sudo 1.3.5 through 1.7.10p5 and 1.8.0 through 1.8.6p6, when running on systems without /proc or the sysctl function with the tty_tickets option enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another terminal. NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - added patch for CVE-2014-0106: certain environment     variables not sanitized when env_reset is disabled     Resolves: rhbz#1072210

  - backported fixes for CVE-2013-1775 CVE-2013-1776     (CVE-2013-2776) CVE-2013-2777 Resolves: rhbz#968221

  - visudo: fixed incorrect warning and parse error     regarding undefined aliases which were in fact defined     Resolves: rhbz#849679 Resolves: rhbz#905624

  - updated sudoers man-page to clarify the behavior of the     user negation operator and the behavior of wildcard     matching in command specifications Resolves: rhbz#846118     Resolves: rhbz#856902

  - fixed regression in escaping of sudo -i arguments     Resolves: rhbz#853203

  - bump release number

  - Fixed caching of user and group names

  - Backported RFC 4515 escaping of LDAP queries Resolves:
    rhbz#855836 Resolves: rhbz#869287

  - Add the -c option to sed commands in post/postun scripts     Resolves: rhbz#818585

  - Implement a new sudoers Defaults option to restore old     command exec behavior Resolves: rhbz#840971

  - Add ability to treat files authoritatively in     sudoers.ldap Resolves: rhbz#840097

  - Changed policycoreutils dependency to a context specific     dependency (post & postun) Resolves: rhbz#846694

  - don't use a temporary file when modifying nsswitch.conf

  - fix permissions on nsswitch.conf, if needed Resolves:
    rhbz#846631

  - added a workaround for a race condition in handling     child processes Resolves: rhbz#829263

  - use safe temporary files in post/postun scripts

  - corrected postun script Resolves: rhbz#841070

  - corrected release number

  - call restorecon after modifying nsswitch.conf in the     postun scriplet

  - added policycoreutils dependency Resolves: rhbz#818585

  - fixed `sudo -i' command escaping (#806073)

  - fixed multiple sudoHost LDAP attr. handlng (#740884)     Resolves: rhbz#740884 Resolves: rhbz#806073

The remote host is running a version of Mac OS X 10.10.x that is prior to version 10.10.5. The installed version is affected by multiple vulnerabilities in the following components :

 - apache (CVE-2014-3581, CVE-2014-3583, CVE-2014-8109, CVE-2015-0228, CVE-2015-0253, CVE-2015-3183, CVE-2015-3185)
 - apache_mod_php (CVE-2015-2783, CVE-2015-2787, CVE-2015-3307, CVE-2015-3329, CVE-2015-3330, CVE-2015-4021, CVE-2015-4022, CVE-2015-4024, CVE-2015-4025, CVE-2015-4026, CVE-2015-4147, CVE-2015-4148)
 - Apple ID OD Plug-in (CVE-2015-3799)
 - AppleGraphicsControl (CVE-2015-5768)
 - Bluetooth (CVE-2015-3777, CVE-2015-3779, CVE-2015-3780, CVE-2015-3786, CVE-2015-3787)
 - bootp (CVE-2015-3778)
 - CloudKit (CVE-2015-3782)
 - CoreMedia Playback (CVE-2015-5777, CVE-2015-5778)
 - CoreText (CVE-2015-5761, CVE-2015-5755)
 - curl (CVE-2014-3613, CVE-2014-3620, CVE-2014-3707, CVE-2014-8150, CVE-2014-8151, CVE-2015-3143, CVE-2015-3144, CVE-2015-3145, CVE-2015-3148, CVE-2015-3153)
 - Data Detectors Engine (CVE-2015-5750)
 - Date & Time pref pane (CVE-2015-3757)
 - Dictionary Application (CVE-2015-3774)
 - DiskImages (CVE-2015-3800)
 - dyld (CVE-2015-3760)
 - FontParser (CVE-2015-3804, CVE-2015-5775, CVE-2015-5756)
 - groff (CVE-2009-5044, CVE-2009-5078)
 - ImageIO (CVE-2015-5758, CVE-2015-5781, CVE-2015-5782)
 - Install Framework Legacy (CVE-2015-5784, CVE-2015-5754)
 - IOFireWireFamily (CVE-2015-3769, CVE-2015-3771, CVE-2015-3772)
 - IOGraphics (CVE-2015-3770, CVE-2015-5783)
 - IOHIDFamily (CVE-2015-5774)
 - Kernel (CVE-2015-3766, CVE-2015-3768, CVE-2015-5747, CVE-2015-5748, CVE-2015-3806, CVE-2015-3803, CVE-2015-3802, CVE-2015-3805, CVE-2015-3776, CVE-2015-3761)
 - Libc (CVE-2015-3796, CVE-2015-3797, CVE-2015-3798)
 - Libinfo (CVE-2015-5776)
 - libpthread (CVE-2015-5757)
 - libxml2 (CVE-2014-0191, CVE-2014-3660, CVE-2015-3807)
 - libxpc (CVE-2015-3795)
 - mail_cmds (CVE-2014-7844)
 - Notification Center OSX (CVE-2015-3764)
 - ntfs (CVE-2015-5763)
 - OpenSSH (CVE-2015-5600)
 - OpenSSL (CVE-2015-1788, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791, CVE-2015-1792)
 - perl (CVE-2013-7422)
 - PostgreSQL (CVE-2014-0067, CVE-2014-8161, CVE-2015-0241, CVE-2015-0242, CVE-2015-0243, CVE-2015-0244)
 - python (CVE-2013-7040, CVE-2013-7338, CVE-2014-1912, CVE-2014-7185, CVE-2014-9365)
 - QL Office (CVE-2015-5773, CVE-2015-3784)
 - Quartz Composer Framework (CVE-2015-5771)
 - Quick Look (CVE-2015-3781)
 - QuickTime 7 (CVE-2015-3779, CVE-2015-5753, CVE-2015-5779, CVE-2015-3765, CVE-2015-3788, CVE-2015-3789, CVE-2015-3790, CVE-2015-3791, CVE-2015-3792, CVE-2015-5751)
 - SceneKit (CVE-2015-5772, CVE-2015-3783)
 - Security (CVE-2015-3775)
 - SMBClient (CVE-2015-3773)
 - Speech UI (CVE-2015-3794)
 - sudo (CVE-2013-1775, CVE-2013-1776, CVE-2013-2776, CVE-2013-2777, CVE-2014-0106, CVE-2014-9680)
 - tcpdump (CVE-2014-8767, CVE-2014-8769, CVE-2014-9140)
 - Text Formats (CVE-2015-3762)
 - udf (CVE-2015-3767)

 Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.5. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - apache_mod_php
  - Apple ID OD Plug-in
  - AppleGraphicsControl
  - Bluetooth
  - bootp
  - CloudKit
  - CoreMedia Playback
  - CoreText
  - curl
  - Data Detectors Engine
  - Date & Time pref pane
  - Dictionary Application
  - DiskImages
  - dyld
  - FontParser
  - groff
  - ImageIO
  - Install Framework Legacy
  - IOFireWireFamily
  - IOGraphics
  - IOHIDFamily
  - Kernel
  - Libc
  - Libinfo
  - libpthread
  - libxml2
  - libxpc
  - mail_cmds
  - Notification Center OSX
  - ntfs
  - OpenSSH
  - OpenSSL
  - perl
  - PostgreSQL
  - python
  - QL Office
  - Quartz Composer Framework
  - Quick Look
  - QuickTime 7
  - SceneKit
  - Security
  - SMBClient
  - Speech UI
  - sudo
  - tcpdump
  - Text Formats
  - udf 

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

An updated sudo package that fixes two security issues, several bugs, and adds two enhancements is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root.

A flaw was found in the way sudo handled time stamp files. An attacker able to run code as a local user and with the ability to control the system clock could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1775)

It was found that sudo did not properly validate the controlling terminal device when the tty_tickets option was enabled in the /etc/sudoers file. An attacker able to run code as a local user could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-2776, CVE-2013-2777)

This update also fixes the following bugs :

* Previously, sudo did not support netgroup filtering for sources from the System Security Services Daemon (SSSD). Consequently, SSSD rules were applied to all users even when they did not belong to the specified netgroup. With this update, netgroup filtering for SSSD sources has been implemented. As a result, rules with a netgroup specification are applied only to users that are part of the netgroup.
(BZ#880150)

* When the sudo utility set up the environment in which it ran a command, it reset the value of the RLIMIT_NPROC resource limit to the parent's value of this limit if both the soft (current) and hard (maximum) values of RLIMIT_NPROC were not limited. An upstream patch has been provided to address this bug and RLIMIT_NPROC can now be set to 'unlimited'. (BZ#947276)

* Due to the refactoring of the sudo code by upstream, the SUDO_USER variable that stores the name of the user running the sudo command was not logged to the /var/log/secure file as before. Consequently, user name 'root' was always recorded instead of the real user name. With this update, the previous behavior of sudo has been restored. As a result, the expected user name is now written to /var/log/secure.
(BZ#973228)

* Due to an error in a loop condition in sudo's rule listing code, a buffer overflow could have occurred in certain cases. This condition has been fixed and the buffer overflow no longer occurs. (BZ#994626)

In addition, this update adds the following enhancements :

* With this update, sudo has been modified to send debug messages about netgroup matching to the debug log. These messages should provide better understanding of how sudo matches netgroup database records with values from the running system and what the values are exactly. (BZ#848111)

* With this update, sudo has been modified to accept the ipa_hostname value from the /etc/sssd/sssd.conf configuration file when matching netgroups. (BZ#853542)

All sudo users are advised to upgrade to this updated package, which contains backported patches to correct these issues and add these enhancements.

An updated sudo package that fixes multiple security issues and several bugs is now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root.

A flaw was found in the way sudo handled time stamp files. An attacker able to run code as a local user and with the ability to control the system clock could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1775)

It was found that sudo did not properly validate the controlling terminal device when the tty_tickets option was enabled in the /etc/sudoers file. An attacker able to run code as a local user could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1776, CVE-2013-2776)

This update also fixes the following bugs :

* Due to a bug in the cycle detection algorithm of the visudo utility, visudo incorrectly evaluated certain alias definitions in the /etc/sudoers file as cycles. Consequently, a warning message about undefined aliases appeared. This bug has been fixed, /etc/sudoers is now parsed correctly by visudo and the warning message no longer appears. (BZ#849679)

* Previously, the 'sudo -l' command did not parse the /etc/sudoers file correctly if it contained an Active Directory (AD) group. The file was parsed only up to the first AD group information and then the parsing failed with the following message :

sudo: unable to cache group ADDOM\admingroup, already exists

With this update, the underlying code has been modified and 'sudo -l' now parses /etc/sudoers containing AD groups correctly. (BZ#855836)

* Previously, the sudo utility did not escape the backslash characters contained in user names properly. Consequently, if a system used sudo integrated with LDAP or Active Directory (AD) as the primary authentication mechanism, users were not able to authenticate on that system. With this update, sudo has been modified to process LDAP and AD names correctly and the authentication process now works as expected. (BZ#869287)

* Prior to this update, the 'visudo -s (strict)' command incorrectly parsed certain alias definitions. Consequently, an error message was issued. The bug has been fixed, and parsing errors no longer occur when using 'visudo

* s'. (BZ#905624)

All sudo users are advised to upgrade to this updated package, which contains backported patches to correct these issues.

The remote host is affected by the vulnerability described in GLSA-201401-23 (sudo: Privilege escalation)

    Multiple vulnerabilities have been found in sudo:
      sudo does not correctly validate the controlling terminal on a system         without /proc or when the tty_tickets option is enabled.
      sudo does not properly handle the clock when it is set to the epoch.
  Impact :

    A local attacker with sudo privileges could connect to the stdin,       stdout, and stderr of the terminal of a user who has authenticated with       sudo, allowing the attacker to hijack the authorization of the other       user. Additionally, a local or physically proximate attacker could set       the system clock to the epoch, bypassing time restrictions on sudo       authentication.
  Workaround :

    There is no known workaround at this time.

A flaw was found in the way sudo handled time stamp files. An attacker able to run code as a local user and with the ability to control the system clock could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1775)

It was found that sudo did not properly validate the controlling terminal device when the tty_tickets option was enabled in the /etc/sudoers file. An attacker able to run code as a local user could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-2776 , CVE-2013-2777)

A flaw was found in the way sudo handled time stamp files. An attacker able to run code as a local user and with the ability to control the system clock could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1775)

It was found that sudo did not properly validate the controlling terminal device when the tty_tickets option was enabled in the /etc/sudoers file. An attacker able to run code as a local user could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-2776, CVE-2013-2777)

This update also fixes the following bugs :

  - Previously, sudo did not support netgroup filtering for     sources from the System Security Services Daemon (SSSD).
    Consequently, SSSD rules were applied to all users even     when they did not belong to the specified netgroup. With     this update, netgroup filtering for SSSD sources has     been implemented. As a result, rules with a netgroup     specification are applied only to users that are part of     the netgroup.

  - When the sudo utility set up the environment in which it     ran a command, it reset the value of the RLIMIT_NPROC     resource limit to the parent's value of this limit if     both the soft (current) and hard (maximum) values of     RLIMIT_NPROC were not limited. An upstream patch has     been provided to address this bug and RLIMIT_NPROC can     now be set to 'unlimited'.

  - Due to the refactoring of the sudo code by upstream, the     SUDO_USER variable that stores the name of the user     running the sudo command was not logged to the     /var/log/secure file as before. Consequently, user name     'root' was always recorded instead of the real user     name. With this update, the previous behavior of sudo     has been restored. As a result, the expected user name     is now written to /var/log/secure.

  - Due to an error in a loop condition in sudo's rule     listing code, a buffer overflow could have occurred in     certain cases. This condition has been fixed and the     buffer overflow no longer occurs.

In addition, this update adds the following enhancements :

  - With this update, sudo has been modified to send debug     messages about netgroup matching to the debug log. These     messages should provide better understanding of how sudo     matches netgroup database records with values from the     running system and what the values are exactly.

  - With this update, sudo has been modified to accept the     ipa_hostname value from the /etc/sssd/sssd.conf     configuration file when matching netgroups.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-1701 advisory.

    - added patches for CVE-2013-1775 CVE-2013-2777 CVE-2013-2776       Resolves: rhbz#1015355

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was found in the way sudo handled time stamp files. An attacker able to run code as a local user and with the ability to control the system clock could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1775)

It was found that sudo did not properly validate the controlling terminal device when the tty_tickets option was enabled in the /etc/sudoers file. An attacker able to run code as a local user could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1776, CVE-2013-2776)

This update also fixes the following bugs :

  - Due to a bug in the cycle detection algorithm of the     visudo utility, visudo incorrectly evaluated certain     alias definitions in the /etc/sudoers file as cycles.
    Consequently, a warning message about undefined aliases     appeared. This bug has been fixed, /etc/sudoers is now     parsed correctly by visudo and the warning message no     longer appears.

  - Previously, the 'sudo -l' command did not parse the     /etc/sudoers file correctly if it contained an Active     Directory (AD) group. The file was parsed only up to the     first AD group information and then the parsing failed     with the following message :

sudo: unable to cache group ADDOM\admingroup, already exists

With this update, the underlying code has been modified and 'sudo -l' now parses /etc/sudoers containing AD groups correctly.

  - Previously, the sudo utility did not escape the     backslash characters contained in user names properly.
    Consequently, if a system used sudo integrated with LDAP     or Active Directory (AD) as the primary authentication     mechanism, users were not able to authenticate on that     system. With this update, sudo has been modified to     process LDAP and AD names correctly and the     authentication process now works as expected.

  - Prior to this update, the 'visudo -s (strict)' command     incorrectly parsed certain alias definitions.
    Consequently, an error message was issued. The bug has     been fixed, and parsing errors no longer occur when     using 'visudo - -s'.

From Red Hat Security Advisory 2013:1353 :

An updated sudo package that fixes multiple security issues and several bugs is now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root.

A flaw was found in the way sudo handled time stamp files. An attacker able to run code as a local user and with the ability to control the system clock could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1775)

It was found that sudo did not properly validate the controlling terminal device when the tty_tickets option was enabled in the /etc/sudoers file. An attacker able to run code as a local user could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1776, CVE-2013-2776)

This update also fixes the following bugs :

* Due to a bug in the cycle detection algorithm of the visudo utility, visudo incorrectly evaluated certain alias definitions in the /etc/sudoers file as cycles. Consequently, a warning message about undefined aliases appeared. This bug has been fixed, /etc/sudoers is now parsed correctly by visudo and the warning message no longer appears. (BZ#849679)

* Previously, the 'sudo -l' command did not parse the /etc/sudoers file correctly if it contained an Active Directory (AD) group. The file was parsed only up to the first AD group information and then the parsing failed with the following message :

sudo: unable to cache group ADDOM\admingroup, already exists

With this update, the underlying code has been modified and 'sudo -l' now parses /etc/sudoers containing AD groups correctly. (BZ#855836)

* Previously, the sudo utility did not escape the backslash characters contained in user names properly. Consequently, if a system used sudo integrated with LDAP or Active Directory (AD) as the primary authentication mechanism, users were not able to authenticate on that system. With this update, sudo has been modified to process LDAP and AD names correctly and the authentication process now works as expected. (BZ#869287)

* Prior to this update, the 'visudo -s (strict)' command incorrectly parsed certain alias definitions. Consequently, an error message was issued. The bug has been fixed, and parsing errors no longer occur when using 'visudo

* s'. (BZ#905624)

All sudo users are advised to upgrade to this updated package, which contains backported patches to correct these issues.

This update fixes the following security issues which allowed to bypass the sudo authentication: CVE-2013-1775 / CVE-2013-1776 / CVE-2013-2776 / CVE-2013-2777.

Several vulnerabilities have been discovered in sudo, a program designed to allow a sysadmin to give limited root privileges to users.
The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2013-1775     Marco Schoepl discovered an authentication bypass when     the clock is set to the UNIX epoch [00:00:00 UTC on 1     January 1970].

  - CVE-2013-1776     Ryan Castellucci and James Ogden discovered aspects of     an issue that would allow session id hijacking from     another authorized tty.

New sudo packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix security issues.

ID	Name	Product	Family	Severity
91755	OracleVM 3.2 : sudo (OVMSA-2016-0079)	Nessus	OracleVM Local Security Checks	medium
8981	Mac OS X < 10.10.5 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	high
85408	Mac OS X 10.10.x < 10.10.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
79173	CentOS 6 : sudo (CESA-2013:1701)	Nessus	CentOS Local Security Checks	medium
79154	CentOS 5 : sudo (CESA-2013:1353)	Nessus	CentOS Local Security Checks	medium
72078	GLSA-201401-23 : sudo: Privilege escalation	Nessus	Gentoo Local Security Checks	medium
71399	Amazon Linux AMI : sudo (ALAS-2013-259)	Nessus	Amazon Linux Local Security Checks	medium
71300	Scientific Linux Security Update : sudo on SL6.x i386/x86_64 (20131121)	Nessus	Scientific Linux Local Security Checks	medium
71112	Oracle Linux 6 : sudo (ELSA-2013-1701)	Nessus	Oracle Linux Local Security Checks	critical
71017	RHEL 6 : sudo (RHSA-2013:1701)	Nessus	Red Hat Local Security Checks	medium
70392	Scientific Linux Security Update : sudo on SL5.x i386/x86_64 (20130930)	Nessus	Scientific Linux Local Security Checks	medium
70288	Oracle Linux 5 : sudo (ELSA-2013-1353)	Nessus	Oracle Linux Local Security Checks	medium
70249	RHEL 5 : sudo (RHSA-2013:1353)	Nessus	Red Hat Local Security Checks	medium
66466	SuSE 10 Security Update : sudo (ZYPP Patch Number 8562)	Nessus	SuSE Local Security Checks	medium
66464	SuSE 11.2 Security Update : sudo (SAT Patch Number 7705)	Nessus	SuSE Local Security Checks	medium
65179	Debian DSA-2642-1 : sudo - several issues	Nessus	Debian Local Security Checks	medium
65060	Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 14.0 / current : sudo (SSA:2013-065-01)	Nessus	Slackware Local Security Checks	medium

Detections

Analytics

CVE-2013-2776

critical

Tenable Plugins

medium

high

high

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium