Sudo vulnerability

2015-03-1600:00:00

ubuntu.com

3.3 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.5 Medium

AI Score

Confidence

Low

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

5.3%

JSON

Releases

Ubuntu 14.10
Ubuntu 14.04 ESM
Ubuntu 12.04
Ubuntu 10.04

Packages

sudo - Provide limited super user privileges to specific users

Details

Jakub Wilk and Stephane Chazelas discovered that Sudo incorrectly handled
the TZ environment variable. An attacker with Sudo access could possibly
use this issue to open arbitrary files, bypassing intended permissions.

OSVersionArchitecturePackageVersionFilename
Ubuntu14.10noarchsudo< 1.8.9p5-1ubuntu2.1UNKNOWN
Ubuntu14.10noarchsudo-ldap< 1.8.9p5-1ubuntu2.1UNKNOWN
Ubuntu14.04noarchsudo< 1.8.9p5-1ubuntu1.1UNKNOWN
Ubuntu14.04noarchsudo-ldap< 1.8.9p5-1ubuntu1.1UNKNOWN
Ubuntu12.04noarchsudo< 1.8.3p1-1ubuntu3.7UNKNOWN
Ubuntu12.04noarchsudo-ldap< 1.8.3p1-1ubuntu3.7UNKNOWN
Ubuntu10.04noarchsudo< 1.7.2p1-1ubuntu5.8UNKNOWN
Ubuntu10.04noarchsudo-ldap< 1.7.2p1-1ubuntu5.8UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	14.10	noarch	sudo	< 1.8.9p5-1ubuntu2.1	UNKNOWN
Ubuntu	14.10	noarch	sudo-ldap	< 1.8.9p5-1ubuntu2.1	UNKNOWN
Ubuntu	14.04	noarch	sudo	< 1.8.9p5-1ubuntu1.1	UNKNOWN
Ubuntu	14.04	noarch	sudo-ldap	< 1.8.9p5-1ubuntu1.1	UNKNOWN
Ubuntu	12.04	noarch	sudo	< 1.8.3p1-1ubuntu3.7	UNKNOWN
Ubuntu	12.04	noarch	sudo-ldap	< 1.8.3p1-1ubuntu3.7	UNKNOWN
Ubuntu	10.04	noarch	sudo	< 1.7.2p1-1ubuntu5.8	UNKNOWN
Ubuntu	10.04	noarch	sudo-ldap	< 1.7.2p1-1ubuntu5.8	UNKNOWN