Vulnerability in sudo - security update
Summary
DSA-3167-1: sudo - security update. Affects sudo versions < 1.8.5p2-1+nmu2. Fixed in 1.8.5p2-1+nmu2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The sudo package is designed to provide limited super user privileges to specific users. It allows users to execute commands as the superuser or another user, as specified in the sudoers file. This package is commonly used in Linux distributions to enhance security by restricting the actions that regular users can perform. However, a vulnerability has been discovered in sudo that allows a user with sudo access to exploit the TZ environment variable, potentially leading to the exploitation of bugs in C library functions or unauthorized file access.
Vulnerability Detail
The vulnerability in sudo involves the preservation of the TZ variable from a user's environment without any sanitization. This means that a user with sudo access can manipulate the TZ variable to exploit bugs in the C library functions that parse the TZ environment variable or to open files that they would not otherwise have access to. Exploiting this vulnerability could result in changes in system behavior when reading certain device special files or cause the program run via sudo to block.
How To Fix
Minimum fixed version
1.8.5p2-1+nmu2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade sudoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that only trusted users have sudo access and by monitoring the usage of sudo commands for any suspicious activity.
Conclusion
The sudo package has been found to have a vulnerability that allows users with sudo access to exploit the TZ environment variable. This can lead to the exploitation of bugs in C library functions or unauthorized file access. To fix this vulnerability, it is recommended to upgrade the sudo package to version 1.8.5p2-1+nmu2 or later. Users can also mitigate the risk by ensuring that only trusted users have sudo access and by monitoring the usage of sudo commands for any suspicious activity. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sudo →
FAQ
Sudo is a program that allows users to execute commands as the superuser or another user, as specified in the sudoers file. It is commonly used in Linux distributions to enhance security by restricting the actions that regular users can perform.
The TZ environment variable is used to specify the time zone for a user. It is preserved by sudo without any sanitization, which can lead to the exploitation of bugs in C library functions or unauthorized file access.
Exploiting this vulnerability could result in changes in system behavior when reading certain device special files or cause the program run via sudo to block. It could also allow unauthorized file access, potentially leading to further security breaches.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and the playground will analyze it for any open-source vulnerabilities, including this sudo vulnerability.
While there is no specific workaround mentioned for this vulnerability, users can mitigate the risk by ensuring that only trusted users have sudo access and by monitoring the usage of sudo commands for any suspicious activity.
Related vulnerabilities
Recent vulnerabilities recorded for sudo.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
