Lucene search

K
osvGoogleOSV:DSA-2642-1
HistoryMar 09, 2013 - 12:00 a.m.

sudo - several issues

2013-03-0900:00:00
Google
osv.dev
8

6.9 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

8.3%

Several vulnerabilities have been discovered in sudo, a program designed
to allow a sysadmin to give limited root privileges to users. The Common
Vulnerabilities and Exposures project identifies the following problems:

  • CVE-2013-1775
    Marco Schoepl discovered an authentication bypass when the clock is
    set to the UNIX epoch [00:00:00 UTC on 1 January 1970].
  • CVE-2013-1776
    Ryan Castellucci and James Ogden discovered aspects of an issue that
    would allow session id hijacking from another authorized tty.

For the stable distribution (squeeze), these problems have been fixed in
version 1.7.4p4-2.squeeze.4.

For the testing (wheezy) and unstable (sid) distributions, these problems
have been fixed in version 1.8.5p2-1+nmu1.

We recommend that you upgrade your sudo packages.

6.9 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

8.3%