sudoedit.txt

Reference http://www.sudo.ws/sudo/alerts/sudoedit.html Summary A flaw in exists in sudo's -u option aka sudoedit in sudo version 1.6.8 that can give an attacker read permission to a file that would otherwise be unreadable. Sudo versions affected 1.6.8 only Details While sudoedit runs the actual...

Sudo 1.6.8 - Information Disclosure

// source: https://www.securityfocus.com/bid/11204/info Sudo is reported prone to an information disclosure vulnerability. This vulnerability presents itself when sudo is called with the '-e' option, or the 'sudoedit' command is invoked. In certain circumstances, attackers may access the contents...

Sudo 1.6.8 - Information Disclosure

Sudo 1.6.8 - Information Disclosure // source: https://www.securityfocus.com/bid/11204/info Sudo is reported prone to an information disclosure vulnerability. This vulnerability presents itself when sudo is called with the '-e' option, or the 'sudoedit' command is invoked. In certain circumstance...

sudo -- sudoedit information disclosure

A new feature of sudo 1.6.8 called "sudoedit" a safe editing facility may allow users to read files to which they normally have no access...

Sudoedit can expose file contents

Sudoedit can expose file contents Summary: A flaw in exists in sudo's -u option aka sudoedit in sudo version 1.6.8 that can give an attacker read permission to a file that would otherwise be unreadable. Sudo versions affected: 1.6.8 only Details: While sudoedit runs the actual editor as the...

Sudo symboli links problem

Unsafe temporary fiels access in sudo -u...

Mandrake Linux Security Advisory : sudo (MDKSA-2002:003)

The SuSE Security Team discovered a vulnerability in sudo that can be exploited to obtain root privilege because sudo is installed setuid root. An attacker could trick sudo to log failed sudo calls executing the sendmail or equivalent mailer program with root privileges and an environment that is...

Mandrake Linux Security Advisory : sudo (MDKSA-2002:028)

A problem was discovered by fc, with further research by Global InterSec, in the sudo program with the password prompt parameter -p. Sudo can be tricked into allocating less memory than it should for the prompt and in certain conditions it is possible to exploit this flaw to corrupt the heap in...

Antologic Antolinux 1.0 - Administrative Interface NDCR Remote Command Execution

Antologic Antolinux 1.0 - Administrative Interface NDCR Remote Command Execution source: https://www.securityfocus.com/bid/9495/info It has been reported that Antologic Antolinux may be prone to a remote command execution vulnerability that may allow an attacker to execute arbitrary commands with...

[Full-Disclosure] Vulnerability in Terminal.app

There is a vulnerability in Apple's Terminal.app for OS X which affects Apple laptops. When running from the Terminal within the Unix shell, the command sudo normally will not prompt for a password for five minutes after the password was last given. The vulnerability occurs when putting an Apple...

MacOS X privilege escalation

If short after sudo command computer was switched to sleep mode, it's still possible to use elevated privileges immediately after turning on again...

CVE-2002-0184

The CVE-2002-0184 entry describes a local privilege-escalation in sudo prior to version 1.6.6 due to an off-by-one/doorknob in the heap-based overflow during prompt ( -p ) handling. The flaw is triggered by special characters in the -p prompt, which are not properly expanded, allowing a local use...

CVE-2002-0184

Sudo before 1.6.6 contains an off-by-one error that can result in a heap-based buffer overflow that may allow local users to gain root privileges via special characters in the -p prompt argument, which are not properly expanded...

CVE-2002-0043

sudo 1.6.0 through 1.6.3p7 does not properly clear the environment before calling the mail program, which could allow local users to gain root privileges by modifying environment variables and changing how the mail program is invoked...

CVE-2002-0043

This CVE affects sudo versions 1.6.0–1.6.3p7. The issue is that sudo does not properly clear the environment before calling the mail program, allowing a local user to gain root privileges by manipulating environment variables and how the mail program is invoked. Documented impact is local privile...

CVE-2001-1240

The default configuration of sudo in Engarde Secure Linux 1.0.1 allows any user in the admin group to run certain commands that could be leveraged to gain full root access...

CVE-2001-1240

The CVE-2001-1240 entry concerns Engarde Secure Linux 1.0.1 where the default sudo configuration allows any user in the admin group to execute certain commands that could yield full root access. The documents confirm the affected component is the sudo configuration on Engarde Secure Linux 1.0.1 a...

CVE-2002-0184

Sudo before 1.6.6 contains an off-by-one error that can result in a heap-based buffer overflow that may allow local users to gain root privileges via special characters in the -p prompt argument, which are not properly expanded...

sudo vulnerable to heap corruption via -p parameter

Overview Sudo is susceptible to a locally exploitable heap overflow vulnerability. Description Sudo is a common utility used to allow a system administrator to give users or groups of users rights to run certain programs as root or as another user. A locally exploitable heap overflow can lead to...

[SECURITY] [DSA-128-1] sudo buffer overflow

Package : sudo Problem type : buffer overflow Debian-specific: no fc found a buffer overflow in the variable expansion code used by sudo for its prompt. Since sudo is necessarily installed suid root a local user can use this to gain root access. This has been fixed in version 1.6.2-2.2 and we...