Authorization Bypass

2019-01-1508:54:23

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

JSON

sudo is vulnerable to authorization bypass. This is due to improper handling of multiple IP networks listed in user specification configuration directives. A local user who is authorized to run commands with sudo on specific hosts is able to bypass restrictions and run commands on hosts that are not matched by any of the network specifications.

CPENameOperatorVersion
sudoeq1.7.2p1__9.el5_5
sudoeq1.7.2p1__13.el5
sudoeq1.7.2p1__10.el5
sudoeq1.6.9p17__3.el5_3.1
sudoeq1.7.4p5__9.el6_2
sudoeq1.6.9p17__3.el5
sudoeq1.7.4p5__7.el6
sudoeq1.6.9p17__5.el5
sudoeq1.7.2p1__8.el5_5
sudoeq1.7.2p2__9.el6

Name	Operator	Version
sudo	eq	1.7.2p1__9.el5_5
sudo	eq	1.7.2p1__13.el5
sudo	eq	1.7.2p1__10.el5
sudo	eq	1.6.9p17__3.el5_3.1
sudo	eq	1.7.4p5__9.el6_2
sudo	eq	1.6.9p17__3.el5
sudo	eq	1.7.4p5__7.el6
sudo	eq	1.6.9p17__5.el5
sudo	eq	1.7.2p1__8.el5_5
sudo	eq	1.7.2p2__9.el6