Executive Summary

Summary
Title Sudo set_cmd() is vulnerable to heap-based buffer overflow
Informations
Name VU#794544 First vendor Publication 2021-02-04
Vendor VU-CERT Last vendor Modification 2021-04-07
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Overall CVSS Score 7.8
Base Score 7.8 Environmental Score 7.8
impact SubScore 5.9 Temporal Score 7.8
Exploitabality Sub Score 1.8
 
Attack Vector Local Attack Complexity Low
Privileges Required Low User Interaction None
Scope Unchanged Confidentiality Impact High
Integrity Impact High Availability Impact High
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 7.2 Attack Range Local
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 3.9 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Overview

A heap-based overflow has been discovered in the set_cmd() function in sudo, which may allow a local attacker to execute commands with elevated administrator privileges.

Description

From the Sudo Main Page:

Sudo (su "do") allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments.

It is possible for a local Non-administrative user to exploit this vulnerability to elevate their privileges so that they can execute commands with administrator privileges. The team at Qualys assigned this vulnerability CVE-2021-3156 and found multiple *nix operating systems were vulnerable, including Fedora, Debian, and Ubuntu. A blog update from February 3, 2021, reports that macOS, AIX, and Solaris may be vulnerable, but Qualys had not yet confirmed this. There is additional reporting that other operating systems are affected, including Apple?s Big Sur.

Impact

If an attacker has local access to an affected machine then it is possible for them to execute commands with administrator privileges.

Solution

Apply an Update

Update sudo to the latest version to address this vulnerability when operationally feasible. This issue is resolved in sudo version 1.9.5p2. Please install this version, or a version from your distribution that has the fix applied to it

Acknowledgements

This vulnerability was researched and reported by the Qualys Research Team.

This document was written by Timur Snoke.

Original Source

Url : https://kb.cert.org/vuls/id/794544

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-193 Off-by-one Error

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Application 1
Application 3
Application 1
Application 1
Application 1
Application 132
Application 1
Application 1
Os 2
Os 2

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
Date Informations
2021-04-07 21:17:59
  • Multiple Updates
2021-04-05 17:17:36
  • Multiple Updates
2021-03-29 17:17:39
  • Multiple Updates
2021-03-26 13:17:52
  • Multiple Updates
2021-02-15 21:18:01
  • Multiple Updates
2021-02-10 21:17:58
  • Multiple Updates
2021-02-08 17:17:33
  • Multiple Updates
2021-02-05 17:17:35
  • Multiple Updates
2021-02-05 00:17:35
  • First insertion