Permissions, Privileges, and Access Controls in Sudo - CVE-2013-1775

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU32716

Permissions, Privileges, and Access Controls in Sudo - CVE-2013-1775

Published: March 5, 2013 / Updated: July 28, 2020


Vulnerability identifier: #VU32716
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-1775
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local non-authenticated attacker to execute arbitrary code.

sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting the system clock and sudo user timestamp to the epoch.


Affected software

Sudo
Ubuntu
sudo (Alpine package)
sudo (Ubuntu package)
sudo-ldap (Ubuntu package)

How to mitigate CVE-2013-1775

Install update from vendor's website.

Sudo - addressed in versions 1.7.10p7, 1.8.6p7
sudo (Alpine package) - update to 1.8.6_p7-r0
sudo (Ubuntu package) - addressed in versions 1.6.9p10-1ubuntu3.10, 1.7.2p1-1ubuntu5.6, 1.7.4p6-1ubuntu2.2, 1.8.3p1-1ubuntu3.4, 1.8.5p2-1ubuntu1.1
sudo-ldap (Ubuntu package) - addressed in versions 1.6.9p10-1ubuntu3.10, 1.7.2p1-1ubuntu5.6, 1.7.4p6-1ubuntu2.2, 1.8.3p1-1ubuntu3.4, 1.8.5p2-1ubuntu1.1

External References

Related Security Bulletins