Todd Miller Sudo CVE-2013-2776 Local Security Bypass Vulnerability

Bugtraq ID:	62741
Class:	Design Error
CVE:	CVE-2013-2776
Remote:	No
Local:	Yes
Published:	Aug 04 2013 12:00AM
Updated:	Jul 29 2016 05:00PM
Credit:	The vendor reported this issue.
Vulnerable:	Todd Miller Sudo 1.8.3 Todd Miller Sudo 1.8.2 Todd Miller Sudo 1.8.1 Todd Miller Sudo 1.8 Todd Miller Sudo 1.7.2 p7 Todd Miller Sudo 1.7.2 p6 Todd Miller Sudo 1.7.2 p5 Todd Miller Sudo 1.7.2 p4 Todd Miller Sudo 1.7.2 p3 Todd Miller Sudo 1.7.2 p1 Todd Miller Sudo 1.7 Todd Miller Sudo 1.6.9 p19 Todd Miller Sudo 1.6.9 p18 Todd Miller Sudo 1.6.9 p17 Todd Miller Sudo 1.6.8 p9 Todd Miller Sudo 1.6.8 p8 + OpenPKG OpenPKG 2.4 + OpenPKG OpenPKG Current + Redhat Fedora Core4 Todd Miller Sudo 1.6.8 p7 + Debian Linux 3.1 sparc + Debian Linux 3.1 s/390 + Debian Linux 3.1 ppc + Debian Linux 3.1 mipsel + Debian Linux 3.1 mips + Debian Linux 3.1 m68k + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 hppa + Debian Linux 3.1 arm + Debian Linux 3.1 amd64 + Debian Linux 3.1 alpha + Debian Linux 3.1 + OpenPKG OpenPKG 2.3 Todd Miller Sudo 1.6.8 p5 + Ubuntu Ubuntu Linux 5.0 4 powerpc + Ubuntu Ubuntu Linux 5.0 4 i386 + Ubuntu Ubuntu Linux 5.0 4 amd64 Todd Miller Sudo 1.6.8 p4 Todd Miller Sudo 1.6.8 p2 + Trustix Secure Linux 2.2 Todd Miller Sudo 1.6.8 p12 Todd Miller Sudo 1.6.8 p1 + Mandriva Linux Mandrake 10.2 x86_64 + Mandriva Linux Mandrake 10.2 + Mandriva Linux Mandrake 10.1 x86_64 + Mandriva Linux Mandrake 10.1 + OpenPKG OpenPKG 2.2 + OpenPKG OpenPKG Current Todd Miller Sudo 1.6.8 Todd Miller Sudo 1.6.7 p5 + MandrakeSoft Corporate Server 3.0 x86_64 + MandrakeSoft Corporate Server 3.0 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 + OpenPKG OpenPKG 2.1 + Redhat Fedora Core3 + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia32 Todd Miller Sudo 1.6.7 Todd Miller Sudo 1.6.6 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 + MandrakeSoft Corporate Server 2.1 x86_64 + MandrakeSoft Corporate Server 2.1 + Slackware Linux 8.0 Todd Miller Sudo 1.6.5 p2 + NetBSD NetBSD 1.5.2 + OpenBSD OpenBSD 3.1 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 + Redhat Linux 7.2 alpha + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 alpha + Redhat Linux 7.0 i386 + Redhat Linux 7.0 alpha - Redhat Linux 6.2 sparc - Redhat Linux 6.2 i386 - Redhat Linux 6.2 alpha + S.u.S.E. Linux 8.0 i386 + S.u.S.E. Linux 8.0 Todd Miller Sudo 1.6.5 p1 + Slackware Linux 8.0 Todd Miller Sudo 1.6.5 Todd Miller Sudo 1.6.4 p2 Todd Miller Sudo 1.6.4 p1 Todd Miller Sudo 1.6.4 + MandrakeSoft Corporate Server 1.0.1 + MandrakeSoft Single Network Firewall 7.2 + Mandriva Linux Mandrake 8.2 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 + Mandriva Linux Mandrake 7.2 + Mandriva Linux Mandrake 7.1 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 + Redhat Linux 7.2 alpha + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 alpha + Redhat Linux 7.0 i386 + Redhat Linux 7.0 alpha - Redhat Linux 6.2 sparc - Redhat Linux 6.2 i386 - Redhat Linux 6.2 alpha Todd Miller Sudo 1.6.3 p7 - FreeBSD FreeBSD 4.5 - FreeBSD FreeBSD 4.4 - FreeBSD FreeBSD 4.3 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 + S.u.S.E. Linux 7.3 sparc + S.u.S.E. Linux 7.3 ppc + S.u.S.E. Linux 7.3 i386 + S.u.S.E. Linux 7.3 + Slackware Linux 8.0 + Trustix Secure Linux 1.5 + Trustix Secure Linux 1.2 + Trustix Secure Linux 1.1 Todd Miller Sudo 1.6.3 p6 + Guardian Digital Engarde Secure Linux 1.0.1 + Guardian Digital Engarde Secure Linux 1.0.1 + HP Secure OS software for Linux 1.0 + HP Secure OS software for Linux 1.0 + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 alpha + Redhat Linux 7.1 alpha + S.u.S.E. Linux 7.2 i386 + S.u.S.E. Linux 7.2 + S.u.S.E. Linux 7.2 + S.u.S.E. Linux 7.1 x86 + S.u.S.E. Linux 7.1 x86 + S.u.S.E. Linux 7.1 sparc + S.u.S.E. Linux 7.1 sparc + S.u.S.E. Linux 7.1 ppc + S.u.S.E. Linux 7.1 ppc + S.u.S.E. Linux 7.1 alpha + S.u.S.E. Linux 7.1 alpha + S.u.S.E. Linux 7.1 + S.u.S.E. Linux 7.1 + S.u.S.E. Linux 7.0 sparc + S.u.S.E. Linux 7.0 sparc + S.u.S.E. Linux 7.0 ppc + S.u.S.E. Linux 7.0 ppc + S.u.S.E. Linux 7.0 i386 + S.u.S.E. Linux 7.0 i386 + S.u.S.E. Linux 7.0 alpha + S.u.S.E. Linux 7.0 alpha + S.u.S.E. Linux 7.0 + S.u.S.E. Linux 7.0 + Wirex Immunix OS 7.0 + Wirex Immunix OS 7.0 Todd Miller Sudo 1.6.3 p5 Todd Miller Sudo 1.6.3 p4 + Slackware Linux 7.1 Todd Miller Sudo 1.6.3 p3 Todd Miller Sudo 1.6.3 p2 Todd Miller Sudo 1.6.3 p1 Todd Miller Sudo 1.6.3 + Redhat Linux 7.0 i386 + Redhat Linux 7.0 alpha Todd Miller Sudo 1.6.2 - Debian Linux 2.2 Todd Miller Sudo 1.6.1 Todd Miller Sudo 1.6 Todd Miller Sudo 1.5.9 + S.u.S.E. Linux 6.4 ppc + S.u.S.E. Linux 6.4 i386 + S.u.S.E. Linux 6.4 Todd Miller Sudo 1.5.8 Todd Miller Sudo 1.5.7 Todd Miller Sudo 1.5.6 Todd Miller Sudo 1.3.5 Todd Miller Sudo 1.8.6p6 Todd Miller Sudo 1.8.5p3 Todd Miller Sudo 1.8.4p5 Todd Miller Sudo 1.8.3p2 Todd Miller Sudo 1.8.3p1 Todd Miller Sudo 1.7.9p1 Todd Miller Sudo 1.7.4p4 Todd Miller Sudo 1.7.4p3 Todd Miller Sudo 1.7.10p5 Todd Miller Sudo 1.6.9 p23 Todd Miller Sudo 1.6.9 p22 Todd Miller Sudo 1.6.9 p21 Todd Miller Sudo 1.6.9 p20 Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux 5 Server Oracle VM Server for x86 3.4 Oracle VM Server for x86 3.3 Oracle VM Server for x86 3.2 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 Gentoo Linux Avaya one-X Client Enablement Services 6.2 Avaya IP Office Server Edition 9.0 Avaya IP Office Server Edition 8.1 Avaya IP Office Application Server 9.0 Avaya CMS r17 Avaya Aura Session Manager 6.3.1 Avaya Aura Session Manager 6.3 Avaya Aura Experience Portal 6.0.2 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 6.0.1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 6.0 SP2 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 6.0 SP1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 6.0 Avaya Aura Collaboration Environment 2.0 Apple Mac Os X 10.10.4 Apple Mac Os X 10.10.3 Apple Mac OS X 10.10.2 Apple Mac OS X 10.10.1 Apple Mac OS X 10.10
Not Vulnerable:	Todd Miller Sudo 1.8.6p7 Todd Miller Sudo 1.7.10p6 Apple Mac Os X 10.10.5

Todd Miller Sudo CVE-2013-2776 Local Security Bypass Vulnerability

Todd Miller 'sudo' is prone to a local security-bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions.

sudo versions 1.3.5 through 1.7.10p5 and 1.8.0 through 1.8.6p6 are vulnerable.

Todd Miller Sudo CVE-2013-2776 Local Security Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Todd Miller Sudo CVE-2013-2776 Local Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Todd Miller Sudo CVE-2013-2776 Local Security Bypass Vulnerability

References:

• Bug 949751 - (CVE-2013-2776) CVE-2013-2776 sudo: bypass of tty_tickets constrain (Red Hat)
  
• Sudo Homepage (Todd Miller)
  
• sudo security, bug fix and enhancement update (RHSA-2013-1701) (Avaya)
  
• APPLE-SA-2015-08-13-2 OS X Yosemite v10.10.5 and Security Update 2015-006 (Apple)
  
• Oracle VM Server for x86 Bulletin - July 2016 (Oracle)