Vulnerability-Lookup

BDU:2017-01283 (CVE-2017-1000367)

Vulnerability from fstec – Published: 2017-06-05 – Updated: 2021-03-23 – View on bdu.fstec.ru Fixed

Title

Уязвимость функции get_process_ttyname программы системного администрирования Sudo может позволить нарушителю повысить привилегии до уровня суперпользователя и выполнить произвольный код

Summary

Уязвимость функции get_process_ttyname программы системного администрирования Sudo связана с недостаточной проверкой вводимых данных. Эксплуатация уязвимости осуществляется путем создания символической ссылки на исполняемый файл Sudo, которому присваивается специальным образом сформированное имя (пробел, после которого следует число). При запуске такого файла, расположенного по адресу /proc/[pid]/stat, Sudo пытается определить tty-номер устройства, но поскольку в качестве разделителей в адресе также используются пробелы, запуск через ссылку с пробелом в имени файла позволяет подставить произвольный номер устройства, не связанный с каким-либо существующим устройством в каталоге по адресу /dev. Если Sudo не находит терминал в каталоге по адресу /dev/pts, она осуществляет поиск в каталоге по адресу /dev. Уязвимость позволяет нарушителю создать фиктивный терминал и, в процессе поиска устройства, когда проверка по адресу /dev/pts уже завершена, а проверка по адресу /dev еще не начата, установить на него символическую ссылку. После этого данный файл будет восприниматься Sudo как текущий терминал. Эксплуатация уязвимости может позволить нарушителю, действующему локально, повысить привилегии до уровня суперпользователя и выполнить произвольный код

Severity

6.9 (Medium) CVSS 2.0


                      
                        AV:L/AC:M/Au:N/C:C/I:C/A:C

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Being clarified

Incidents

Being clarified

Remediation

Being clarified

CWE

CWE-20 - Недостаточная проверка вводимых данных

Aliases

CVE-2017-1000367, USN-3304-1, DSA-3867-1, RHSA-2017:1381, RHSA-2017:1382, SUSE-SU-2017:1450-1

References

12 references

URL
http://www.securitylab.ru/news/486457.php
https://www.sudo.ws/alerts/linux_tty.html
https://access.redhat.com/security/cve/cve-2017-1000367
https://security-tracker.debian.org/tracker/CVE-2017-1000367
https://www.suse.com/security/cve/CVE-2017-1000367
https://www.ubuntu.com/usn/usn-3304-1/
https://bugzilla.redhat.com/show_bug.cgi?id=1456884
https://bugzilla.suse.com/1015351
https://bugzilla.suse.com/1024145
https://bugzilla.suse.com/1039361
https://bugzilla.suse.com/981124
https://access.redhat.com/security/updates/classification/#important

Impacted products

6 products from 7 vendors

Vendors

Canonical Ltd., Red Hat, Inc., Todd C. Miller, Fedora Project, Novell Inc., Сообщество свободного программного обеспечения

Products

Ubuntu, Red Hat Enterprise Linux, Sudo, Fedora, SUSE Linux Enterprise, Debian GNU/Linux

Versions

14.04 LTS (Ubuntu), 5 (Red Hat Enterprise Linux), 6 (Red Hat Enterprise Linux), 7 (Red Hat Enterprise Linux), 17.04 (Ubuntu), 16.10 (Ubuntu), 16.04 LTS (Ubuntu), от 1.8.6p7 до 1.8.20 включительно (Sudo), 25 (Fedora), Desktop 12 SP1 (SUSE Linux Enterprise), Desktop 12 SP2 (SUSE Linux Enterprise), Server 12 SP1 (SUSE Linux Enterprise), Server 12 SP2 (SUSE Linux Enterprise), Server 12-LTSS (SUSE Linux Enterprise), Server for Raspberry Pi 12 SP2 (SUSE Linux Enterprise), Development Kit 12 SP1 (SUSE Linux Enterprise), Development Kit 12 SP2 (SUSE Linux Enterprise), SAP 12 (SUSE Linux Enterprise), 7.1 (Debian GNU/Linux), 8.3 (Debian GNU/Linux)

Product types

Operating system, Application software

Platforms

Сообщество свободного программного обеспечения Linux .

Mitigations

Использование рекомендаций: https://www.sudo.ws/alerts/linux_tty.html

Credits

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": null,
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Canonical Ltd., Red Hat, Inc., Todd C. Miller, Fedora Project, Novell Inc., \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "14.04 LTS (Ubuntu), 5 (Red Hat Enterprise Linux), 6 (Red Hat Enterprise Linux), 7 (Red Hat Enterprise Linux), 17.04 (Ubuntu), 16.10 (Ubuntu), 16.04 LTS (Ubuntu), \u043e\u0442 1.8.6p7 \u0434\u043e 1.8.20 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Sudo), 25 (Fedora), Desktop 12 SP1 (SUSE Linux Enterprise), Desktop 12 SP2 (SUSE Linux Enterprise), Server 12 SP1 (SUSE Linux Enterprise), Server 12 SP2 (SUSE Linux Enterprise), Server 12-LTSS (SUSE Linux Enterprise), Server for Raspberry Pi 12 SP2 (SUSE Linux Enterprise), Development Kit 12 SP1 (SUSE Linux Enterprise), Development Kit 12 SP2 (SUSE Linux Enterprise), SAP 12 (SUSE Linux Enterprise), 7.1 (Debian GNU/Linux), 8.3 (Debian GNU/Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439: https://www.sudo.ws/alerts/linux_tty.html",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "30.05.2017",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "23.03.2021",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "05.06.2017",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2017-01283",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2017-1000367, USN-3304-1, DSA-3867-1, RHSA-2017:1381, RHSA-2017:1382, SUSE-SU-2017:1450-1",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Ubuntu, Red Hat Enterprise Linux, Sudo, Fedora, SUSE Linux Enterprise, Debian GNU/Linux",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "\u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux . ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 get_process_ttyname \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Sudo \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0441\u0443\u043f\u0435\u0440\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (CWE-20)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 get_process_ttyname \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Sudo \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0443\u0442\u0435\u043c \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0441\u0438\u043c\u0432\u043e\u043b\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b Sudo, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043f\u0440\u0438\u0441\u0432\u0430\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0438\u043c\u044f (\u043f\u0440\u043e\u0431\u0435\u043b, \u043f\u043e\u0441\u043b\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0447\u0438\u0441\u043b\u043e). \u041f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u0442\u0430\u043a\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430, \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /proc/[pid]/stat, Sudo \u043f\u044b\u0442\u0430\u0435\u0442\u0441\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c tty-\u043d\u043e\u043c\u0435\u0440 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u043d\u043e \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0440\u0430\u0437\u0434\u0435\u043b\u0438\u0442\u0435\u043b\u0435\u0439 \u0432 \u0430\u0434\u0440\u0435\u0441\u0435 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u043f\u0440\u043e\u0431\u0435\u043b\u044b, \u0437\u0430\u043f\u0443\u0441\u043a \u0447\u0435\u0440\u0435\u0437 \u0441\u0441\u044b\u043b\u043a\u0443 \u0441 \u043f\u0440\u043e\u0431\u0435\u043b\u043e\u043c \u0432 \u0438\u043c\u0435\u043d\u0438 \u0444\u0430\u0439\u043b\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043d\u043e\u043c\u0435\u0440 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u043d\u0435 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0439 \u0441 \u043a\u0430\u043a\u0438\u043c-\u043b\u0438\u0431\u043e \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e\u043c \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /dev. \u0415\u0441\u043b\u0438 Sudo \u043d\u0435 \u043d\u0430\u0445\u043e\u0434\u0438\u0442 \u0442\u0435\u0440\u043c\u0438\u043d\u0430\u043b \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /dev/pts, \u043e\u043d\u0430 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /dev. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0439 \u0442\u0435\u0440\u043c\u0438\u043d\u0430\u043b \u0438, \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u043f\u043e\u0438\u0441\u043a\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u043a\u043e\u0433\u0434\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /dev/pts \u0443\u0436\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0430, \u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /dev \u0435\u0449\u0435 \u043d\u0435 \u043d\u0430\u0447\u0430\u0442\u0430, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043d\u0430 \u043d\u0435\u0433\u043e \u0441\u0438\u043c\u0432\u043e\u043b\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0441\u0441\u044b\u043b\u043a\u0443. \u041f\u043e\u0441\u043b\u0435 \u044d\u0442\u043e\u0433\u043e \u0434\u0430\u043d\u043d\u044b\u0439 \u0444\u0430\u0439\u043b \u0431\u0443\u0434\u0435\u0442 \u0432\u043e\u0441\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c\u0441\u044f Sudo \u043a\u0430\u043a \u0442\u0435\u043a\u0443\u0449\u0438\u0439 \u0442\u0435\u0440\u043c\u0438\u043d\u0430\u043b. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e, \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0441\u0443\u043f\u0435\u0440\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": "-",
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "http://www.securitylab.ru/news/486457.php\nhttps://www.sudo.ws/alerts/linux_tty.html\nhttps://access.redhat.com/security/cve/cve-2017-1000367\nhttps://security-tracker.debian.org/tracker/CVE-2017-1000367\nhttps://www.suse.com/security/cve/CVE-2017-1000367\nhttps://www.ubuntu.com/usn/usn-3304-1/\nhttps://bugzilla.redhat.com/show_bug.cgi?id=1456884\nhttps://bugzilla.suse.com/1015351\nhttps://bugzilla.suse.com/1024145\nhttps://bugzilla.suse.com/1039361\nhttps://bugzilla.suse.com/981124\nhttps://access.redhat.com/security/updates/classification/#important",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-20",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,9)"
}

CVE-2017-1000367 (GCVE-0-2017-1000367)

Vulnerability from cvelistv5 – Published: 2017-06-05 00:00 – Updated: 2024-08-05 22:00

Summary

Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

18 references

URL	Tags
http://www.ubuntu.com/usn/USN-3304-1	vendor-advisory
https://security.gentoo.org/glsa/201705-15	vendor-advisory
http://www.securityfocus.com/bid/98745	vdb-entry
https://www.sudo.ws/alerts/linux_tty.html
http://seclists.org/fulldisclosure/2017/Jun/3	mailing-list
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://access.redhat.com/errata/RHSA-2017:1382	vendor-advisory
http://packetstormsecurity.com/files/142783/Sudo-…
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
http://www.debian.org/security/2017/dsa-3867	vendor-advisory
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
https://www.exploit-db.com/exploits/42183/	exploit
http://www.openwall.com/lists/oss-security/2017/0…	mailing-list
https://access.redhat.com/errata/RHSA-2017:1381	vendor-advisory
http://www.securitytracker.com/id/1038582	vdb-entry
http://www.openwall.com/lists/oss-security/2022/12/22/5	mailing-list
http://www.openwall.com/lists/oss-security/2022/12/22/6	mailing-list

Date Public

2017-05-30 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T22:00:39.956Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3304-1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-3304-1"
          },
          {
            "name": "GLSA-201705-15",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201705-15"
          },
          {
            "name": "98745",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/98745"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.sudo.ws/alerts/linux_tty.html"
          },
          {
            "name": "20170602 Qualys Security Advisory - CVE-2017-1000367 in Sudo\u0027s get_process_ttyname() for Linux",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2017/Jun/3"
          },
          {
            "name": "FEDORA-2017-54580efa82",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEXC4NNIG2QOZY6N2YUK246KI3D3UQO/"
          },
          {
            "name": "RHSA-2017:1382",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1382"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/142783/Sudo-get_process_ttyname-Race-Condition.html"
          },
          {
            "name": "SUSE-SU-2017:1446",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00077.html"
          },
          {
            "name": "SUSE-SU-2017:1450",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00078.html"
          },
          {
            "name": "DSA-3867",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3867"
          },
          {
            "name": "openSUSE-SU-2017:1455",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00079.html"
          },
          {
            "name": "42183",
            "tags": [
              "exploit",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/42183/"
          },
          {
            "name": "[oss-security] 20170530 Qualys Security Advisory - CVE-2017-1000367 in Sudo\u0027s get_process_ttyname() for Linux",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2017/05/30/16"
          },
          {
            "name": "RHSA-2017:1381",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1381"
          },
          {
            "name": "1038582",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038582"
          },
          {
            "name": "[oss-security] 20221222 Re: [Linux] /proc/pid/stat parsing bugs",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/12/22/5"
          },
          {
            "name": "[oss-security] 20221222 Re: [Linux] /proc/pid/stat parsing bugs",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/12/22/6"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-05-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Todd Miller\u0027s sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-22T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-3304-1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://www.ubuntu.com/usn/USN-3304-1"
        },
        {
          "name": "GLSA-201705-15",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/201705-15"
        },
        {
          "name": "98745",
          "tags": [
            "vdb-entry"
          ],
          "url": "http://www.securityfocus.com/bid/98745"
        },
        {
          "url": "https://www.sudo.ws/alerts/linux_tty.html"
        },
        {
          "name": "20170602 Qualys Security Advisory - CVE-2017-1000367 in Sudo\u0027s get_process_ttyname() for Linux",
          "tags": [
            "mailing-list"
          ],
          "url": "http://seclists.org/fulldisclosure/2017/Jun/3"
        },
        {
          "name": "FEDORA-2017-54580efa82",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEXC4NNIG2QOZY6N2YUK246KI3D3UQO/"
        },
        {
          "name": "RHSA-2017:1382",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1382"
        },
        {
          "url": "http://packetstormsecurity.com/files/142783/Sudo-get_process_ttyname-Race-Condition.html"
        },
        {
          "name": "SUSE-SU-2017:1446",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00077.html"
        },
        {
          "name": "SUSE-SU-2017:1450",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00078.html"
        },
        {
          "name": "DSA-3867",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3867"
        },
        {
          "name": "openSUSE-SU-2017:1455",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00079.html"
        },
        {
          "name": "42183",
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/42183/"
        },
        {
          "name": "[oss-security] 20170530 Qualys Security Advisory - CVE-2017-1000367 in Sudo\u0027s get_process_ttyname() for Linux",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2017/05/30/16"
        },
        {
          "name": "RHSA-2017:1381",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1381"
        },
        {
          "name": "1038582",
          "tags": [
            "vdb-entry"
          ],
          "url": "http://www.securitytracker.com/id/1038582"
        },
        {
          "name": "[oss-security] 20221222 Re: [Linux] /proc/pid/stat parsing bugs",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/12/22/5"
        },
        {
          "name": "[oss-security] 20221222 Re: [Linux] /proc/pid/stat parsing bugs",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/12/22/6"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-1000367",
    "datePublished": "2017-06-05T00:00:00.000Z",
    "dateReserved": "2017-06-05T00:00:00.000Z",
    "dateUpdated": "2024-08-05T22:00:39.956Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

RHSA-2017:1381

Vulnerability from csaf_redhat - Published: 2017-05-30 17:02 - Updated: 2026-05-13 01:40

Summary

Red Hat Security Advisory: sudo security update

Severity

Important

Scope

1 vulnerability in this advisory.

Open the full advisory

RHSA-2017:1382

Vulnerability from csaf_redhat - Published: 2017-05-30 19:33 - Updated: 2026-06-25 10:50

Summary

Red Hat Security Advisory: sudo security update

Severity

Important

Scope

1 vulnerability in this advisory.

Open the full advisory

SUSE-SU-2017:1450-1

Vulnerability from csaf_suse - Published: 2017-05-30 15:52 - Updated: 2017-05-30 15:52

Summary

Security update for sudo

Severity

Important

Scope

1 vulnerability in this advisory.

Open the full advisory

usn-3304-1

Vulnerability from osv_ubuntu

Published

2017-05-30 16:38

Modified

2026-02-10 04:41

Summary

sudo vulnerability

Details

It was discovered that Sudo did not properly parse the contents of /proc/[pid]/stat when attempting to determine its controlling tty. A local attacker in some configurations could possibly use this to overwrite any file on the filesystem, bypassing intended permissions.

References

URL

Type

	https://ubuntu.com/security/notices/USN-3304-1	ADVISORY
	https://ubuntu.com/security/CVE-2017-1000367	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2017-1000367",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "sudo",
            "binary_version": "1.8.9p5-1ubuntu1.4"
          },
          {
            "binary_name": "sudo-ldap",
            "binary_version": "1.8.9p5-1ubuntu1.4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "sudo",
        "purl": "pkg:deb/ubuntu/sudo@1.8.9p5-1ubuntu1.4?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.9p5-1ubuntu1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.6p3-0ubuntu3",
        "1.8.8-2ubuntu1",
        "1.8.8-2ubuntu2",
        "1.8.9p4-1ubuntu1",
        "1.8.9p4-1ubuntu2",
        "1.8.9p5-1ubuntu1",
        "1.8.9p5-1ubuntu1.1",
        "1.8.9p5-1ubuntu1.2",
        "1.8.9p5-1ubuntu1.3"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2017-1000367",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "sudo",
            "binary_version": "1.8.16-0ubuntu1.4"
          },
          {
            "binary_name": "sudo-ldap",
            "binary_version": "1.8.16-0ubuntu1.4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "sudo",
        "purl": "pkg:deb/ubuntu/sudo@1.8.16-0ubuntu1.4?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.16-0ubuntu1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.12-1ubuntu3",
        "1.8.16-0ubuntu1",
        "1.8.16-0ubuntu1.1",
        "1.8.16-0ubuntu1.2",
        "1.8.16-0ubuntu1.3"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that Sudo did not properly parse the contents of\n/proc/[pid]/stat when attempting to determine its controlling tty.\nA local attacker in some configurations could possibly use this to\noverwrite any file on the filesystem, bypassing intended permissions.\n",
  "id": "USN-3304-1",
  "modified": "2026-02-10T04:41:08Z",
  "published": "2017-05-30T16:38:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3304-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-1000367"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "sudo vulnerability",
  "upstream": [
    "UBUNTU-CVE-2017-1000367"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2017-01283 (CVE-2017-1000367)

CVE-2017-1000367 (GCVE-0-2017-1000367)

RHSA-2017:1381

RHSA-2017:1382

SUSE-SU-2017:1450-1

usn-3304-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature

Related by attack behaviour