CVE-2015-5602
6.1 Medium
AI Score
Confidence
Low
7.2 High
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
0.001 Low
EPSS
Percentile
25.4%
sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by “/home///file.txt.”
| CPE | Name | Operator | Version |
|---|---|---|---|
| sudo_project:sudo | sudo project sudo | le | 1.8.14 |
References
bugzilla.sudo.ws/show_bug.cgi?id=707
lists.fedoraproject.org/pipermail/package-announce/2015-November/171024.html
lists.fedoraproject.org/pipermail/package-announce/2015-November/171054.html
www.debian.org/security/2016/dsa-3440
www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
www.securitytracker.com/id/1034392
www.sudo.ws/stable.html#1.8.15
security.gentoo.org/glsa/201606-13
www.exploit-db.com/exploits/37710/
Social References
More
Related
6.1 Medium
AI Score
Confidence
Low
7.2 High
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
0.001 Low
EPSS
Percentile
25.4%