vendor:
Sudo
by:
MaXX
7.2
CVSS
HIGH
Heap Overflow
119
CWE
Product Name: Sudo
Affected Version From: All versions
Affected Version To: All versions
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Linux/Unix
2001
Sudo Heap Overflow Vulnerability
Sudo is vulnerable to a heap overflow condition related to it's customizable password prompt feature. The nature of the sudo utility requires that it be installed setuid root. Successful exploitation may allow for local attackers to gain root privileges. The vulnerability is caused by the author forgetting to reset the lastchar variable in the second loop of the expand_prompt() function in the check.c file. This can be exploited by an attacker to overflow the new_prompt buffer, depending on the length of the username or hostname. The overflow can be transformed into a one-byte heap overflow, which can be used to overwrite the effective uid of the process.
Mitigation:
Upgrade to the latest version of Sudo.
