Risk | Low |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2012-0809 |
CWE-ID | CWE-134 |
Exploitation vector | Local |
Public exploit | Public exploit code for vulnerability #1 is available. |
Vulnerable software Subscribe |
sudo (Alpine package) Operating systems & Components / Operating system package or component |
Vendor | Alpine Linux Development Team |
This security bulletin contains one low risk vulnerability.
EUVDB-ID: #VU32823
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2012-0809
CWE-ID:
CWE-134 - Use of Externally-Controlled Format String
Exploit availability: Yes
DescriptionThe vulnerability allows a local non-authenticated attacker to execute arbitrary code.
Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbitrary code via format string sequences in the program name for sudo.
MitigationInstall update from vendor's website.
Vulnerable software versionssudo (Alpine package): 1.8.1p1-r0 - 1.8.3_p1-r0
http://git.alpinelinux.org/aports/commit/?id=0fda40c88e85cf7ae9cbee333fe7eb2aed9871bc
http://git.alpinelinux.org/aports/commit/?id=86e58ceec6c6f67f981f17f8e41af6291a198c3d
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?