Permissions, Privileges, and Access Controls in Sudo - CVE-2012-2337

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU32797

Permissions, Privileges, and Access Controls in Sudo - CVE-2012-2337

Published: May 18, 2012 / Updated: July 28, 2020


Vulnerability identifier: #VU32797
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2012-2337
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local non-authenticated attacker to execute arbitrary code.

sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations that use a netmask syntax, which allows local users to bypass intended command restrictions in opportunistic circumstances by executing a command on a host that has an IPv4 address.


Affected software

Sudo
Gentoo Linux
Amazon Linux AMI
Ubuntu
sudo (Alpine package)
sudo (Ubuntu package)
sudo-ldap (Ubuntu package)

How to mitigate CVE-2012-2337

Install update from vendor's website.

Sudo - addressed in versions 1.7.9p1, 1.8.4p5
sudo (Alpine package) - update to 1.7.9_p1-r0
sudo (Ubuntu package) - addressed in versions 1.6.9p10-1ubuntu3.9, 1.7.2p1-1ubuntu5.4, 1.7.4p4-5ubuntu7.2, 1.7.4p6-1ubuntu2.1, 1.8.3p1-1ubuntu3.2
sudo-ldap (Ubuntu package) - addressed in versions 1.6.9p10-1ubuntu3.9, 1.7.2p1-1ubuntu5.4, 1.7.4p4-5ubuntu7.2, 1.7.4p6-1ubuntu2.1, 1.8.3p1-1ubuntu3.2

External References

Related Security Bulletins