CVE-2017-1000367

Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.
Race Condition
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.4 MEDIUM
LOCAL
HIGH
HIGH
CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 95%
Affected Products (NVD)
VendorProductVersion
sudo_projectsudo
𝑥
≤ 1.8.20
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
sudo
bookworm
1.9.13p3-1+deb12u1
fixed
bullseye
1.9.5p2-3+deb11u1
fixed
bullseye (security)
1.9.5p2-3+deb11u1
fixed
sid
1.9.16-2
fixed
trixie
1.9.16-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
sudo
trusty
Fixed 1.8.9p5-1ubuntu1.4
released
xenial
Fixed 1.8.16-0ubuntu1.4
released
yakkety
Fixed 1.8.16-0ubuntu3.2
released
zesty
Fixed 1.8.19p1-1ubuntu1.1
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
sudo
suse enterprise desktop 15
1.8.22-2.11
fixed
suse enterprise desktop 15 SP1
1.8.22-4.3.3
fixed
suse enterprise desktop 15 SP2
1.8.22-4.9.1
fixed
suse enterprise desktop 15 SP4
1.9.9-150400.2.5
fixed
suse enterprise sap 15
1.8.22-2.11
fixed
suse enterprise sap 15 SP1
1.8.22-4.3.3
fixed
suse enterprise sap 15 SP2
1.8.22-4.9.1
fixed
suse enterprise sap 15 SP4
1.9.9-150400.2.5
fixed
suse enterprise server 15
1.8.22-2.11
fixed
suse enterprise server 15 SP1
1.8.22-4.3.3
fixed
suse enterprise server 15 SP2
1.8.22-4.9.1
fixed
suse enterprise server 15 SP4
1.9.9-150400.2.5
fixed
sudo-devel
suse enterprise desktop 15
1.8.22-2.11
fixed
suse enterprise desktop 15 SP1
1.8.22-4.3.3
fixed
suse enterprise desktop 15 SP2
1.8.22-4.9.1
fixed
suse enterprise desktop 15 SP4
1.9.9-150400.2.5
fixed
suse enterprise sap 15
1.8.22-2.11
fixed
suse enterprise sap 15 SP1
1.8.22-4.3.3
fixed
suse enterprise sap 15 SP2
1.8.22-4.9.1
fixed
suse enterprise sap 15 SP4
1.9.9-150400.2.5
fixed
suse enterprise server 15
1.8.22-2.11
fixed
suse enterprise server 15 SP1
1.8.22-4.3.3
fixed
suse enterprise server 15 SP2
1.8.22-4.9.1
fixed
suse enterprise server 15 SP4
1.9.9-150400.2.5
fixed
sudo-plugin-python
suse enterprise desktop 15 SP4
1.9.9-150400.2.5
fixed
suse enterprise sap 15 SP4
1.9.9-150400.2.5
fixed
suse enterprise server 15 SP4
1.9.9-150400.2.5
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
sudo
RHEL 6
0:1.8.6p3-28.el6_9
fixed
RHEL 7
0:1.8.6p7-22.el7_3
fixed
sudo-devel
RHEL 6
0:1.8.6p3-28.el6_9
fixed
RHEL 7
0:1.8.6p7-22.el7_3
fixed
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00077.html
http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00078.html
http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00079.html
http://packetstormsecurity.com/files/142783/Sudo-get_process_ttyname-Race-Condition.html
http://seclists.org/fulldisclosure/2017/Jun/3
http://www.debian.org/security/2017/dsa-3867
http://www.openwall.com/lists/oss-security/2017/05/30/16
http://www.openwall.com/lists/oss-security/2022/12/22/5
http://www.openwall.com/lists/oss-security/2022/12/22/6
http://www.securityfocus.com/bid/98745
http://www.securitytracker.com/id/1038582
http://www.ubuntu.com/usn/USN-3304-1
https://access.redhat.com/errata/RHSA-2017:1381
https://access.redhat.com/errata/RHSA-2017:1382
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEXC4NNIG2QOZY6N2YUK246KI3D3UQO/
https://security.gentoo.org/glsa/201705-15
https://www.exploit-db.com/exploits/42183/
https://www.sudo.ws/alerts/linux_tty.html
http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00077.html
http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00078.html
http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00079.html
http://packetstormsecurity.com/files/142783/Sudo-get_process_ttyname-Race-Condition.html
http://seclists.org/fulldisclosure/2017/Jun/3
http://www.debian.org/security/2017/dsa-3867
http://www.openwall.com/lists/oss-security/2017/05/30/16
http://www.openwall.com/lists/oss-security/2022/12/22/5
http://www.openwall.com/lists/oss-security/2022/12/22/6
http://www.securityfocus.com/bid/98745
http://www.securitytracker.com/id/1038582
http://www.ubuntu.com/usn/USN-3304-1
https://access.redhat.com/errata/RHSA-2017:1381
https://access.redhat.com/errata/RHSA-2017:1382
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEXC4NNIG2QOZY6N2YUK246KI3D3UQO/
https://security.gentoo.org/glsa/201705-15
https://www.exploit-db.com/exploits/42183/
https://www.sudo.ws/alerts/linux_tty.html