OS Command Injection in Sudo - CVE-2023-28487

Vulnerability identifier: #VU74197

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-28487

CWE-ID: CWE-78

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when processing control characters in the sudoreplay output. A local user can inject specially crafted characters to the log messages and execute arbitrary OS commands on the system.

Sudo
Amazon Linux AMI
Gentoo Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Software Development Kit 12
SUSE CaaS Platform
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
Oracle Solaris
SUSE Linux Enterprise Server 12 SP4 ESPOS
SUSE Linux Enterprise Server 12 SP4 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Basesystem Module
openSUSE Leap
Ubuntu
openEuler
VMware Tanzu Application Service for VMs
Isolation Segment
IBM Integrated Analytics System
Dell EMC PowerProtect Data Protection
SmartFabric OS10
cflinuxfs3
ObjectScale
Enterprise SONiC
Storage Protect Plus Server
EMC Cloud Tiering Appliance
RecoverPoint for Virtual Machines
IBM Qradar SIEM
LANTIME Operating System Firmware (LTOS)
Juniper Secure Analytics (JSA)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
sudo (Ubuntu package)
sudo-ldap (Ubuntu package)
sudo
sudo-debugsource
sudo-debuginfo
sudo-devel
sudo-help
sudo (Red Hat package)
sudo-plugin-python
sudo-plugin-python-debuginfo
sudo-test
app-admin/sudo
VMware Tanzu Operations Manager
OpenShift Data Foundation (formerly OpenShift Container Storage)
Red Hat Ceph Storage
RecoverPoint for VMs

Install updates from vendor's website.

Sudo - update to 1.9.13
IBM Integrated Analytics System - update to 1.0.31.0
Dell EMC PowerProtect Data Protection - update to 2.7.8
RecoverPoint for Virtual Machines - update to 6.0 SP2 P1
LANTIME Operating System Firmware (LTOS) - update to 7.06.014
Juniper Secure Analytics (JSA) - update to 7.5.0 UP8 IF03
SmartFabric OS10 - addressed in versions 10.5.5.9, 10.5.6.1
sudo (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1.8.21p2-3ubuntu1.6, 1.8.31-1ubuntu1.5, 1.9.9-1ubuntu2.4, 1.9.11p3-1ubuntu1.3
sudo-ldap (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1.8.21p2-3ubuntu1.6, 1.8.31-1ubuntu1.5, 1.9.9-1ubuntu2.4, 1.9.11p3-1ubuntu1.3
cflinuxfs3 - update to 0.361.0
ObjectScale - update to 1.4.0
sudo - addressed in versions 1.8.20p2-3.39.1, 1.8.27-4.38.1, 1.8.27-150000.4.43.1, 1.9.5p2-150300.3.24.1, 1.9.9-150400.4.26.1
sudo-debugsource - addressed in versions 1.8.20p2-3.39.1, 1.8.27-4.38.1, 1.8.27-150000.4.43.1, 1.9.5p2-150300.3.24.1, 1.9.9-150400.4.26.1
sudo-debuginfo - addressed in versions 1.8.20p2-3.39.1, 1.8.27-4.38.1, 1.8.27-150000.4.43.1, 1.9.5p2-150300.3.24.1, 1.9.9-150400.4.26.1
sudo - update to 1.8.23-10.59
sudo-devel - addressed in versions 1.8.27-4.38.1, 1.8.27-150000.4.43.1, 1.9.5p2-150300.3.24.1, 1.9.9-150400.4.26.1
sudo - update to 1.9.2-11
sudo-debuginfo - update to 1.9.2-11
sudo-devel - update to 1.9.2-11
sudo-help - update to 1.9.2-11
sudo-debugsource - update to 1.9.2-11
sudo - update to 1.9.5p2-1.0.1
sudo (Red Hat package) - addressed in versions 1.9.5p2-1.el8_6, 1.9.5p2-1.el8_8, 1.9.5p2-1.el8_9, 1.9.5p2-7.el9_0.4, 1.9.5p2-9.el9_2.2, 1.9.5p2-10.el9_3
sudo-plugin-python - addressed in versions 1.9.5p2-150300.3.24.1, 1.9.9-150400.4.26.1
sudo-plugin-python-debuginfo - addressed in versions 1.9.5p2-150300.3.24.1, 1.9.9-150400.4.26.1
sudo-test - update to 1.9.9-150400.4.26.1
app-admin/sudo - update to 1.9.12-r1
VMware Tanzu Operations Manager - update to 3.0.8
Enterprise SONiC - update to 4.2.1
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.15.0
Red Hat Ceph Storage - update to 5.3
RecoverPoint for VMs - update to 6.0.SP1.P1
IBM Qradar SIEM - update to 7.5.0 Update Pack 8 IF01
Storage Protect Plus Server - update to 10.1.16.1
EMC Cloud Tiering Appliance - update to 13.2.0.2.22

• https://github.com/sudo-project/sudo/commit/334daf92b31b79ce68ed75e2ee14fca265f029ca
• https://github.com/sudo-project/sudo/releases/tag/SUDO_1_9_13

• Local OS command injection in Sudo
• SUSE update for sudo
• SUSE update for sudo
• SUSE update for sudo
• SUSE update for sudo
• SUSE update for sudo
• Ubuntu update for sudo
• Cloud Foundry Foundation cflinuxfs3 update for Sudo
• Multiple vulnerabilities in Dell Cloud Tiering Appliance
• Ubuntu update for sudo
• Multiple vulnerabilities in Oracle Solaris third-party software
• VMware Tanzu products update for Sudo
• Gentoo update for sudo
• Red Hat Enterprise Linux update for sudo
• openEuler update for sudo
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.15
• Multiple vulnerabilities in IBM Storage Protect Plus Server
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Dell Networking OS10
• Multiple vulnerabilities in Dell Enterprise SONiC Distribution
• Multiple vulnerabilities in Dell SmartFabric OS10
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Multiple vulnerabilities in Red Hat Ceph Storage 5
• Amazon Linux AMI update for sudo
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in Dell RecoverPoint for Virtual Machines
• Anolis OS update for sudo
• PowerProtect Data Protection software update for third-party components
• Meinberg LANTIME firmware update for third-party components (May 2023)
• Multiple vulnerabilities in IBM Integrated Analytics System
• Dell RecoverPoint for Virtual Machines update for third-party components