Format string error in Sudo - CVE-2012-0809
Published: February 1, 2012 / Updated: July 29, 2020
Vulnerability identifier: #VU32823
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2012-0809
CWE-ID: CWE-134
Exploitation vector: Local access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a local non-authenticated attacker to execute arbitrary code.
Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbitrary code via format string sequences in the program name for sudo.
Affected software
Sudo
Gentoo Linux
sudo (Alpine package)
Gentoo Linux
sudo (Alpine package)
How to mitigate CVE-2012-0809
Install update from vendor's website.
Sudo - update to 1.8.3p2
sudo (Alpine package) - update to 1.8.3_p2-r0
sudo (Alpine package) - update to 1.8.3_p2-r0