sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sudo: noexec bypass via wordexp() (CVE-2016-7076)

  - sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file,     which allows local users to open arbitrary files for read access (but not view file contents) by running a     program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log     messages, or repositioning tape drives. (CVE-2014-9680)

  - sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose     full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by /home/*/*/file.txt.
    (CVE-2015-5602)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote NewStart CGSL host, running version MAIN 6.02, has sudo packages installed that are affected by multiple vulnerabilities:

  - A certain Fedora patch for parse.c in sudo before 1.7.4p5-1.fc14 on Fedora 14 does not properly interpret     a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to     that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a     sudo command. NOTE: this vulnerability exists because of a CVE-2009-0034 regression. (CVE-2011-0008)

  - check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for     command execution that involves a gid change but no uid change, which allows local users to bypass an     intended authentication requirement via the -g option to a sudo command. (CVE-2011-0010)

  - Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to     execute arbitrary code via format string sequences in the program name for sudo. (CVE-2012-0809)

  - sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations     that use a netmask syntax, which allows local users to bypass intended command restrictions in     opportunistic circumstances by executing a command on a host that has an IPv4 address. (CVE-2012-2337)

  - sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate     attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting     the system clock and sudo user timestamp to the epoch. (CVE-2013-1775)

  - sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not     properly validate the controlling terminal device, which allows local users with sudo permissions to     hijack the authorization of another terminal via vectors related to connecting to the standard input,     output, and error file descriptors of another terminal. NOTE: this is one of three closely-related     vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different     affected versions. (CVE-2013-1776)

  - sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file,     which allows local users to open arbitrary files for read access (but not view file contents) by running a     program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log     messages, or repositioning tape drives. (CVE-2014-9680)

  - sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose     full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by /home/*/*/file.txt.
    (CVE-2015-5602)

  - sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run     via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to     run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary     commands with elevated privileges. (CVE-2016-7076)

  - Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in     the get_process_ttyname() function resulting in information disclosure and command execution.
    (CVE-2017-1000367)

  - ** DISPUTED ** In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can     impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user.
    NOTE: The software maintainer believes that this is not a vulnerability because running a command via sudo     as a user not present in the local password database is an intentional feature. Because this behavior     surprised some users, sudo 1.8.30 introduced an option to enable/disable this behavior with the default     being disabled. However, this does not change the fact that sudo was behaving as intended, and as     documented, in earlier versions. (CVE-2019-19232)

  - Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which     allows privilege escalation to root via sudoedit -s and a command-line argument that ends with a single     backslash character. (CVE-2021-3156)

  - A heap-based buffer overflow was found in the way sudo parses command line arguments. This flaw is     exploitable by any local user who can execute the sudo command without authentication. Successful     exploitation of this flaw could lead to privilege escalation.  (CVE-2021-3156)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3968-1 advisory.

    Florian Weimer discovered that Sudo incorrectly handled the noexec restriction when used with certain     applications. A local attacker could possibly use this issue to bypass configured restrictions and execute     arbitrary commands. (CVE-2016-7076)

    It was discovered that Sudo did not properly parse the contents of /proc/[pid]/stat when attempting to     determine its controlling tty. A local attacker in some configurations could possibly use this to     overwrite any file on the filesystem, bypassing intended permissions. (CVE-2017-1000368)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the sudo package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - It was discovered that the sudo noexec restriction     could have been bypassed if application run via sudo     executed system(), popen(), or wordexp() C library     functions with a user-supplied argument. A local user     permitted to run such application via sudo with noexec     restriction could use these flaws to execute arbitrary     commands with elevated privileges. (CVE-2016-7076)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for sudo is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.

Security Fix(es) :

* It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed system(), popen(), or wordexp() C library functions with a user-supplied argument. A local user permitted to run such application via sudo with noexec restriction could use these flaws to execute arbitrary commands with elevated privileges. (CVE-2016-7032, CVE-2016-7076)

These issues were discovered by Florian Weimer (Red Hat).

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fixes (CVE-2017-1000367) Resolves: rhbz#1455399

  - Update noexec syscall blacklist

  - Fixes (CVE-2016-7032, CVE-2016-7076) Resolves:
    rhbz#1391938

  - RHEL-6.9 erratum

  - Fix race condition when creating /var/log/sudo-io     direcotry Resolves: rhbz#1365156

According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that the sudo noexec restriction     could have been bypassed if application run via sudo     executed system(), popen(), or wordexp() C library     functions with a user-supplied argument. A local user     permitted to run such application via sudo with noexec     restriction could use these flaws to execute arbitrary     commands with elevated privileges. (CVE-2016-7032,     CVE-2016-7076)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed system() or popen() C library functions with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could use this flaw to execute arbitrary commands with elevated privileges. (CVE-2016-7032)

It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges.
(CVE-2016-7076)

Security Fix(es) :

  - It was discovered that the sudo noexec restriction could     have been bypassed if application run via sudo executed     system(), popen(), or wordexp() C library functions with     a user-supplied argument. A local user permitted to run     such application via sudo with noexec restriction could     use these flaws to execute arbitrary commands with     elevated privileges. (CVE-2016-7032, CVE-2016-7076)

These issues were discovered by Florian Weimer (Red Hat).

An update for sudo is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.

Security Fix(es) :

* It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed system(), popen(), or wordexp() C library functions with a user-supplied argument. A local user permitted to run such application via sudo with noexec restriction could use these flaws to execute arbitrary commands with elevated privileges. (CVE-2016-7032, CVE-2016-7076)

These issues were discovered by Florian Weimer (Red Hat).

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Update noexec syscall blacklist

  - Fixes (CVE-2016-7032, CVE-2016-7076) Resolves:
    rhbz#1391937

  - RHEL-6.8 erratum

  - fixed a bug causing that non-root users can list     privileges of other users Resolves: rhbz#1312481

  - RHEL-6.8 erratum

  - fixed handling of closefrom_override defaults option     Resolves: rhbz#1309976

  - RHEL-6.8 erratum

  - fixed potential getcwd failure, resulting in Null     pointer exception Resolves: rhbz#1284886

  - RHEL-6.8 erratum

  - fixed sssd's detection of user with zero rules Resolves:
    rhbz#1220480

  - RHEL-6.8 erratum

  - search also by user id when fetching rules from LDAP     Resolves: rhbz#1135531

  - RHEL-6.8 erratum

  - fixed ldap's and sssd's sudoOption value and remove     quotes

  - fixed ldap's and sssd's sudoOption whitespaces parse     problem Resolves: rhbz#1144422 Resolves: rhbz#1279447

  - RHEL-6.8 erratum

  - removed defaults option requiretty from /etc/sudoers

  - backported pam_service and pam_login_service defaults     options

  - implemented a new defaults option for changing netgroup     processing semantics

  - fixed visudo's quiet cli option Resolves: rhbz#1248695     Resolves: rhbz#1247231 Resolves: rhbz#1241896 Resolves:
    rhbz#1197885 Resolves: rhbz#1233205

  - added patch to re-introduce old group processing     behaviour Resolves: rhbz#1075836

From Red Hat Security Advisory 2016:2872 :

An update for sudo is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.

Security Fix(es) :

* It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed system(), popen(), or wordexp() C library functions with a user-supplied argument. A local user permitted to run such application via sudo with noexec restriction could use these flaws to execute arbitrary commands with elevated privileges. (CVE-2016-7032, CVE-2016-7076)

These issues were discovered by Florian Weimer (Red Hat).

This update for sudo fixes the following security issues :

  - Fix two security vulnerabilities that allowed users to     bypass sudo's NOEXEC functionality :

  - noexec bypass via system() and popen() [CVE-2016-7032,     bsc#1007766]

  - noexec bypass via wordexp() [CVE-2016-7076, bsc#1007501]

  - Fix unsafe handling of TZ environment variable.
    [CVE-2014-9680, bsc#917806]

Additionally, these non-security fixes are included in the update :

  - Fix 'ignoring time stamp from the future' message after     each boot with !tty_tickets. [bsc#899252]

  - Enable support for SASL-based authentication.
    [bsc#979531]

This update was imported from the SUSE:SLE-12:Update update project.

This update for sudo fixes the following issues :

  - fix two security vulnerabilities that allowed users to     bypass sudo's NOEXEC functionality :

  - noexec bypass via system() and popen() [CVE-2016-7032,     bsc#1007766]

  - noexec bypass via wordexp() [CVE-2016-7076, bsc#1007501]

Sudo was updated to the package from SUSE:SLE-12-SP2:Update, incorporating the following new feature :

  - allow dynamic groups with sudo [fate#318850]

The following bug fixes are included :

  - parse /proc/stat for boottime correctly [boo#899252]

  - enable SASL authentication [boo#979531]

- update to 1.8.18p1

  - fixes CVE-2016-7076

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sudo fixes the following security issues :

  - Fix two security vulnerabilities that allowed users to     bypass sudo's NOEXEC functionality :

  - noexec bypass via system() and popen() [CVE-2016-7032,     bsc#1007766]

  - noexec bypass via wordexp() [CVE-2016-7076, bsc#1007501]

  - Fix unsafe handling of TZ environment variable.
    [CVE-2014-9680, bsc#917806] Additionally, these     non-security fixes are included in the update :

  - Fix 'ignoring time stamp from the future' message after     each boot with !tty_tickets. [bsc#899252]

  - Enable support for SASL-based authentication.
    [bsc#979531]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sudo fixes the following issues :

  - fix two security vulnerabilities that allowed users to     bypass sudo's NOEXEC functionality :

  - noexec bypass via system() and popen() [CVE-2016-7032,     bsc#1007766]

  - noexec bypass via wordexp() [CVE-2016-7076, bsc#1007501]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sudo fixes the following issues :

  - Fix two security vulnerabilities that allowed users to     bypass sudo's NOEXEC functionality :

  - noexec bypass via system() and popen() [CVE-2016-7032,     bsc#1007766]

  - noexec bypass via wordexp() [CVE-2016-7076, bsc#1007501]

  - The SSSD plugin would occasionally crash sudo with an     'internal error'. This issue has been fixed.
    [bsc#948973]

  - The SSSD plugin would occasionally apply @netgroups     rules from LDAP to all users rather than the @netgroup.
    This issue is now fixed. [bsc#966755]

  - When the SSSD plugin was used and a local user ran sudo,     an e-mail used to be sent to administrator because SSSD     did not support sudo rules for local users. This message     did not signify an error, however, it was only noise.
    [bsc#1008043]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sudo fixes the following issues :

  - fix two security vulnerabilities that allowed users to     bypass sudo's NOEXEC functionality :

  - noexec bypass via system() and popen() [CVE-2016-7032,     boo#1007766]

  - noexec bypass via wordexp() [CVE-2016-7076, boo#1007501]

It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed system(), popen() or wordexp() C library functions with a user-supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges.

CVE-2016-7032

noexec bypass via system() and popen()

CVE-2016-7076

noexec bypass via wordexp()

For Debian 7 'Wheezy', these problems have been fixed in version 1.8.5p2-1+nmu3+deb7u2.

We recommend that you upgrade your sudo packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Todd C. Miller reports :

A flaw exists in sudo's noexec functionality that may allow a user with sudo privileges to run additional commands even when the NOEXEC tag has been applied to a command that uses the wordexp() function.

ID	Name	Product	Family	Severity
198848	RHEL 5 : sudo (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
154540	NewStart CGSL MAIN 6.02 : sudo Multiple Vulnerabilities (NS-SA-2021-0120)	Nessus	NewStart CGSL Local Security Checks	high
124679	Ubuntu 16.04 LTS : Sudo vulnerabilities (USN-3968-1)	Nessus	Ubuntu Local Security Checks	high
119071	EulerOS Virtualization 2.5.1 : sudo (EulerOS-SA-2018-1380)	Nessus	Huawei Local Security Checks	high
101533	Virtuozzo 7 : sudo / sudo-devel (VZLSA-2016-2872)	Nessus	Virtuozzo Local Security Checks	high
100530	OracleVM 3.3 / 3.4 : sudo (OVMSA-2017-0110)	Nessus	OracleVM Local Security Checks	high
99851	EulerOS 2.0 SP1 : sudo (EulerOS-SA-2017-1004)	Nessus	Huawei Local Security Checks	high
96282	Amazon Linux AMI : sudo (ALAS-2017-780)	Nessus	Amazon Linux Local Security Checks	high
95871	Scientific Linux Security Update : sudo on SL6.x, SL7.x i386/x86_64 (20161206)	Nessus	Scientific Linux Local Security Checks	high
95600	RHEL 6 / 7 : sudo (RHSA-2016:2872)	Nessus	Red Hat Local Security Checks	high
95599	OracleVM 3.3 / 3.4 : sudo (OVMSA-2016-0170)	Nessus	OracleVM Local Security Checks	high
95598	Oracle Linux 6 / 7 : sudo (ELSA-2016-2872)	Nessus	Oracle Linux Local Security Checks	high
95577	CentOS 6 / 7 : sudo (CESA-2016:2872)	Nessus	CentOS Local Security Checks	high
95556	openSUSE Security Update : sudo (openSUSE-2016-1402)	Nessus	SuSE Local Security Checks	high
95533	openSUSE Security Update : sudo (openSUSE-2016-1381)	Nessus	SuSE Local Security Checks	high
95375	Fedora 23 : sudo (2016-48614c8b69)	Nessus	Fedora Local Security Checks	high
95317	SUSE SLED12 / SLES12 Security Update : sudo (SUSE-SU-2016:2904-1)	Nessus	SuSE Local Security Checks	high
95313	SUSE SLED12 / SLES12 Security Update : sudo (SUSE-SU-2016:2893-1)	Nessus	SuSE Local Security Checks	high
95312	SUSE SLES11 Security Update : sudo (SUSE-SU-2016:2891-1)	Nessus	SuSE Local Security Checks	high
95275	openSUSE Security Update : sudo (openSUSE-2016-1343)	Nessus	SuSE Local Security Checks	high
94998	Fedora 25 : sudo (2016-3a0df9e256)	Nessus	Fedora Local Security Checks	high
94764	Debian DLA-707-1 : sudo security update	Nessus	Debian Local Security Checks	high
94746	Fedora 24 : sudo (2016-112b333bdf)	Nessus	Fedora Local Security Checks	high
94417	FreeBSD : sudo -- Potential bypass of sudo_noexec.so via wordexp() (2e4fbc9a-9d23-11e6-a298-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2016-7076

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high