This update fixes the following security issues which allowed to bypass the sudo authentication: CVE-2013-1775 / CVE-2013-1776 / CVE-2013-2776 / CVE-2013-2777.

The remote host is affected by the vulnerability described in GLSA-201401-23 (sudo: Privilege escalation)

    Multiple vulnerabilities have been found in sudo:
      sudo does not correctly validate the controlling terminal on a system         without /proc or when the tty_tickets option is enabled.
      sudo does not properly handle the clock when it is set to the epoch.
  Impact :

    A local attacker with sudo privileges could connect to the stdin,       stdout, and stderr of the terminal of a user who has authenticated with       sudo, allowing the attacker to hijack the authorization of the other       user. Additionally, a local or physically proximate attacker could set       the system clock to the epoch, bypassing time restrictions on sudo       authentication.
  Workaround :

    There is no known workaround at this time.

A flaw was found in the way sudo handled time stamp files. An attacker able to run code as a local user and with the ability to control the system clock could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1775)

It was found that sudo did not properly validate the controlling terminal device when the tty_tickets option was enabled in the /etc/sudoers file. An attacker able to run code as a local user could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-2776 , CVE-2013-2777)

New sudo packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix security issues.

A flaw was found in the way sudo handled time stamp files. An attacker able to run code as a local user and with the ability to control the system clock could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1775)

It was found that sudo did not properly validate the controlling terminal device when the tty_tickets option was enabled in the /etc/sudoers file. An attacker able to run code as a local user could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-2776, CVE-2013-2777)

This update also fixes the following bugs :

  - Previously, sudo did not support netgroup filtering for     sources from the System Security Services Daemon (SSSD).
    Consequently, SSSD rules were applied to all users even     when they did not belong to the specified netgroup. With     this update, netgroup filtering for SSSD sources has     been implemented. As a result, rules with a netgroup     specification are applied only to users that are part of     the netgroup.

  - When the sudo utility set up the environment in which it     ran a command, it reset the value of the RLIMIT_NPROC     resource limit to the parent's value of this limit if     both the soft (current) and hard (maximum) values of     RLIMIT_NPROC were not limited. An upstream patch has     been provided to address this bug and RLIMIT_NPROC can     now be set to 'unlimited'.

  - Due to the refactoring of the sudo code by upstream, the     SUDO_USER variable that stores the name of the user     running the sudo command was not logged to the     /var/log/secure file as before. Consequently, user name     'root' was always recorded instead of the real user     name. With this update, the previous behavior of sudo     has been restored. As a result, the expected user name     is now written to /var/log/secure.

  - Due to an error in a loop condition in sudo's rule     listing code, a buffer overflow could have occurred in     certain cases. This condition has been fixed and the     buffer overflow no longer occurs.

In addition, this update adds the following enhancements :

  - With this update, sudo has been modified to send debug     messages about netgroup matching to the debug log. These     messages should provide better understanding of how sudo     matches netgroup database records with values from the     running system and what the values are exactly.

  - With this update, sudo has been modified to accept the     ipa_hostname value from the /etc/sssd/sssd.conf     configuration file when matching netgroups.

An updated sudo package that fixes two security issues, several bugs, and adds two enhancements is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root.

A flaw was found in the way sudo handled time stamp files. An attacker able to run code as a local user and with the ability to control the system clock could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1775)

It was found that sudo did not properly validate the controlling terminal device when the tty_tickets option was enabled in the /etc/sudoers file. An attacker able to run code as a local user could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-2776, CVE-2013-2777)

This update also fixes the following bugs :

* Previously, sudo did not support netgroup filtering for sources from the System Security Services Daemon (SSSD). Consequently, SSSD rules were applied to all users even when they did not belong to the specified netgroup. With this update, netgroup filtering for SSSD sources has been implemented. As a result, rules with a netgroup specification are applied only to users that are part of the netgroup.
(BZ#880150)

* When the sudo utility set up the environment in which it ran a command, it reset the value of the RLIMIT_NPROC resource limit to the parent's value of this limit if both the soft (current) and hard (maximum) values of RLIMIT_NPROC were not limited. An upstream patch has been provided to address this bug and RLIMIT_NPROC can now be set to 'unlimited'. (BZ#947276)

* Due to the refactoring of the sudo code by upstream, the SUDO_USER variable that stores the name of the user running the sudo command was not logged to the /var/log/secure file as before. Consequently, user name 'root' was always recorded instead of the real user name. With this update, the previous behavior of sudo has been restored. As a result, the expected user name is now written to /var/log/secure.
(BZ#973228)

* Due to an error in a loop condition in sudo's rule listing code, a buffer overflow could have occurred in certain cases. This condition has been fixed and the buffer overflow no longer occurs. (BZ#994626)

In addition, this update adds the following enhancements :

* With this update, sudo has been modified to send debug messages about netgroup matching to the debug log. These messages should provide better understanding of how sudo matches netgroup database records with values from the running system and what the values are exactly. (BZ#848111)

* With this update, sudo has been modified to accept the ipa_hostname value from the /etc/sssd/sssd.conf configuration file when matching netgroups. (BZ#853542)

All sudo users are advised to upgrade to this updated package, which contains backported patches to correct these issues and add these enhancements.

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.5. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - apache_mod_php
  - Apple ID OD Plug-in
  - AppleGraphicsControl
  - Bluetooth
  - bootp
  - CloudKit
  - CoreMedia Playback
  - CoreText
  - curl
  - Data Detectors Engine
  - Date & Time pref pane
  - Dictionary Application
  - DiskImages
  - dyld
  - FontParser
  - groff
  - ImageIO
  - Install Framework Legacy
  - IOFireWireFamily
  - IOGraphics
  - IOHIDFamily
  - Kernel
  - Libc
  - Libinfo
  - libpthread
  - libxml2
  - libxpc
  - mail_cmds
  - Notification Center OSX
  - ntfs
  - OpenSSH
  - OpenSSL
  - perl
  - PostgreSQL
  - python
  - QL Office
  - Quartz Composer Framework
  - Quick Look
  - QuickTime 7
  - SceneKit
  - Security
  - SMBClient
  - Speech UI
  - sudo
  - tcpdump
  - Text Formats
  - udf 

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

Several vulnerabilities have been discovered in sudo, a program designed to allow a sysadmin to give limited root privileges to users.
The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2013-1775     Marco Schoepl discovered an authentication bypass when     the clock is set to the UNIX epoch [00:00:00 UTC on 1     January 1970].

  - CVE-2013-1776     Ryan Castellucci and James Ogden discovered aspects of     an issue that would allow session id hijacking from     another authorized tty.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - added patch for CVE-2014-0106: certain environment     variables not sanitized when env_reset is disabled     Resolves: rhbz#1072210

  - backported fixes for CVE-2013-1775 CVE-2013-1776     (CVE-2013-2776) CVE-2013-2777 Resolves: rhbz#968221

  - visudo: fixed incorrect warning and parse error     regarding undefined aliases which were in fact defined     Resolves: rhbz#849679 Resolves: rhbz#905624

  - updated sudoers man-page to clarify the behavior of the     user negation operator and the behavior of wildcard     matching in command specifications Resolves: rhbz#846118     Resolves: rhbz#856902

  - fixed regression in escaping of sudo -i arguments     Resolves: rhbz#853203

  - bump release number

  - Fixed caching of user and group names

  - Backported RFC 4515 escaping of LDAP queries Resolves:
    rhbz#855836 Resolves: rhbz#869287

  - Add the -c option to sed commands in post/postun scripts     Resolves: rhbz#818585

  - Implement a new sudoers Defaults option to restore old     command exec behavior Resolves: rhbz#840971

  - Add ability to treat files authoritatively in     sudoers.ldap Resolves: rhbz#840097

  - Changed policycoreutils dependency to a context specific     dependency (post & postun) Resolves: rhbz#846694

  - don't use a temporary file when modifying nsswitch.conf

  - fix permissions on nsswitch.conf, if needed Resolves:
    rhbz#846631

  - added a workaround for a race condition in handling     child processes Resolves: rhbz#829263

  - use safe temporary files in post/postun scripts

  - corrected postun script Resolves: rhbz#841070

  - corrected release number

  - call restorecon after modifying nsswitch.conf in the     postun scriplet

  - added policycoreutils dependency Resolves: rhbz#818585

  - fixed `sudo -i' command escaping (#806073)

  - fixed multiple sudoHost LDAP attr. handlng (#740884)     Resolves: rhbz#740884 Resolves: rhbz#806073

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-1701 advisory.

    - added patches for CVE-2013-1775 CVE-2013-2777 CVE-2013-2776       Resolves: rhbz#1015355

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of Mac OS X 10.10.x that is prior to version 10.10.5. The installed version is affected by multiple vulnerabilities in the following components :

 - apache (CVE-2014-3581, CVE-2014-3583, CVE-2014-8109, CVE-2015-0228, CVE-2015-0253, CVE-2015-3183, CVE-2015-3185)
 - apache_mod_php (CVE-2015-2783, CVE-2015-2787, CVE-2015-3307, CVE-2015-3329, CVE-2015-3330, CVE-2015-4021, CVE-2015-4022, CVE-2015-4024, CVE-2015-4025, CVE-2015-4026, CVE-2015-4147, CVE-2015-4148)
 - Apple ID OD Plug-in (CVE-2015-3799)
 - AppleGraphicsControl (CVE-2015-5768)
 - Bluetooth (CVE-2015-3777, CVE-2015-3779, CVE-2015-3780, CVE-2015-3786, CVE-2015-3787)
 - bootp (CVE-2015-3778)
 - CloudKit (CVE-2015-3782)
 - CoreMedia Playback (CVE-2015-5777, CVE-2015-5778)
 - CoreText (CVE-2015-5761, CVE-2015-5755)
 - curl (CVE-2014-3613, CVE-2014-3620, CVE-2014-3707, CVE-2014-8150, CVE-2014-8151, CVE-2015-3143, CVE-2015-3144, CVE-2015-3145, CVE-2015-3148, CVE-2015-3153)
 - Data Detectors Engine (CVE-2015-5750)
 - Date & Time pref pane (CVE-2015-3757)
 - Dictionary Application (CVE-2015-3774)
 - DiskImages (CVE-2015-3800)
 - dyld (CVE-2015-3760)
 - FontParser (CVE-2015-3804, CVE-2015-5775, CVE-2015-5756)
 - groff (CVE-2009-5044, CVE-2009-5078)
 - ImageIO (CVE-2015-5758, CVE-2015-5781, CVE-2015-5782)
 - Install Framework Legacy (CVE-2015-5784, CVE-2015-5754)
 - IOFireWireFamily (CVE-2015-3769, CVE-2015-3771, CVE-2015-3772)
 - IOGraphics (CVE-2015-3770, CVE-2015-5783)
 - IOHIDFamily (CVE-2015-5774)
 - Kernel (CVE-2015-3766, CVE-2015-3768, CVE-2015-5747, CVE-2015-5748, CVE-2015-3806, CVE-2015-3803, CVE-2015-3802, CVE-2015-3805, CVE-2015-3776, CVE-2015-3761)
 - Libc (CVE-2015-3796, CVE-2015-3797, CVE-2015-3798)
 - Libinfo (CVE-2015-5776)
 - libpthread (CVE-2015-5757)
 - libxml2 (CVE-2014-0191, CVE-2014-3660, CVE-2015-3807)
 - libxpc (CVE-2015-3795)
 - mail_cmds (CVE-2014-7844)
 - Notification Center OSX (CVE-2015-3764)
 - ntfs (CVE-2015-5763)
 - OpenSSH (CVE-2015-5600)
 - OpenSSL (CVE-2015-1788, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791, CVE-2015-1792)
 - perl (CVE-2013-7422)
 - PostgreSQL (CVE-2014-0067, CVE-2014-8161, CVE-2015-0241, CVE-2015-0242, CVE-2015-0243, CVE-2015-0244)
 - python (CVE-2013-7040, CVE-2013-7338, CVE-2014-1912, CVE-2014-7185, CVE-2014-9365)
 - QL Office (CVE-2015-5773, CVE-2015-3784)
 - Quartz Composer Framework (CVE-2015-5771)
 - Quick Look (CVE-2015-3781)
 - QuickTime 7 (CVE-2015-3779, CVE-2015-5753, CVE-2015-5779, CVE-2015-3765, CVE-2015-3788, CVE-2015-3789, CVE-2015-3790, CVE-2015-3791, CVE-2015-3792, CVE-2015-5751)
 - SceneKit (CVE-2015-5772, CVE-2015-3783)
 - Security (CVE-2015-3775)
 - SMBClient (CVE-2015-3773)
 - Speech UI (CVE-2015-3794)
 - sudo (CVE-2013-1775, CVE-2013-1776, CVE-2013-2776, CVE-2013-2777, CVE-2014-0106, CVE-2014-9680)
 - tcpdump (CVE-2014-8767, CVE-2014-8769, CVE-2014-9140)
 - Text Formats (CVE-2015-3762)
 - udf (CVE-2015-3767)

 Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	Name	Product	Family	Published	Updated	Severity
66466	SuSE 10 Security Update : sudo (ZYPP Patch Number 8562)	Nessus	SuSE Local Security Checks	5/16/2013	1/19/2021	medium
72078	GLSA-201401-23 : sudo: Privilege escalation	Nessus	Gentoo Local Security Checks	1/22/2014	1/6/2021	medium
71399	Amazon Linux AMI : sudo (ALAS-2013-259)	Nessus	Amazon Linux Local Security Checks	12/14/2013	4/18/2018	medium
65060	Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 14.0 / current : sudo (SSA:2013-065-01)	Nessus	Slackware Local Security Checks	3/7/2013	1/14/2021	medium
71300	Scientific Linux Security Update : sudo on SL6.x i386/x86_64 (20131121)	Nessus	Scientific Linux Local Security Checks	12/10/2013	1/14/2021	medium
71017	RHEL 6 : sudo (RHSA-2013:1701)	Nessus	Red Hat Local Security Checks	11/21/2013	1/14/2021	medium
85408	Mac OS X 10.10.x < 10.10.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	8/17/2015	5/28/2024	high
65179	Debian DSA-2642-1 : sudo - several issues	Nessus	Debian Local Security Checks	3/11/2013	1/11/2021	medium
79173	CentOS 6 : sudo (CESA-2013:1701)	Nessus	CentOS Local Security Checks	11/12/2014	1/4/2021	medium
91755	OracleVM 3.2 : sudo (OVMSA-2016-0079)	Nessus	OracleVM Local Security Checks	6/22/2016	1/4/2021	medium
71112	Oracle Linux 6 : sudo (ELSA-2013-1701)	Nessus	Oracle Linux Local Security Checks	11/27/2013	10/22/2024	critical
66464	SuSE 11.2 Security Update : sudo (SAT Patch Number 7705)	Nessus	SuSE Local Security Checks	5/16/2013	1/19/2021	medium
8981	Mac OS X < 10.10.5 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	10/16/2015	3/6/2019	high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

critical

medium

high