Information disclosure in Sudo - CVE-2014-9680
Published: April 24, 2017 / Updated: July 28, 2020
Vulnerability identifier: #VU32438
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-9680
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local authenticated user to gain access to sensitive information.
sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not view file contents) by running a program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log messages, or repositioning tape drives.
Affected software
Sudo
Gentoo Linux
Slackware Linux
Fedora
sudo (Alpine package)
sudo
Gentoo Linux
Slackware Linux
Fedora
sudo (Alpine package)
sudo
How to mitigate CVE-2014-9680
Install update from vendor's website.
Sudo - update to 1.8.12
sudo (Alpine package) - update to 1.8.12-r0
sudo - update to 1.8.12-1.fc21
sudo (Alpine package) - update to 1.8.12-r0
sudo - update to 1.8.12-1.fc21