CVE-2012-2337

2012-05-1600:00:00

ubuntu.com

sudo configuration handling

local user bypass

command restrictions

ipv4 address

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

Percentile

5.1%

JSON

sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not
properly support configurations that use a netmask syntax, which allows
local users to bypass intended command restrictions in opportunistic
circumstances by executing a command on a host that has an IPv4 address.

Bugs

<https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/1000276>

Notes

Author	Note
tyhicks	Not easy to reproduce and requires that the user exploiting this flaw to already be specified in the sudoers file

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchsudo< 1.6.9p10-1ubuntu3.9UNKNOWN
ubuntu10.04noarchsudo< 1.7.2p1-1ubuntu5.4UNKNOWN
ubuntu11.04noarchsudo< 1.7.4p4-5ubuntu7.2UNKNOWN
ubuntu11.10noarchsudo< 1.7.4p6-1ubuntu2.1UNKNOWN
ubuntu12.04noarchsudo< 1.8.3p1-1ubuntu3.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	8.04	noarch	sudo	< 1.6.9p10-1ubuntu3.9	UNKNOWN
ubuntu	10.04	noarch	sudo	< 1.7.2p1-1ubuntu5.4	UNKNOWN
ubuntu	11.04	noarch	sudo	< 1.7.4p4-5ubuntu7.2	UNKNOWN
ubuntu	11.10	noarch	sudo	< 1.7.4p6-1ubuntu2.1	UNKNOWN
ubuntu	12.04	noarch	sudo	< 1.8.3p1-1ubuntu3.2	UNKNOWN