sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations that use a netmask syntax, which allows local users to bypass intended command restrictions in opportunistic circumstances by executing a command on a host that has an IPv4 address.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has sudo packages installed that are affected by multiple vulnerabilities:

  - A certain Fedora patch for parse.c in sudo before 1.7.4p5-1.fc14 on Fedora 14 does not properly interpret     a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to     that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a     sudo command. NOTE: this vulnerability exists because of a CVE-2009-0034 regression. (CVE-2011-0008)

  - check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for     command execution that involves a gid change but no uid change, which allows local users to bypass an     intended authentication requirement via the -g option to a sudo command. (CVE-2011-0010)

  - Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to     execute arbitrary code via format string sequences in the program name for sudo. (CVE-2012-0809)

  - sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations     that use a netmask syntax, which allows local users to bypass intended command restrictions in     opportunistic circumstances by executing a command on a host that has an IPv4 address. (CVE-2012-2337)

  - sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate     attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting     the system clock and sudo user timestamp to the epoch. (CVE-2013-1775)

  - sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not     properly validate the controlling terminal device, which allows local users with sudo permissions to     hijack the authorization of another terminal via vectors related to connecting to the standard input,     output, and error file descriptors of another terminal. NOTE: this is one of three closely-related     vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different     affected versions. (CVE-2013-1776)

  - Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which     allows privilege escalation to root via sudoedit -s and a command-line argument that ends with a single     backslash character. (CVE-2021-3156)

  - A heap-based buffer overflow was found in the way sudo parses command line arguments. This flaw is     exploitable by any local user who can execute the sudo command without authentication. Successful     exploitation of this flaw could lead to privilege escalation.  (CVE-2021-3156)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has sudo packages installed that are affected by multiple vulnerabilities:

  - A certain Fedora patch for parse.c in sudo before 1.7.4p5-1.fc14 on Fedora 14 does not properly interpret     a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to     that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a     sudo command. NOTE: this vulnerability exists because of a CVE-2009-0034 regression. (CVE-2011-0008)

  - check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for     command execution that involves a gid change but no uid change, which allows local users to bypass an     intended authentication requirement via the -g option to a sudo command. (CVE-2011-0010)

  - Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to     execute arbitrary code via format string sequences in the program name for sudo. (CVE-2012-0809)

  - sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations     that use a netmask syntax, which allows local users to bypass intended command restrictions in     opportunistic circumstances by executing a command on a host that has an IPv4 address. (CVE-2012-2337)

  - sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate     attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting     the system clock and sudo user timestamp to the epoch. (CVE-2013-1775)

  - sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not     properly validate the controlling terminal device, which allows local users with sudo permissions to     hijack the authorization of another terminal via vectors related to connecting to the standard input,     output, and error file descriptors of another terminal. NOTE: this is one of three closely-related     vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different     affected versions. (CVE-2013-1776)

  - Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines)     in the get_process_ttyname() function resulting in information disclosure and command execution.
    (CVE-2017-1000368)

  - Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which     allows privilege escalation to root via sudoedit -s and a command-line argument that ends with a single     backslash character. (CVE-2021-3156)

  - A heap-based buffer overflow was found in the way sudo parses command line arguments. This flaw is     exploitable by any local user who can execute the sudo command without authentication. Successful     exploitation of this flaw could lead to privilege escalation.  (CVE-2021-3156)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has sudo packages installed that are affected by multiple vulnerabilities:

  - A certain Fedora patch for parse.c in sudo before 1.7.4p5-1.fc14 on Fedora 14 does not properly interpret     a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to     that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a     sudo command. NOTE: this vulnerability exists because of a CVE-2009-0034 regression. (CVE-2011-0008)

  - check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for     command execution that involves a gid change but no uid change, which allows local users to bypass an     intended authentication requirement via the -g option to a sudo command. (CVE-2011-0010)

  - Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to     execute arbitrary code via format string sequences in the program name for sudo. (CVE-2012-0809)

  - sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations     that use a netmask syntax, which allows local users to bypass intended command restrictions in     opportunistic circumstances by executing a command on a host that has an IPv4 address. (CVE-2012-2337)

  - sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate     attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting     the system clock and sudo user timestamp to the epoch. (CVE-2013-1775)

  - sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not     properly validate the controlling terminal device, which allows local users with sudo permissions to     hijack the authorization of another terminal via vectors related to connecting to the standard input,     output, and error file descriptors of another terminal. NOTE: this is one of three closely-related     vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different     affected versions. (CVE-2013-1776)

  - sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file,     which allows local users to open arbitrary files for read access (but not view file contents) by running a     program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log     messages, or repositioning tape drives. (CVE-2014-9680)

  - sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose     full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by /home/*/*/file.txt.
    (CVE-2015-5602)

  - sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run     via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to     run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary     commands with elevated privileges. (CVE-2016-7076)

  - Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in     the get_process_ttyname() function resulting in information disclosure and command execution.
    (CVE-2017-1000367)

  - ** DISPUTED ** In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can     impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user.
    NOTE: The software maintainer believes that this is not a vulnerability because running a command via sudo     as a user not present in the local password database is an intentional feature. Because this behavior     surprised some users, sudo 1.8.30 introduced an option to enable/disable this behavior with the default     being disabled. However, this does not change the fact that sudo was behaving as intended, and as     documented, in earlier versions. (CVE-2019-19232)

  - Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which     allows privilege escalation to root via sudoedit -s and a command-line argument that ends with a single     backslash character. (CVE-2021-3156)

  - A heap-based buffer overflow was found in the way sudo parses command line arguments. This flaw is     exploitable by any local user who can execute the sudo command without authentication. Successful     exploitation of this flaw could lead to privilege escalation.  (CVE-2021-3156)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities in the bundled version of sudo :

  - An unspecified flaw exists in the sudo package related     to the Network Matching Mechanism that is triggered when     parsing IPv4 netmask hosts. A local attacker can exploit     this to execute arbitrary code. (CVE-2012-2337) 

  - An arbitrary file overwrite vulnerability exists in sudo     due to a race condition occurs in post-uninstall during     the upgrade or removal of sudo packages. A local     attacker can exploit this via a symlink attack against     the /var/tmp/nsswitch.conf.bak file, allowing the     attacker write to a specified file. (CVE-2012-3440)

The remote Solaris system is missing necessary patches to address security updates :

  - sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before     1.8.4p5, does not properly support configurations that     use a netmask syntax, which allows local users to bypass     intended command restrictions in opportunistic     circumstances by executing a command on a host that has     an IPv4 address. (CVE-2012-2337)

sudo did not always honor the Host_List setting in /etc/sudoers properly

A flaw was found in the way the network matching code in sudo handled multiple IP networks listed in user specification configuration directives. A user, who is authorized to run commands with sudo on specific hosts, could use this flaw to bypass intended restrictions and run those commands on hosts not matched by any of the network specifications. (CVE-2012-2337)

From Red Hat Security Advisory 2012:1081 :

An updated sudo package that fixes one security issue is now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root.

A flaw was found in the way the network matching code in sudo handled multiple IP networks listed in user specification configuration directives. A user, who is authorized to run commands with sudo on specific hosts, could use this flaw to bypass intended restrictions and run those commands on hosts not matched by any of the network specifications. (CVE-2012-2337)

All users of sudo are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

a. Service Console update for sudo         The service console package sudo is updated to version     1.7.2p1-14.el5_8.3

    The Common Vulnerabilities and Exposures project (cve.mitre.org)     has assigned the name CVE-2012-2337 and CVE-2012-3440 to the issues     addressed in this update.

Multiple vulnerabilities has been found and corrected in sudo :

A flaw exists in the IP network matching code in sudo versions 1.6.9p3 through 1.8.4p4 that may result in the local host being matched even though it is not actually part of the network described by the IP address and associated netmask listed in the sudoers file or in LDAP.
As a result, users authorized to run commands on certain IP networks may be able to run commands on hosts that belong to other networks not explicitly listed in sudoers (CVE-2012-2337).

sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically-proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting the system clock and sudo user timestamp to the epoch (CVE-2013-1775).

Sudo before 1.8.6p7 allows a malicious user to run commands via sudo without authenticating, so long as there exists a terminal the user has access to where a sudo command was successfully run by that same user within the password timeout period (usually five minutes) (CVE-2013-1776).

The updated packages have been patched to correct these issues.

This update fixes a security problem in sudo :

Multiple netmask values used in Host / Host_List configuration caused any host to be allowed access. (CVE-2012-2337)

Also a bug in wildcard matching could allow too relaxed matches within subdirectories of the specified path so /usr/bin/* would also match /usr/bin/X11/*, which is probably not intended. The behaviour was aligned to the one described in the sudoers manpage

The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root.

A flaw was found in the way the network matching code in sudo handled multiple IP networks listed in user specification configuration directives. A user, who is authorized to run commands with sudo on specific hosts, could use this flaw to bypass intended restrictions and run those commands on hosts not matched by any of the network specifications. (CVE-2012-2337)

All users of sudo are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

An updated sudo package that fixes one security issue is now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root.

A flaw was found in the way the network matching code in sudo handled multiple IP networks listed in user specification configuration directives. A user, who is authorized to run commands with sudo on specific hosts, could use this flaw to bypass intended restrictions and run those commands on hosts not matched by any of the network specifications. (CVE-2012-2337)

All users of sudo are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

- fixed CVE-2012-2337

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201207-01 (sudo: Privilege escalation)

    An error in sudo may allow unintended IPv4 hosts to be granted access to       commands.
  Impact :

    A local attacker could gain escalated privileges.
  Workaround :

    There is no known workaround at this time.

- fixed CVE-2012-2337

    - temporarily disabled SSSD support

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes a security problem in sudo :

Multiple netmask values used in Host / Host_List configuration caused any host to be allowed access. (CVE-2012-2337)

Also a bug in wildcard matching could allow too relaxed matches within subdirectories of the specified path so /usr/bin/* would also match /usr/bin/X11/*, which is probably not intended. The behavior was aligned to the one described in the sudoers manpage

It was discovered that sudo misparsed network masks used in Host and Host_List stanzas. This allowed the execution of commands on hosts, where the user would not be allowed to run the specified command.

A vulnerability has been found and corrected in sudo :

A flaw exists in the IP network matching code in sudo versions 1.6.9p3 through 1.8.4p4 that may result in the local host being matched even though it is not actually part of the network described by the IP address and associated netmask listed in the sudoers file or in LDAP.
As a result, users authorized to run commands on certain IP networks may be able to run commands on hosts that belong to other networks not explicitly listed in sudoers (CVE-2012-2337

The updated packages have been patched to correct this issue.

It was discovered that sudo incorrectly handled network masks when using Host and Host_List. A local user who is listed in sudoers may be allowed to run commands on unintended hosts when IPv4 network masks are used to grant access. A local attacker could exploit this to bypass intended access restrictions. Host and Host_List are not used in the default installation of Ubuntu.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Todd Miller reports :

Sudo supports granting access to commands on a per-host basis. The host specification may be in the form of a host name, a netgroup, an IP address, or an IP network (an IP address with an associated netmask).

When IPv6 support was added to sudo, a bug was introduced that caused the IPv6 network matching code to be called when an IPv4 network address does not match. Depending on the value of the uninitialized portion of the IPv6 address, it is possible for the IPv4 network number to match when it should not. This bug only affects IP network matching and does not affect simple IP address matching.

The reported configuration that exhibited the bug was an LDAP-based sudo installation where the sudoRole object contained multiple sudoHost entries, each containing a different IPv4 network. File-based sudoers should be affected as well as the same matching code is used.

ID	Name	Product	Family	Severity
160804	NewStart CGSL CORE 5.05 / MAIN 5.05 : sudo Multiple Vulnerabilities (NS-SA-2022-0028)	Nessus	NewStart CGSL Local Security Checks	high
154615	NewStart CGSL CORE 5.04 / MAIN 5.04 : sudo Multiple Vulnerabilities (NS-SA-2021-0101)	Nessus	NewStart CGSL Local Security Checks	high
154540	NewStart CGSL MAIN 6.02 : sudo Multiple Vulnerabilities (NS-SA-2021-0120)	Nessus	NewStart CGSL Local Security Checks	high
89665	VMware ESX sudo Package Multiple Vulnerabilities (VMSA-2013-0007) (remote check)	Nessus	Misc.	high
80778	Oracle Solaris Third-Party Patch Update : sudo (cve_2012_2337_restriction_bypass)	Nessus	Solaris Local Security Checks	high
74632	openSUSE Security Update : sudo (openSUSE-SU-2012:0652-1)	Nessus	SuSE Local Security Checks	high
69600	Amazon Linux AMI : sudo (ALAS-2012-110)	Nessus	Amazon Linux Local Security Checks	high
68577	Oracle Linux 5 / 6 : sudo (ELSA-2012-1081)	Nessus	Oracle Linux Local Security Checks	high
66723	VMSA-2013-0007 : VMware ESX third-party update for Service Console package sudo	Nessus	VMware ESX Local Security Checks	high
66068	Mandriva Linux Security Advisory : sudo (MDVSA-2013:054)	Nessus	Mandriva Local Security Checks	high
64227	SuSE 11.1 Security Update : sudo, sudo-debuginfo, sudo-debugsource (SAT Patch Number 6306)	Nessus	SuSE Local Security Checks	high
61363	Scientific Linux Security Update : sudo on SL5.x, SL6.x i386/x86_64 (20120716)	Nessus	Scientific Linux Local Security Checks	high
59982	RHEL 5 / 6 : sudo (RHSA-2012:1081)	Nessus	Red Hat Local Security Checks	high
59981	CentOS 5 / 6 : sudo (CESA-2012:1081)	Nessus	CentOS Local Security Checks	high
59962	Fedora 16 : sudo-1.8.3p1-3.fc16 (2012-8021)	Nessus	Fedora Local Security Checks	high
59893	GLSA-201207-01 : sudo: Privilege escalation	Nessus	Gentoo Local Security Checks	high
59296	Fedora 17 : sudo-1.8.3p1-7.fc17 (2012-7998)	Nessus	Fedora Local Security Checks	high
59288	SuSE 10 Security Update : sudo, sudo-debuginfo (ZYPP Patch Number 8134)	Nessus	SuSE Local Security Checks	high
59250	Debian DSA-2478-1 : sudo - parsing error	Nessus	Debian Local Security Checks	high
59221	Mandriva Linux Security Advisory : sudo (MDVSA-2012:079)	Nessus	Mandriva Local Security Checks	high
59170	Ubuntu 8.04 LTS / 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : sudo vulnerability (USN-1442-1)	Nessus	Ubuntu Local Security Checks	high
59169	FreeBSD : sudo -- netmask vulnerability (b3435b68-9ee8-11e1-997c-002354ed89bc)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2012-2337

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high