, \u043f\u043e\u0441\u043b\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0447\u0438\u0441\u043b\u043e). \u041f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u0442\u0430\u043a\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430, \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /proc/[pid]/stat, Sudo \u043f\u044b\u0442\u0430\u0435\u0442\u0441\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c tty-\u043d\u043e\u043c\u0435\u0440 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u043d\u043e \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0440\u0430\u0437\u0434\u0435\u043b\u0438\u0442\u0435\u043b\u0435\u0439 \u0432 \u0430\u0434\u0440\u0435\u0441\u0435 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u043f\u0440\u043e\u0431\u0435\u043b\u044b, \u0437\u0430\u043f\u0443\u0441\u043a \u0447\u0435\u0440\u0435\u0437 \u0441\u0441\u044b\u043b\u043a\u0443 \u0441 \u043f\u0440\u043e\u0431\u0435\u043b\u043e\u043c \u0432 \u0438\u043c\u0435\u043d\u0438 \u0444\u0430\u0439\u043b\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043d\u043e\u043c\u0435\u0440 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u043d\u0435 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0439 \u0441 \u043a\u0430\u043a\u0438\u043c-\u043b\u0438\u0431\u043e \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e\u043c \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /dev. \u0415\u0441\u043b\u0438 Sudo \u043d\u0435 \u043d\u0430\u0445\u043e\u0434\u0438\u0442 \u0442\u0435\u0440\u043c\u0438\u043d\u0430\u043b \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /dev/pts, \u043e\u043d\u0430 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /dev. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0439 \u0442\u0435\u0440\u043c\u0438\u043d\u0430\u043b \u0438, \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u043f\u043e\u0438\u0441\u043a\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u043a\u043e\u0433\u0434\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /dev/pts \u0443\u0436\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0430, \u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /dev \u0435\u0449\u0435 \u043d\u0435 \u043d\u0430\u0447\u0430\u0442\u0430, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043d\u0430 \u043d\u0435\u0433\u043e \u0441\u0438\u043c\u0432\u043e\u043b\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0441\u0441\u044b\u043b\u043a\u0443. \u041f\u043e\u0441\u043b\u0435 \u044d\u0442\u043e\u0433\u043e \u0434\u0430\u043d\u043d\u044b\u0439 \u0444\u0430\u0439\u043b \u0431\u0443\u0434\u0435\u0442 \u0432\u043e\u0441\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c\u0441\u044f Sudo \u043a\u0430\u043a \u0442\u0435\u043a\u0443\u0449\u0438\u0439 \u0442\u0435\u0440\u043c\u0438\u043d\u0430\u043b. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e, \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0441\u0443\u043f\u0435\u0440\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": "-",
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "http://www.securitylab.ru/news/486457.php\nhttps://www.sudo.ws/alerts/linux_tty.html\nhttps://access.redhat.com/security/cve/cve-2017-1000367\nhttps://security-tracker.debian.org/tracker/CVE-2017-1000367\nhttps://www.suse.com/security/cve/CVE-2017-1000367\nhttps://www.ubuntu.com/usn/usn-3304-1/\nhttps://bugzilla.redhat.com/show_bug.cgi?id=1456884\nhttps://bugzilla.suse.com/1015351\nhttps://bugzilla.suse.com/1024145\nhttps://bugzilla.suse.com/1039361\nhttps://bugzilla.suse.com/981124\nhttps://access.redhat.com/security/updates/classification/#important",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-20",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,9)"
}

CVE-2017-1000367 (GCVE-0-2017-1000367)

Vulnerability from cvelistv5 – Published: 2017-06-05 00:00 – Updated: 2024-08-05 22:00

Summary

Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.

Severity

No CVSS data available.

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 29/100 over 2194 records in the last 180 days details

References

18 references

URL	Tags
http://www.ubuntu.com/usn/USN-3304-1	vendor-advisory
https://security.gentoo.org/glsa/201705-15	vendor-advisory
http://www.securityfocus.com/bid/98745	vdb-entry
https://www.sudo.ws/alerts/linux_tty.html
http://seclists.org/fulldisclosure/2017/Jun/3	mailing-list
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://access.redhat.com/errata/RHSA-2017:1382	vendor-advisory
http://packetstormsecurity.com/files/142783/Sudo-…
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
http://www.debian.org/security/2017/dsa-3867	vendor-advisory
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
https://www.exploit-db.com/exploits/42183/	exploit
http://www.openwall.com/lists/oss-security/2017/0…	mailing-list
https://access.redhat.com/errata/RHSA-2017:1381	vendor-advisory
http://www.securitytracker.com/id/1038582	vdb-entry
http://www.openwall.com/lists/oss-security/2022/12/22/5	mailing-list
http://www.openwall.com/lists/oss-security/2022/12/22/6	mailing-list

Date Public

2017-05-30 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T22:00:39.956Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3304-1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-3304-1"
          },
          {
            "name": "GLSA-201705-15",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201705-15"
          },
          {
            "name": "98745",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/98745"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.sudo.ws/alerts/linux_tty.html"
          },
          {
            "name": "20170602 Qualys Security Advisory - CVE-2017-1000367 in Sudo\u0027s get_process_ttyname() for Linux",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2017/Jun/3"
          },
          {
            "name": "FEDORA-2017-54580efa82",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEXC4NNIG2QOZY6N2YUK246KI3D3UQO/"
          },
          {
            "name": "RHSA-2017:1382",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1382"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/142783/Sudo-get_process_ttyname-Race-Condition.html"
          },
          {
            "name": "SUSE-SU-2017:1446",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00077.html"
          },
          {
            "name": "SUSE-SU-2017:1450",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00078.html"
          },
          {
            "name": "DSA-3867",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3867"
          },
          {
            "name": "openSUSE-SU-2017:1455",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00079.html"
          },
          {
            "name": "42183",
            "tags": [
              "exploit",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/42183/"
          },
          {
            "name": "[oss-security] 20170530 Qualys Security Advisory - CVE-2017-1000367 in Sudo\u0027s get_process_ttyname() for Linux",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2017/05/30/16"
          },
          {
            "name": "RHSA-2017:1381",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1381"
          },
          {
            "name": "1038582",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038582"
          },
          {
            "name": "[oss-security] 20221222 Re: [Linux] /proc/pid/stat parsing bugs",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/12/22/5"
          },
          {
            "name": "[oss-security] 20221222 Re: [Linux] /proc/pid/stat parsing bugs",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/12/22/6"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-05-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Todd Miller\u0027s sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-22T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-3304-1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://www.ubuntu.com/usn/USN-3304-1"
        },
        {
          "name": "GLSA-201705-15",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/201705-15"
        },
        {
          "name": "98745",
          "tags": [
            "vdb-entry"
          ],
          "url": "http://www.securityfocus.com/bid/98745"
        },
        {
          "url": "https://www.sudo.ws/alerts/linux_tty.html"
        },
        {
          "name": "20170602 Qualys Security Advisory - CVE-2017-1000367 in Sudo\u0027s get_process_ttyname() for Linux",
          "tags": [
            "mailing-list"
          ],
          "url": "http://seclists.org/fulldisclosure/2017/Jun/3"
        },
        {
          "name": "FEDORA-2017-54580efa82",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEXC4NNIG2QOZY6N2YUK246KI3D3UQO/"
        },
        {
          "name": "RHSA-2017:1382",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1382"
        },
        {
          "url": "http://packetstormsecurity.com/files/142783/Sudo-get_process_ttyname-Race-Condition.html"
        },
        {
          "name": "SUSE-SU-2017:1446",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00077.html"
        },
        {
          "name": "SUSE-SU-2017:1450",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00078.html"
        },
        {
          "name": "DSA-3867",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3867"
        },
        {
          "name": "openSUSE-SU-2017:1455",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00079.html"
        },
        {
          "name": "42183",
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/42183/"
        },
        {
          "name": "[oss-security] 20170530 Qualys Security Advisory - CVE-2017-1000367 in Sudo\u0027s get_process_ttyname() for Linux",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2017/05/30/16"
        },
        {
          "name": "RHSA-2017:1381",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1381"
        },
        {
          "name": "1038582",
          "tags": [
            "vdb-entry"
          ],
          "url": "http://www.securitytracker.com/id/1038582"
        },
        {
          "name": "[oss-security] 20221222 Re: [Linux] /proc/pid/stat parsing bugs",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/12/22/5"
        },
        {
          "name": "[oss-security] 20221222 Re: [Linux] /proc/pid/stat parsing bugs",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/12/22/6"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-1000367",
    "datePublished": "2017-06-05T00:00:00.000Z",
    "dateReserved": "2017-06-05T00:00:00.000Z",
    "dateUpdated": "2024-08-05T22:00:39.956Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

RHSA-2017:1381

Vulnerability from csaf_redhat - Published: 2017-05-30 17:02 - Updated: 2026-05-13 01:40

Summary

Red Hat Security Advisory: sudo security update

Severity

Important

Scope

1 vulnerability in this advisory.

Open the full advisory

RHSA-2017:1382

Vulnerability from csaf_redhat - Published: 2017-05-30 19:33 - Updated: 2026-06-25 10:50

Summary

Red Hat Security Advisory: sudo security update

Severity

Important

Scope

1 vulnerability in this advisory.

Open the full advisory

SUSE-SU-2017:1450-1

Vulnerability from csaf_suse - Published: 2017-05-30 15:52 - Updated: 2026-09-20 12:27

Summary

Security update for sudo

Severity

Important

Scope

1 vulnerability in this advisory.

Open the full advisory

USN-3304-1 (UBUNTU-CVE-2017-1000367)

Vulnerability from osv_ubuntu – Published: 2017-05-30 16:38 – Updated: 2026-02-10 04:41 – Source website

Summary

sudo vulnerability

Details

It was discovered that Sudo did not properly parse the contents of /proc/[pid]/stat when attempting to determine its controlling tty. A local attacker in some configurations could possibly use this to overwrite any file on the filesystem, bypassing intended permissions.

References

URL

Type

	https://ubuntu.com/security/notices/USN-3304-1	ADVISORY
	https://ubuntu.com/security/CVE-2017-1000367	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2017-1000367",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "sudo",
            "binary_version": "1.8.9p5-1ubuntu1.4"
          },
          {
            "binary_name": "sudo-ldap",
            "binary_version": "1.8.9p5-1ubuntu1.4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "sudo",
        "purl": "pkg:deb/ubuntu/sudo@1.8.9p5-1ubuntu1.4?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.9p5-1ubuntu1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.6p3-0ubuntu3",
        "1.8.8-2ubuntu1",
        "1.8.8-2ubuntu2",
        "1.8.9p4-1ubuntu1",
        "1.8.9p4-1ubuntu2",
        "1.8.9p5-1ubuntu1",
        "1.8.9p5-1ubuntu1.1",
        "1.8.9p5-1ubuntu1.2",
        "1.8.9p5-1ubuntu1.3"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2017-1000367",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "sudo",
            "binary_version": "1.8.16-0ubuntu1.4"
          },
          {
            "binary_name": "sudo-ldap",
            "binary_version": "1.8.16-0ubuntu1.4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "sudo",
        "purl": "pkg:deb/ubuntu/sudo@1.8.16-0ubuntu1.4?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.16-0ubuntu1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.12-1ubuntu3",
        "1.8.16-0ubuntu1",
        "1.8.16-0ubuntu1.1",
        "1.8.16-0ubuntu1.2",
        "1.8.16-0ubuntu1.3"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that Sudo did not properly parse the contents of\n/proc/[pid]/stat when attempting to determine its controlling tty.\nA local attacker in some configurations could possibly use this to\noverwrite any file on the filesystem, bypassing intended permissions.\n",
  "id": "USN-3304-1",
  "modified": "2026-02-10T04:41:08Z",
  "published": "2017-05-30T16:38:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3304-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-1000367"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "sudo vulnerability",
  "upstream": [
    "UBUNTU-CVE-2017-1000367"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2017-01283 (CVE-2017-1000367)

CVE-2017-1000367 (GCVE-0-2017-1000367)

RHSA-2017:1381

RHSA-2017:1382

SUSE-SU-2017:1450-1

USN-3304-1 (UBUNTU-CVE-2017-1000367)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour