CVE-2016-7076
Published: May 29, 2018Last modified: November 9, 2023
Description
sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.8 |
| Attack Vector | LOCAL |
| Attack complexity | LOW |
| Privileges required | LOW |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | HIGH |
| Integrity impact | HIGH |
| Availability impact | HIGH |
| Vector | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | sudo | Not affected (1.9.12_p2-r1) |
| Stream | sudo | Not affected (1.9.14_p3-r0) |
References
- http://rhn.redhat.com/errata/RHSA-2016-2872.html
- http://www.securityfocus.com/bid/95778
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7076
- https://security.netapp.com/advisory/ntap-20181127-0002/
- https://usn.ubuntu.com/3968-1/
- https://usn.ubuntu.com/3968-3/
- https://www.sudo.ws/alerts/noexec_wordexp.html