Vulnerability-Lookup

SUSE-SU-2017:1450-1

Vulnerability from csaf_suse - Published: 2017-05-30 15:52 - Updated: 2017-05-30 15:52

Summary

Security update for sudo

Severity

Important

Notes

Title of the patch: Security update for sudo

Description of the patch: This update for sudo fixes the following issues: CVE-2017-1000367: - Due to incorrect assumptions in /proc/[pid]/stat parsing, a local attacker can pretend that his tty is any file on the filesystem, thus gaining arbitrary file write access on SELinux-enabled systems. [bsc#1039361] - Fix FQDN for hostname. [bsc#1024145] - Filter netgroups, they aren't handled by SSSD. [bsc#1015351] - Fix problems related to 'krb5_ccname' option [bsc#981124]

Patchnames: SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-889,SUSE-SLE-DESKTOP-12-SP2-2017-889,SUSE-SLE-RPI-12-SP2-2017-889,SUSE-SLE-SDK-12-SP2-2017-889,SUSE-SLE-SERVER-12-SP2-2017-889

CVE-2017-1000367

7.8 (High)


                
                  CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 14 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Desktop 12 SP2:sudo-1.8.10p3-10.5.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP2:sudo-1.8.10p3-10.5.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP2:sudo-1.8.10p3-10.5.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP2:sudo-1.8.10p3-10.5.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP2:sudo-1.8.10p3-10.5.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:sudo-1.8.10p3-10.5.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP2:sudo-1.8.10p3-10.5.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP2:sudo-1.8.10p3-10.5.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP2:sudo-1.8.10p3-10.5.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP2:sudo-1.8.10p3-10.5.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Software Development Kit 12 SP2:sudo-devel-1.8.10p3-10.5.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Software Development Kit 12 SP2:sudo-devel-1.8.10p3-10.5.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Software Development Kit 12 SP2:sudo-devel-1.8.10p3-10.5.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Software Development Kit 12 SP2:sudo-devel-1.8.10p3-10.5.1.x86_64	—	Vendor Fix

Threats

Impact important

References

14 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1015351	self
https://bugzilla.suse.com/1024145	self
https://bugzilla.suse.com/1039361	self
https://bugzilla.suse.com/981124	self
https://www.suse.com/security/cve/CVE-2017-1000367/	self
https://www.suse.com/security/cve/CVE-2017-1000367	external
https://bugzilla.suse.com/1007501	external
https://bugzilla.suse.com/1039361	external
https://bugzilla.suse.com/1042146	external
https://bugzilla.suse.com/1077345	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for sudo",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "\nThis update for sudo fixes the following issues:\n\nCVE-2017-1000367:\n- Due to incorrect assumptions in /proc/[pid]/stat parsing,\n  a local attacker can pretend that his tty is any file on the filesystem,\n  thus gaining arbitrary file write access on SELinux-enabled systems. [bsc#1039361]\n- Fix FQDN for hostname. [bsc#1024145]\n- Filter netgroups, they aren\u0027t handled by SSSD. [bsc#1015351]\n- Fix problems related to \u0027krb5_ccname\u0027 option [bsc#981124]\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-889,SUSE-SLE-DESKTOP-12-SP2-2017-889,SUSE-SLE-RPI-12-SP2-2017-889,SUSE-SLE-SDK-12-SP2-2017-889,SUSE-SLE-SERVER-12-SP2-2017-889",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2017_1450-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2017:1450-1",
        "url": "https://www.suse.com/support/update/announcement/2017/suse-su-20171450-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2017:1450-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2017-May/002930.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1015351",
        "url": "https://bugzilla.suse.com/1015351"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1024145",
        "url": "https://bugzilla.suse.com/1024145"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1039361",
        "url": "https://bugzilla.suse.com/1039361"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 981124",
        "url": "https://bugzilla.suse.com/981124"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-1000367 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-1000367/"
      }
    ],
    "title": "Security update for sudo",
    "tracking": {
      "current_release_date": "2017-05-30T15:52:27Z",
      "generator": {
        "date": "2017-05-30T15:52:27Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2017:1450-1",
      "initial_release_date": "2017-05-30T15:52:27Z",
      "revision_history": [
        {
          "date": "2017-05-30T15:52:27Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "sudo-1.8.10p3-10.5.1.aarch64",
                "product": {
                  "name": "sudo-1.8.10p3-10.5.1.aarch64",
                  "product_id": "sudo-1.8.10p3-10.5.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "sudo-devel-1.8.10p3-10.5.1.aarch64",
                "product": {
                  "name": "sudo-devel-1.8.10p3-10.5.1.aarch64",
                  "product_id": "sudo-devel-1.8.10p3-10.5.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "sudo-devel-1.8.10p3-10.5.1.ppc64le",
                "product": {
                  "name": "sudo-devel-1.8.10p3-10.5.1.ppc64le",
                  "product_id": "sudo-devel-1.8.10p3-10.5.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "sudo-1.8.10p3-10.5.1.ppc64le",
                "product": {
                  "name": "sudo-1.8.10p3-10.5.1.ppc64le",
                  "product_id": "sudo-1.8.10p3-10.5.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "sudo-devel-1.8.10p3-10.5.1.s390x",
                "product": {
                  "name": "sudo-devel-1.8.10p3-10.5.1.s390x",
                  "product_id": "sudo-devel-1.8.10p3-10.5.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "sudo-1.8.10p3-10.5.1.s390x",
                "product": {
                  "name": "sudo-1.8.10p3-10.5.1.s390x",
                  "product_id": "sudo-1.8.10p3-10.5.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "sudo-1.8.10p3-10.5.1.x86_64",
                "product": {
                  "name": "sudo-1.8.10p3-10.5.1.x86_64",
                  "product_id": "sudo-1.8.10p3-10.5.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "sudo-devel-1.8.10p3-10.5.1.x86_64",
                "product": {
                  "name": "sudo-devel-1.8.10p3-10.5.1.x86_64",
                  "product_id": "sudo-devel-1.8.10p3-10.5.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Desktop 12 SP2",
                "product": {
                  "name": "SUSE Linux Enterprise Desktop 12 SP2",
                  "product_id": "SUSE Linux Enterprise Desktop 12 SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sled:12:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
                "product": {
                  "name": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
                  "product_id": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:12:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Software Development Kit 12 SP2",
                "product": {
                  "name": "SUSE Linux Enterprise Software Development Kit 12 SP2",
                  "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-sdk:12:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP2",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP2",
                  "product_id": "SUSE Linux Enterprise Server 12 SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:12:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sudo-1.8.10p3-10.5.1.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP2",
          "product_id": "SUSE Linux Enterprise Desktop 12 SP2:sudo-1.8.10p3-10.5.1.x86_64"
        },
        "product_reference": "sudo-1.8.10p3-10.5.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sudo-1.8.10p3-10.5.1.aarch64 as component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
          "product_id": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:sudo-1.8.10p3-10.5.1.aarch64"
        },
        "product_reference": "sudo-1.8.10p3-10.5.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sudo-devel-1.8.10p3-10.5.1.aarch64 as component of SUSE Linux Enterprise Software Development Kit 12 SP2",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP2:sudo-devel-1.8.10p3-10.5.1.aarch64"
        },
        "product_reference": "sudo-devel-1.8.10p3-10.5.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sudo-devel-1.8.10p3-10.5.1.ppc64le as component of SUSE Linux Enterprise Software Development Kit 12 SP2",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP2:sudo-devel-1.8.10p3-10.5.1.ppc64le"
        },
        "product_reference": "sudo-devel-1.8.10p3-10.5.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sudo-devel-1.8.10p3-10.5.1.s390x as component of SUSE Linux Enterprise Software Development Kit 12 SP2",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP2:sudo-devel-1.8.10p3-10.5.1.s390x"
        },
        "product_reference": "sudo-devel-1.8.10p3-10.5.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sudo-devel-1.8.10p3-10.5.1.x86_64 as component of SUSE Linux Enterprise Software Development Kit 12 SP2",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP2:sudo-devel-1.8.10p3-10.5.1.x86_64"
        },
        "product_reference": "sudo-devel-1.8.10p3-10.5.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sudo-1.8.10p3-10.5.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP2",
          "product_id": "SUSE Linux Enterprise Server 12 SP2:sudo-1.8.10p3-10.5.1.aarch64"
        },
        "product_reference": "sudo-1.8.10p3-10.5.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sudo-1.8.10p3-10.5.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP2",
          "product_id": "SUSE Linux Enterprise Server 12 SP2:sudo-1.8.10p3-10.5.1.ppc64le"
        },
        "product_reference": "sudo-1.8.10p3-10.5.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sudo-1.8.10p3-10.5.1.s390x as component of SUSE Linux Enterprise Server 12 SP2",
          "product_id": "SUSE Linux Enterprise Server 12 SP2:sudo-1.8.10p3-10.5.1.s390x"
        },
        "product_reference": "sudo-1.8.10p3-10.5.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sudo-1.8.10p3-10.5.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP2",
          "product_id": "SUSE Linux Enterprise Server 12 SP2:sudo-1.8.10p3-10.5.1.x86_64"
        },
        "product_reference": "sudo-1.8.10p3-10.5.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sudo-1.8.10p3-10.5.1.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:sudo-1.8.10p3-10.5.1.aarch64"
        },
        "product_reference": "sudo-1.8.10p3-10.5.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sudo-1.8.10p3-10.5.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:sudo-1.8.10p3-10.5.1.ppc64le"
        },
        "product_reference": "sudo-1.8.10p3-10.5.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sudo-1.8.10p3-10.5.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:sudo-1.8.10p3-10.5.1.s390x"
        },
        "product_reference": "sudo-1.8.10p3-10.5.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sudo-1.8.10p3-10.5.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:sudo-1.8.10p3-10.5.1.x86_64"
        },
        "product_reference": "sudo-1.8.10p3-10.5.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-1000367",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-1000367"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Todd Miller\u0027s sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP2:sudo-1.8.10p3-10.5.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:sudo-1.8.10p3-10.5.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP2:sudo-1.8.10p3-10.5.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP2:sudo-1.8.10p3-10.5.1.s390x",
          "SUSE Linux Enterprise Server 12 SP2:sudo-1.8.10p3-10.5.1.x86_64",
          "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:sudo-1.8.10p3-10.5.1.aarch64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:sudo-1.8.10p3-10.5.1.aarch64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:sudo-1.8.10p3-10.5.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:sudo-1.8.10p3-10.5.1.s390x",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:sudo-1.8.10p3-10.5.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:sudo-devel-1.8.10p3-10.5.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:sudo-devel-1.8.10p3-10.5.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:sudo-devel-1.8.10p3-10.5.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:sudo-devel-1.8.10p3-10.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-1000367",
          "url": "https://www.suse.com/security/cve/CVE-2017-1000367"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1007501 for CVE-2017-1000367",
          "url": "https://bugzilla.suse.com/1007501"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1039361 for CVE-2017-1000367",
          "url": "https://bugzilla.suse.com/1039361"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1042146 for CVE-2017-1000367",
          "url": "https://bugzilla.suse.com/1042146"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1077345 for CVE-2017-1000367",
          "url": "https://bugzilla.suse.com/1077345"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP2:sudo-1.8.10p3-10.5.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:sudo-1.8.10p3-10.5.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP2:sudo-1.8.10p3-10.5.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP2:sudo-1.8.10p3-10.5.1.s390x",
            "SUSE Linux Enterprise Server 12 SP2:sudo-1.8.10p3-10.5.1.x86_64",
            "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:sudo-1.8.10p3-10.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:sudo-1.8.10p3-10.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:sudo-1.8.10p3-10.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:sudo-1.8.10p3-10.5.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:sudo-1.8.10p3-10.5.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:sudo-devel-1.8.10p3-10.5.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:sudo-devel-1.8.10p3-10.5.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:sudo-devel-1.8.10p3-10.5.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:sudo-devel-1.8.10p3-10.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP2:sudo-1.8.10p3-10.5.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:sudo-1.8.10p3-10.5.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP2:sudo-1.8.10p3-10.5.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP2:sudo-1.8.10p3-10.5.1.s390x",
            "SUSE Linux Enterprise Server 12 SP2:sudo-1.8.10p3-10.5.1.x86_64",
            "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:sudo-1.8.10p3-10.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:sudo-1.8.10p3-10.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:sudo-1.8.10p3-10.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:sudo-1.8.10p3-10.5.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:sudo-1.8.10p3-10.5.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:sudo-devel-1.8.10p3-10.5.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:sudo-devel-1.8.10p3-10.5.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:sudo-devel-1.8.10p3-10.5.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:sudo-devel-1.8.10p3-10.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-05-30T15:52:27Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-1000367"
    }
  ]
}

BDU:2017-01283 (CVE-2017-1000367)

Vulnerability from fstec – Published: 2017-06-05 – Updated: 2021-03-23 – View on bdu.fstec.ru Fixed

Title

Уязвимость функции get_process_ttyname программы системного администрирования Sudo может позволить нарушителю повысить привилегии до уровня суперпользователя и выполнить произвольный код

Summary

Уязвимость функции get_process_ttyname программы системного администрирования Sudo связана с недостаточной проверкой вводимых данных. Эксплуатация уязвимости осуществляется путем создания символической ссылки на исполняемый файл Sudo, которому присваивается специальным образом сформированное имя (пробел, после которого следует число). При запуске такого файла, расположенного по адресу /proc/[pid]/stat, Sudo пытается определить tty-номер устройства, но поскольку в качестве разделителей в адресе также используются пробелы, запуск через ссылку с пробелом в имени файла позволяет подставить произвольный номер устройства, не связанный с каким-либо существующим устройством в каталоге по адресу /dev. Если Sudo не находит терминал в каталоге по адресу /dev/pts, она осуществляет поиск в каталоге по адресу /dev. Уязвимость позволяет нарушителю создать фиктивный терминал и, в процессе поиска устройства, когда проверка по адресу /dev/pts уже завершена, а проверка по адресу /dev еще не начата, установить на него символическую ссылку. После этого данный файл будет восприниматься Sudo как текущий терминал. Эксплуатация уязвимости может позволить нарушителю, действующему локально, повысить привилегии до уровня суперпользователя и выполнить произвольный код

Severity

6.9 (Medium) CVSS 2.0


                      
                        AV:L/AC:M/Au:N/C:C/I:C/A:C

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Being clarified

Incidents

Being clarified

Remediation

Being clarified

CWE

CWE-20 - Недостаточная проверка вводимых данных

Aliases

CVE-2017-1000367, USN-3304-1, DSA-3867-1, RHSA-2017:1381, RHSA-2017:1382, SUSE-SU-2017:1450-1

References

12 references

URL
http://www.securitylab.ru/news/486457.php
https://www.sudo.ws/alerts/linux_tty.html
https://access.redhat.com/security/cve/cve-2017-1000367
https://security-tracker.debian.org/tracker/CVE-2017-1000367
https://www.suse.com/security/cve/CVE-2017-1000367
https://www.ubuntu.com/usn/usn-3304-1/
https://bugzilla.redhat.com/show_bug.cgi?id=1456884
https://bugzilla.suse.com/1015351
https://bugzilla.suse.com/1024145
https://bugzilla.suse.com/1039361
https://bugzilla.suse.com/981124
https://access.redhat.com/security/updates/classification/#important

Impacted products

6 products from 7 vendors

Vendors

Canonical Ltd., Red Hat, Inc., Todd C. Miller, Fedora Project, Novell Inc., Сообщество свободного программного обеспечения

Products

Ubuntu, Red Hat Enterprise Linux, Sudo, Fedora, SUSE Linux Enterprise, Debian GNU/Linux

Versions

14.04 LTS (Ubuntu), 5 (Red Hat Enterprise Linux), 6 (Red Hat Enterprise Linux), 7 (Red Hat Enterprise Linux), 17.04 (Ubuntu), 16.10 (Ubuntu), 16.04 LTS (Ubuntu), от 1.8.6p7 до 1.8.20 включительно (Sudo), 25 (Fedora), Desktop 12 SP1 (SUSE Linux Enterprise), Desktop 12 SP2 (SUSE Linux Enterprise), Server 12 SP1 (SUSE Linux Enterprise), Server 12 SP2 (SUSE Linux Enterprise), Server 12-LTSS (SUSE Linux Enterprise), Server for Raspberry Pi 12 SP2 (SUSE Linux Enterprise), Development Kit 12 SP1 (SUSE Linux Enterprise), Development Kit 12 SP2 (SUSE Linux Enterprise), SAP 12 (SUSE Linux Enterprise), 7.1 (Debian GNU/Linux), 8.3 (Debian GNU/Linux)

Product types

Operating system, Application software

Platforms

Сообщество свободного программного обеспечения Linux .

Mitigations

Использование рекомендаций: https://www.sudo.ws/alerts/linux_tty.html

Credits

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": null,
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Canonical Ltd., Red Hat, Inc., Todd C. Miller, Fedora Project, Novell Inc., \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "14.04 LTS (Ubuntu), 5 (Red Hat Enterprise Linux), 6 (Red Hat Enterprise Linux), 7 (Red Hat Enterprise Linux), 17.04 (Ubuntu), 16.10 (Ubuntu), 16.04 LTS (Ubuntu), \u043e\u0442 1.8.6p7 \u0434\u043e 1.8.20 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Sudo), 25 (Fedora), Desktop 12 SP1 (SUSE Linux Enterprise), Desktop 12 SP2 (SUSE Linux Enterprise), Server 12 SP1 (SUSE Linux Enterprise), Server 12 SP2 (SUSE Linux Enterprise), Server 12-LTSS (SUSE Linux Enterprise), Server for Raspberry Pi 12 SP2 (SUSE Linux Enterprise), Development Kit 12 SP1 (SUSE Linux Enterprise), Development Kit 12 SP2 (SUSE Linux Enterprise), SAP 12 (SUSE Linux Enterprise), 7.1 (Debian GNU/Linux), 8.3 (Debian GNU/Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439: https://www.sudo.ws/alerts/linux_tty.html",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "30.05.2017",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "23.03.2021",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "05.06.2017",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2017-01283",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2017-1000367, USN-3304-1, DSA-3867-1, RHSA-2017:1381, RHSA-2017:1382, SUSE-SU-2017:1450-1",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Ubuntu, Red Hat Enterprise Linux, Sudo, Fedora, SUSE Linux Enterprise, Debian GNU/Linux",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "\u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux . ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 get_process_ttyname \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Sudo \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0441\u0443\u043f\u0435\u0440\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (CWE-20)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 get_process_ttyname \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Sudo \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0443\u0442\u0435\u043c \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0441\u0438\u043c\u0432\u043e\u043b\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b Sudo, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043f\u0440\u0438\u0441\u0432\u0430\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0438\u043c\u044f (\u043f\u0440\u043e\u0431\u0435\u043b, \u043f\u043e\u0441\u043b\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0447\u0438\u0441\u043b\u043e). \u041f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u0442\u0430\u043a\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430, \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /proc/[pid]/stat, Sudo \u043f\u044b\u0442\u0430\u0435\u0442\u0441\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c tty-\u043d\u043e\u043c\u0435\u0440 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u043d\u043e \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0440\u0430\u0437\u0434\u0435\u043b\u0438\u0442\u0435\u043b\u0435\u0439 \u0432 \u0430\u0434\u0440\u0435\u0441\u0435 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u043f\u0440\u043e\u0431\u0435\u043b\u044b, \u0437\u0430\u043f\u0443\u0441\u043a \u0447\u0435\u0440\u0435\u0437 \u0441\u0441\u044b\u043b\u043a\u0443 \u0441 \u043f\u0440\u043e\u0431\u0435\u043b\u043e\u043c \u0432 \u0438\u043c\u0435\u043d\u0438 \u0444\u0430\u0439\u043b\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043d\u043e\u043c\u0435\u0440 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u043d\u0435 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0439 \u0441 \u043a\u0430\u043a\u0438\u043c-\u043b\u0438\u0431\u043e \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e\u043c \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /dev. \u0415\u0441\u043b\u0438 Sudo \u043d\u0435 \u043d\u0430\u0445\u043e\u0434\u0438\u0442 \u0442\u0435\u0440\u043c\u0438\u043d\u0430\u043b \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /dev/pts, \u043e\u043d\u0430 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /dev. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0439 \u0442\u0435\u0440\u043c\u0438\u043d\u0430\u043b \u0438, \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u043f\u043e\u0438\u0441\u043a\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u043a\u043e\u0433\u0434\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /dev/pts \u0443\u0436\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0430, \u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /dev \u0435\u0449\u0435 \u043d\u0435 \u043d\u0430\u0447\u0430\u0442\u0430, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043d\u0430 \u043d\u0435\u0433\u043e \u0441\u0438\u043c\u0432\u043e\u043b\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0441\u0441\u044b\u043b\u043a\u0443. \u041f\u043e\u0441\u043b\u0435 \u044d\u0442\u043e\u0433\u043e \u0434\u0430\u043d\u043d\u044b\u0439 \u0444\u0430\u0439\u043b \u0431\u0443\u0434\u0435\u0442 \u0432\u043e\u0441\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c\u0441\u044f Sudo \u043a\u0430\u043a \u0442\u0435\u043a\u0443\u0449\u0438\u0439 \u0442\u0435\u0440\u043c\u0438\u043d\u0430\u043b. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e, \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0441\u0443\u043f\u0435\u0440\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": "-",
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "http://www.securitylab.ru/news/486457.php\nhttps://www.sudo.ws/alerts/linux_tty.html\nhttps://access.redhat.com/security/cve/cve-2017-1000367\nhttps://security-tracker.debian.org/tracker/CVE-2017-1000367\nhttps://www.suse.com/security/cve/CVE-2017-1000367\nhttps://www.ubuntu.com/usn/usn-3304-1/\nhttps://bugzilla.redhat.com/show_bug.cgi?id=1456884\nhttps://bugzilla.suse.com/1015351\nhttps://bugzilla.suse.com/1024145\nhttps://bugzilla.suse.com/1039361\nhttps://bugzilla.suse.com/981124\nhttps://access.redhat.com/security/updates/classification/#important",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-20",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,9)"
}

CVE-2017-1000367 (GCVE-0-2017-1000367)

Vulnerability from cvelistv5 – Published: 2017-06-05 00:00 – Updated: 2024-08-05 22:00

Summary

Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

18 references

URL	Tags
http://www.ubuntu.com/usn/USN-3304-1	vendor-advisory
https://security.gentoo.org/glsa/201705-15	vendor-advisory
http://www.securityfocus.com/bid/98745	vdb-entry
https://www.sudo.ws/alerts/linux_tty.html
http://seclists.org/fulldisclosure/2017/Jun/3	mailing-list
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://access.redhat.com/errata/RHSA-2017:1382	vendor-advisory
http://packetstormsecurity.com/files/142783/Sudo-…
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
http://www.debian.org/security/2017/dsa-3867	vendor-advisory
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
https://www.exploit-db.com/exploits/42183/	exploit
http://www.openwall.com/lists/oss-security/2017/0…	mailing-list
https://access.redhat.com/errata/RHSA-2017:1381	vendor-advisory
http://www.securitytracker.com/id/1038582	vdb-entry
http://www.openwall.com/lists/oss-security/2022/12/22/5	mailing-list
http://www.openwall.com/lists/oss-security/2022/12/22/6	mailing-list

Date Public

2017-05-30 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T22:00:39.956Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3304-1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-3304-1"
          },
          {
            "name": "GLSA-201705-15",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201705-15"
          },
          {
            "name": "98745",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/98745"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.sudo.ws/alerts/linux_tty.html"
          },
          {
            "name": "20170602 Qualys Security Advisory - CVE-2017-1000367 in Sudo\u0027s get_process_ttyname() for Linux",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2017/Jun/3"
          },
          {
            "name": "FEDORA-2017-54580efa82",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEXC4NNIG2QOZY6N2YUK246KI3D3UQO/"
          },
          {
            "name": "RHSA-2017:1382",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1382"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/142783/Sudo-get_process_ttyname-Race-Condition.html"
          },
          {
            "name": "SUSE-SU-2017:1446",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00077.html"
          },
          {
            "name": "SUSE-SU-2017:1450",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00078.html"
          },
          {
            "name": "DSA-3867",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3867"
          },
          {
            "name": "openSUSE-SU-2017:1455",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00079.html"
          },
          {
            "name": "42183",
            "tags": [
              "exploit",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/42183/"
          },
          {
            "name": "[oss-security] 20170530 Qualys Security Advisory - CVE-2017-1000367 in Sudo\u0027s get_process_ttyname() for Linux",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2017/05/30/16"
          },
          {
            "name": "RHSA-2017:1381",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1381"
          },
          {
            "name": "1038582",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038582"
          },
          {
            "name": "[oss-security] 20221222 Re: [Linux] /proc/pid/stat parsing bugs",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/12/22/5"
          },
          {
            "name": "[oss-security] 20221222 Re: [Linux] /proc/pid/stat parsing bugs",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/12/22/6"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-05-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Todd Miller\u0027s sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-22T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-3304-1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://www.ubuntu.com/usn/USN-3304-1"
        },
        {
          "name": "GLSA-201705-15",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/201705-15"
        },
        {
          "name": "98745",
          "tags": [
            "vdb-entry"
          ],
          "url": "http://www.securityfocus.com/bid/98745"
        },
        {
          "url": "https://www.sudo.ws/alerts/linux_tty.html"
        },
        {
          "name": "20170602 Qualys Security Advisory - CVE-2017-1000367 in Sudo\u0027s get_process_ttyname() for Linux",
          "tags": [
            "mailing-list"
          ],
          "url": "http://seclists.org/fulldisclosure/2017/Jun/3"
        },
        {
          "name": "FEDORA-2017-54580efa82",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEXC4NNIG2QOZY6N2YUK246KI3D3UQO/"
        },
        {
          "name": "RHSA-2017:1382",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1382"
        },
        {
          "url": "http://packetstormsecurity.com/files/142783/Sudo-get_process_ttyname-Race-Condition.html"
        },
        {
          "name": "SUSE-SU-2017:1446",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00077.html"
        },
        {
          "name": "SUSE-SU-2017:1450",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00078.html"
        },
        {
          "name": "DSA-3867",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3867"
        },
        {
          "name": "openSUSE-SU-2017:1455",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00079.html"
        },
        {
          "name": "42183",
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/42183/"
        },
        {
          "name": "[oss-security] 20170530 Qualys Security Advisory - CVE-2017-1000367 in Sudo\u0027s get_process_ttyname() for Linux",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2017/05/30/16"
        },
        {
          "name": "RHSA-2017:1381",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1381"
        },
        {
          "name": "1038582",
          "tags": [
            "vdb-entry"
          ],
          "url": "http://www.securitytracker.com/id/1038582"
        },
        {
          "name": "[oss-security] 20221222 Re: [Linux] /proc/pid/stat parsing bugs",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/12/22/5"
        },
        {
          "name": "[oss-security] 20221222 Re: [Linux] /proc/pid/stat parsing bugs",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/12/22/6"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-1000367",
    "datePublished": "2017-06-05T00:00:00.000Z",
    "dateReserved": "2017-06-05T00:00:00.000Z",
    "dateUpdated": "2024-08-05T22:00:39.956Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

SUSE-SU-2017:1450-1

BDU:2017-01283 (CVE-2017-1000367)

CVE-2017-1000367 (GCVE-0-2017-1000367)

Tags

Sightings

Nomenclature

Related by attack behaviour