Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
Configuration 6 (hide)
|
Configuration 7 (hide)
AND |
|
Configuration 8 (hide)
AND |
|
Configuration 9 (hide)
|
Configuration 10 (hide)
AND |
|
Configuration 11 (hide)
AND |
|
Configuration 12 (hide)
AND |
|
Configuration 13 (hide)
AND |
|
Configuration 14 (hide)
AND |
|
Configuration 15 (hide)
|
History
09 Jul 2024, 18:27
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:ontap_tools:9:*:*:*:*:vmware_vsphere:*:* cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* |
|
First Time |
Netapp cloud Backup
Netapp ontap Tools Netapp active Iq Unified Manager Netapp ontap Select Deploy Administration Utility |
|
References | () http://packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.html - Exploit, Third Party Advisory, VDB Entry | |
References | () http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html - Exploit, Third Party Advisory, VDB Entry | |
References | () http://seclists.org/fulldisclosure/2024/Feb/3 - Exploit, Mailing List, Third Party Advisory | |
References | () http://www.openwall.com/lists/oss-security/2024/01/30/6 - Exploit, Mailing List | |
References | () http://www.openwall.com/lists/oss-security/2024/01/30/8 - Mailing List | |
References | () https://kc.mcafee.com/corporate/index?page=content&id=SB10348 - Broken Link, Third Party Advisory | |
References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CALA5FTXIQBRRYUA2ZQNJXB6OQMAXEII/ - Mailing List, Release Notes | |
References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LHXK6ICO5AYLGFK2TAX5MZKUXTUKWOJY/ - Mailing List, Release Notes | |
References | () https://www.beyondtrust.com/blog/entry/security-advisory-privilege-management-for-unix-linux-pmul-basic-and-privilege-management-for-mac-pmm-affected-by-sudo-vulnerability - Third Party Advisory | |
References | () https://www.sudo.ws/stable.html#1.9.5p2 - Release Notes |
04 Feb 2024, 09:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
31 Jan 2024, 18:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
30 Jan 2024, 21:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
07 Nov 2023, 03:37
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
Information
Published : 2021-01-26 21:15
Updated : 2024-07-09 18:27
NVD link : CVE-2021-3156
Mitre link : CVE-2021-3156
CVE.ORG link : CVE-2021-3156
JSON object : View
Products Affected
netapp
- hci_management_node
- solidfire
- active_iq_unified_manager
- ontap_tools
- cloud_backup
- oncommand_unified_manager_core_package
- ontap_select_deploy_administration_utility
synology
- skynas
- vs960hd
- diskstation_manager_unified_controller
- vs960hd_firmware
- diskstation_manager
- skynas_firmware
oracle
- micros_kitchen_display_system
- micros_compact_workstation_3_firmware
- micros_es400_firmware
- tekelec_platform_distribution
- micros_es400
- micros_workstation_6
- micros_workstation_5a_firmware
- micros_compact_workstation_3
- micros_kitchen_display_system_firmware
- communications_performance_intelligence_center
- micros_workstation_6_firmware
- micros_workstation_5a
debian
- debian_linux
mcafee
- web_gateway
beyondtrust
- privilege_management_for_unix\/linux
- privilege_management_for_mac
sudo_project
- sudo
fedoraproject
- fedora
CWE
CWE-193
Off-by-one Error