sudo protection bypass

It's possible to bypass password request by manipulating timestamps. Session id hijacking is possible under some conditions...

[SECURITY] [DSA 2642-1] sudo security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2642-1 [email protected] http://www.debian.org/security/ Michael Gilbert March 09, 2013 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 2642-1 (sudo - several issues)

Several vulnerabilities have been discovered in sudo, a program designed to allow a sysadmin to give limited root privileges to users. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2013-1775 Marco Schoepl discovered an authentication bypass when the clock...

DSA-2642-1 sudo - several issues

Bulletin has no description...

Debian: Security Advisory (DSA-2642-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 14.0 / current : sudo (SSA:2013-065-01)

New sudo packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2013-065-01. The text...

sudo

New sudo packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix security issues. Here are the details from the Slackware 14.0 ChangeLog: patches/packages/sudo-1.8.6p7-i486-1slack14.0.txz: Upgraded. This update fixes security issues that could allow a user to...

DEBIAN-CVE-2013-1775

sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting the system clock and sudo user timestamp to the epoch...

CVE-2013-1775

sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting the system clock and sudo user timestamp to the epoch...

CVE-2013-1775

sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting the system clock and sudo user timestamp to the epoch...

Code injection

sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting the system clock and sudo user timestamp to the epoch...

Immunity Canvas: SUDO_TIMESTAMP

Name| sudotimestamp ---|--- CVE| CVE-2013-1775 Exploit Pack| CANVAS Description| sudotimestamp: Linux/MacOS timestamp privilege escalation Notes| CVE Name: CVE-2013-1775 VENDOR: Intel, GNU/Linux, Apple Notes: This exploit runs on GNU/Linux and MacOS X. On both systems this exploit requires: - Use...

Time Stamp Bug in Sudo Could Have Allowed Code Entry

A vulnerability in sudo – a program that manages user privileges on certain types of systems – could allow an unauthenticated user to execute commands for about five minutes, without entering a password. The problem, which has since been fixed, previously existed in builds 1.6.0 through 1.7.10p6...

Ubuntu: Security Advisory (USN-1754-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu Update for sudo USN-1754-1

Check for the Version of sudo OpenVAS Vulnerability Test $Id: gbubuntuUSN17541.nasl 8526 2018-01-25 06:57:37Z teissa $ Ubuntu Update for sudo USN-1754-1 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you...

CVE-2013-1775

CVE-2013-1775 affects sudo 1.6.0–1.7.10p6 and 1.8.0–1.8.6p6. The issue allows a local attacker to bypass time-based authentication by setting the system clock to the epoch, enabling privilege escalation if a user has an active sudo timestamp. Debian notes the fix in 1.7.4p4-2 (squeeze) and 1.8.5p...

CVE-2013-1775

sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting the system clock and sudo user timestamp to the epoch...

CVE-2013-1775

sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting the system clock and sudo user timestamp to the epoch...

FreeBSD : sudo -- Authentication bypass when clock is reset (764344fb-8214-11e2-9273-902b343deec9)

Todd Miller reports : The flaw may allow someone with physical access to a machine that is not password-protected to run sudo commands without knowing the logged in user's password. On systems where sudo is the principal way of running commands as root, such as on Ubuntu and Mac OS X, there is a...

FreeBSD : sudo -- Potential bypass of tty_tickets constraints (82cfd919-8213-11e2-9273-902b343deec9)

Todd Miller reports : A potentially malicious program run by a user with sudo access may be able to bypass the 'ttyticket' constraints. In order for this to succeed there must exist on the machine a terminal device that the user has previously authenticated themselves on via sudo within the last...