sudosh3 'replay.c' Multiple Buffer Overflow Vulnerabilities

Bugtraq ID:	37971
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Jan 17 2010 12:00AM
Updated:	Jan 17 2010 12:00AM
Credit:	Adam Borowski
Vulnerable:	Giulio Capitanio sudosh3 3.2
Not Vulnerable:

sudosh3 'replay.c' Multiple Buffer Overflow Vulnerabilities

The 'sudosh3' utility is prone to multiple buffer-overflow vulnerabilities because it fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Attackers can execute arbitrary code in the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

These issues affect sudosh3 3.2.0; other versions may also be affected.

sudosh3 'replay.c' Multiple Buffer Overflow Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting victim to use the affected application to open a malicious file.

sudosh3 'replay.c' Multiple Buffer Overflow Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

sudosh3 'replay.c' Multiple Buffer Overflow Vulnerabilities

References:

• Re: Bug#565515: ITP: sudosh3 -- Complete logging for sudo (Adam Borowski)
  
• sudosh3 Homepage (Giulio Capitanio)