Sudo before 1.9.13 does not escape control characters in log messages.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the sudo-1.9.5p2-10.el9 build changelog.

  - Sudo does not escape control characters in log messages (CVE-2023-28486)

  - Sudo does not escape control characters in sudoreplay output (CVE-2023-28487)

  - Targeted Corruption of Register and Stack Variables (CVE-2023-42465)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2024:0811 advisory.

  - Sudo before 1.9.13 does not escape control characters in log messages. (CVE-2023-28486)

  - Sudo before 1.9.13 does not escape control characters in sudoreplay output. (CVE-2023-28487)

  - Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation)     because application logic sometimes is based on not equaling an error value (instead of equaling a success     value), and because the values do not resist flips of a single bit. (CVE-2023-42465)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0811 advisory.

  - Sudo before 1.9.13 does not escape control characters in sudoreplay output. (CVE-2023-28487)

  - Sudo before 1.9.13 does not escape control characters in log messages. (CVE-2023-28486)

  - Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation)     because application logic sometimes is based on not equaling an error value (instead of equaling a success     value), and because the values do not resist flips of a single bit. (CVE-2023-42465)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0811 advisory.

  - sudo: Sudo does not escape control characters in log messages (CVE-2023-28486)

  - sudo: Sudo does not escape control characters in sudoreplay output (CVE-2023-28487)

  - sudo: Targeted Corruption of Register and Stack Variables (CVE-2023-42465)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:0811 advisory.

  - Sudo before 1.9.13 does not escape control characters in log messages. (CVE-2023-28486)

  - Sudo before 1.9.13 does not escape control characters in sudoreplay output. (CVE-2023-28487)

  - Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation)     because application logic sometimes is based on not equaling an error value (instead of equaling a success     value), and because the values do not resist flips of a single bit. (CVE-2023-42465)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3732 advisory.

  - Sudo before 1.9.13 does not escape control characters in log messages. (CVE-2023-28486)

  - Sudo before 1.9.13 does not escape control characters in sudoreplay output. (CVE-2023-28487)

  - A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was     not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications,     where client hosts retain privileges even after retracting them. (CVE-2023-7090)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Sudo before 1.9.13 does not escape control characters in log messages. (CVE-2023-28486)

  - Sudo before 1.9.13 does not escape control characters in sudoreplay output. (CVE-2023-28487)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the sudo package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Sudo before 1.9.13 does not escape control characters in log messages. (CVE-2023-28486)

  - Sudo before 1.9.13 does not escape control characters in sudoreplay output. (CVE-2023-28487)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of sudo installed on the remote host is prior to 1.8.23-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2301 advisory.

  - Sudo before 1.9.13 does not escape control characters in log messages. (CVE-2023-28486)

  - Sudo before 1.9.13 does not escape control characters in sudoreplay output. (CVE-2023-28487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202309-12 (sudo: Multiple Vulnerabilities)

  - Sudo before 1.9.13p2 has a double free in the per-command chroot feature. (CVE-2023-27320)

  - Sudo before 1.9.13 does not escape control characters in log messages. (CVE-2023-28486)

  - Sudo before 1.9.13 does not escape control characters in sudoreplay output. (CVE-2023-28487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This Solaris system is missing necessary patches to address critical security updates :

  - Vulnerability in the Oracle Solaris product of Oracle     Systems (component: Device Driver Interface). The     supported version that is affected is 11. Easily     exploitable vulnerability allows low privileged attacker     with logon to the infrastructure where Oracle Solaris     executes to compromise Oracle Solaris. Successful     attacks of this vulnerability can result in takeover of     Oracle Solaris. Note: CVE-2023-22023 is equivalent to     CVE-2023-31284. CVSS 3.1 Base Score 7.8     (Confidentiality, Integrity and Availability impacts).
    CVSS Vector:
    (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
    (CVE-2023-22023)

  - Vulnerability in the PeopleSoft Enterprise PeopleTools     product of Oracle PeopleSoft (component: Security     (OpenSSL)). Supported versions that are affected are     8.58, 8.59 and 8.60. Easily exploitable vulnerability     allows unauthenticated attacker with network access via     TLS to compromise PeopleSoft Enterprise PeopleTools.
    Successful attacks of this vulnerability can result in     unauthorized read access to a subset of PeopleSoft     Enterprise PeopleTools accessible data. CVSS 3.1 Base     Score 5.3 (Confidentiality impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
    (CVE-2022-2097)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Connection Handling).
    Supported versions that are affected are 5.7.39 and     prior and 8.0.30 and prior. Easily exploitable     vulnerability allows high privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server. CVSS 3.1 Base Score 4.9 (Availability impacts).
    CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2022-21617)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Optimizer). Supported versions     that are affected are 5.7.39 and prior and 8.0.30 and     prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple     protocols to compromise MySQL Server. Successful attacks     of this vulnerability can result in unauthorized ability     to cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.9     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2022-21608)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Security: Encryption).
    Supported versions that are affected are 5.7.39 and     prior and 8.0.29 and prior. Easily exploitable     vulnerability allows low privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized read access to a subset of     MySQL Server accessible data. CVSS 3.1 Base Score 4.3     (Confidentiality impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
    (CVE-2022-21592)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Security: Privileges).
    Supported versions that are affected are 5.7.39 and     prior and 8.0.16 and prior. Easily exploitable     vulnerability allows low privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized read access to a subset of     MySQL Server accessible data. CVSS 3.1 Base Score 4.3     (Confidentiality impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
    (CVE-2022-21589)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Packaging (cURL)). Supported     versions that are affected are 5.7.41 and prior and     8.0.32 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via     multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access     to all MySQL Server accessible data. CVSS 3.1 Base Score     7.5 (Confidentiality impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
    (CVE-2022-43551)

  - Vulnerability in the Oracle Communications Network     Analytics Data Director product of Oracle Communications     (component: Install/Upgrade (Kerberos)). The supported     version that is affected is 23.1.0. Easily exploitable     vulnerability allows low privileged attacker with     network access via HTTP to compromise Oracle     Communications Network Analytics Data Director.
    Successful attacks of this vulnerability can result in     takeover of Oracle Communications Network Analytics Data     Director. CVSS 3.1 Base Score 8.8 (Confidentiality,     Integrity and Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
    (CVE-2022-42898)

  - Vulnerability in the Oracle Outside In Technology     product of Oracle Fusion Middleware (component: Third     Party (SQLite)). The supported version that is affected     is 8.5.6. Easily exploitable vulnerability allows low     privileged attacker with logon to the infrastructure     where Oracle Outside In Technology executes to     compromise Oracle Outside In Technology. Successful     attacks of this vulnerability can result in unauthorized     creation, deletion or modification access to critical     data or all Oracle Outside In Technology accessible data     as well as unauthorized access to critical data or     complete access to all Oracle Outside In Technology     accessible data and unauthorized ability to cause a     partial denial of service (partial DOS) of Oracle     Outside In Technology. CVSS 3.1 Base Score 7.3     (Confidentiality, Integrity and Availability impacts).
    CVSS Vector:
    (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).
    (CVE-2022-46908)

  - Vulnerability in the Oracle Communications Diameter     Signaling Router product of Oracle Communications     (component: Platform (Microcode Controller)). The     supported version that is affected is 8.6.0.0. Easily     exploitable vulnerability allows low privileged attacker     with logon to the infrastructure where Oracle     Communications Diameter Signaling Router executes to     compromise Oracle Communications Diameter Signaling     Router. Successful attacks of this vulnerability can     result in unauthorized access to critical data or     complete access to all Oracle Communications Diameter     Signaling Router accessible data. CVSS 3.1 Base Score     5.5 (Confidentiality impacts). CVSS Vector:
    (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
    (CVE-2022-21123)

  - Vulnerability in the PeopleSoft Enterprise PeopleTools     product of Oracle PeopleSoft (component: Porting     (Cryptography)). Supported versions that are affected     are 8.59 and 8.60. Easily exploitable vulnerability     allows unauthenticated attacker with network access via     HTTPS to compromise PeopleSoft Enterprise PeopleTools.
    Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of     PeopleSoft Enterprise PeopleTools accessible data and     unauthorized ability to cause a partial denial of     service (partial DOS) of PeopleSoft Enterprise     PeopleTools. CVSS 3.1 Base Score 6.5 (Integrity and     Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).
    (CVE-2023-23931)

  - Vulnerability in the PeopleSoft Enterprise PeopleTools     product of Oracle PeopleSoft (component: Porting (Python     setuptools)). Supported versions that are affected are     8.59 and 8.60. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via HTTP to     compromise PeopleSoft Enterprise PeopleTools. Successful     attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash     (complete DOS) of PeopleSoft Enterprise PeopleTools.
    CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2022-40897)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6005-2 advisory.

  - Sudo before 1.9.13 does not escape control characters in log messages. (CVE-2023-28486)

  - Sudo before 1.9.13 does not escape control characters in sudoreplay output. (CVE-2023-28487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 22.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6005-1 advisory.

  - Sudo before 1.9.13 does not escape control characters in log messages. (CVE-2023-28486)

  - Sudo before 1.9.13 does not escape control characters in sudoreplay output. (CVE-2023-28487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1700-1 advisory.

  - Sudo before 1.9.13 does not escape control characters in log messages. (CVE-2023-28486)

  - Sudo before 1.9.13 does not escape control characters in sudoreplay output. (CVE-2023-28487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1698-1 advisory.

  - Sudo before 1.9.13 does not escape control characters in log messages. (CVE-2023-28486)

  - Sudo before 1.9.13 does not escape control characters in sudoreplay output. (CVE-2023-28487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1699-1 advisory.

  - Sudo before 1.9.13 does not escape control characters in log messages. (CVE-2023-28486)

  - Sudo before 1.9.13 does not escape control characters in sudoreplay output. (CVE-2023-28487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1665-1 advisory.

  - Sudo before 1.9.13p2 has a double free in the per-command chroot feature. (CVE-2023-27320)

  - Sudo before 1.9.13 does not escape control characters in log messages. (CVE-2023-28486)

  - Sudo before 1.9.13 does not escape control characters in sudoreplay output. (CVE-2023-28487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1659-1 advisory.

  - Sudo before 1.9.13 does not escape control characters in log messages. (CVE-2023-28486)

  - Sudo before 1.9.13 does not escape control characters in sudoreplay output. (CVE-2023-28487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-135 advisory.

  - Sudo before 1.9.13p2 has a double free in the per-command chroot feature. (CVE-2023-27320)

  - Sudo before 1.9.13 does not escape control characters in log messages. (CVE-2023-28486)

  - Sudo before 1.9.13 does not escape control characters in sudoreplay output. (CVE-2023-28487)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
193919	CentOS 9 : sudo-1.9.5p2-10.el9	Nessus	CentOS Local Security Checks	high
190850	CentOS 8 : sudo (CESA-2024:0811)	Nessus	CentOS Local Security Checks	high
190536	Oracle Linux 8 / 9 : sudo (ELSA-2024-0811)	Nessus	Oracle Linux Local Security Checks	high
190517	RHEL 8 / 9 : sudo (RHSA-2024:0811)	Nessus	Red Hat Local Security Checks	high
190513	AlmaLinux 9 : sudo (ALSA-2024:0811)	Nessus	Alma Linux Local Security Checks	high
189972	Debian dla-3732 : sudo - security update	Nessus	Debian Local Security Checks	high
189060	EulerOS 2.0 SP11 : sudo (EulerOS-SA-2023-2670)	Nessus	Huawei Local Security Checks	medium
188890	EulerOS Virtualization 2.11.1 : sudo (EulerOS-SA-2023-2744)	Nessus	Huawei Local Security Checks	medium
188822	EulerOS Virtualization 2.11.0 : sudo (EulerOS-SA-2023-2775)	Nessus	Huawei Local Security Checks	medium
188729	EulerOS 2.0 SP11 : sudo (EulerOS-SA-2023-2712)	Nessus	Huawei Local Security Checks	medium
183465	Amazon Linux 2 : sudo (ALAS-2023-2301)	Nessus	Amazon Linux Local Security Checks	medium
182195	GLSA-202309-12 : sudo: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
178998	EulerOS Virtualization 2.10.1 : sudo (EulerOS-SA-2023-2469)	Nessus	Huawei Local Security Checks	medium
178991	EulerOS Virtualization 2.10.0 : sudo (EulerOS-SA-2023-2494)	Nessus	Huawei Local Security Checks	medium
178627	Oracle Solaris Critical Patch Update : jul2023_SRU11_4_57_144_3	Nessus	Solaris Local Security Checks	critical
176456	Ubuntu 16.04 ESM : Sudo vulnerabilities (USN-6005-2)	Nessus	Ubuntu Local Security Checks	medium
175309	EulerOS 2.0 SP10 : sudo (EulerOS-SA-2023-1813)	Nessus	Huawei Local Security Checks	medium
175308	EulerOS 2.0 SP10 : sudo (EulerOS-SA-2023-1831)	Nessus	Huawei Local Security Checks	medium
174161	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Sudo vulnerabilities (USN-6005-1)	Nessus	Ubuntu Local Security Checks	medium
173733	SUSE SLES12 Security Update : sudo (SUSE-SU-2023:1700-1)	Nessus	SuSE Local Security Checks	medium
173727	SUSE SLES15 Security Update : sudo (SUSE-SU-2023:1698-1)	Nessus	SuSE Local Security Checks	medium
173725	SUSE SLES15 Security Update : sudo (SUSE-SU-2023:1699-1)	Nessus	SuSE Local Security Checks	medium
173706	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : sudo (SUSE-SU-2023:1665-1)	Nessus	SuSE Local Security Checks	high
173695	SUSE SLES12 Security Update : sudo (SUSE-SU-2023:1659-1)	Nessus	SuSE Local Security Checks	medium
173336	Amazon Linux 2023 : sudo, sudo-devel, sudo-logsrvd (ALAS2023-2023-135)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2023-28486

medium

Tenable Plugins

high

high

high

high

high

high

medium

medium

medium

medium

medium

high

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium

high

medium

high