DebianDEBIAN:DLA-707-1:A2A4B[SECURITY] [DLA 707-1] sudo security update
7.2 High
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8 High
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
5.1%
Package : sudo
Version : 1.8.5p2-1+nmu3+deb7u2
CVE ID : CVE-2016-7032 CVE-2016-7076
Debian Bug : 842507
It was discovered that the sudo noexec restriction could have been
bypassed if application run via sudo executed system(), popen() or
wordexp() C library functions with a user supplied argument. A local
user permitted to run such application via sudo with noexec
restriction could possibly use this flaw to execute arbitrary commands
with elevated privileges.
CVE-2016-7032
noexec bypass via system() and popen()
CVE-2016-7076
noexec bypass via wordexp()
For Debian 7 "Wheezy", these problems have been fixed in version
1.8.5p2-1+nmu3+deb7u2.
We recommend that you upgrade your sudo packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 7 | amd64 | sudo-ldap | < 1.8.5p2-1+nmu3+deb7u2 | sudo-ldap_1.8.5p2-1+nmu3+deb7u2_amd64.deb |
| Debian | 7 | amd64 | sudo | < 1.8.5p2-1+nmu3+deb7u2 | sudo_1.8.5p2-1+nmu3+deb7u2_amd64.deb |
| Debian | 7 | armhf | sudo | < 1.8.5p2-1+nmu3+deb7u2 | sudo_1.8.5p2-1+nmu3+deb7u2_armhf.deb |
| Debian | 7 | i386 | sudo | < 1.8.5p2-1+nmu3+deb7u2 | sudo_1.8.5p2-1+nmu3+deb7u2_i386.deb |
| Debian | 7 | all | sudo | < 1.8.5p2-1+nmu3+deb7u2 | sudo_1.8.5p2-1+nmu3+deb7u2_all.deb |
| Debian | 7 | armel | sudo-ldap | < 1.8.5p2-1+nmu3+deb7u2 | sudo-ldap_1.8.5p2-1+nmu3+deb7u2_armel.deb |
| Debian | 7 | i386 | sudo-ldap | < 1.8.5p2-1+nmu3+deb7u2 | sudo-ldap_1.8.5p2-1+nmu3+deb7u2_i386.deb |
| Debian | 7 | armel | sudo | < 1.8.5p2-1+nmu3+deb7u2 | sudo_1.8.5p2-1+nmu3+deb7u2_armel.deb |
| Debian | 7 | armhf | sudo-ldap | < 1.8.5p2-1+nmu3+deb7u2 | sudo-ldap_1.8.5p2-1+nmu3+deb7u2_armhf.deb |
Related
7.2 High
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8 High
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
5.1%