Input Validation Vulnerability in Sudo by Todd Miller
CVE-2017-1000367

6.4MEDIUM

Key Information:

Vendor
Sudo Project
Status
Sudo
Vendor
CVE Published:
5 June 2017

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 16%

Summary

An input validation vulnerability exists in Sudo versions 1.8.20 and earlier, specifically within the get_process_ttyname() function. This flaw may allow an attacker to exploit embedded spaces in user input, potentially leading to unauthorized information disclosure and execution of arbitrary commands. Organizations using affected versions of Sudo should prioritize updates to mitigate these risks and reinforce their overall security posture.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

sudo-CVE-2017-1000367
Created by c0d3z3r0

sudo_exploit
Created by pucerpocok

CVE-2017-1000367
Created by homjxi0e

References

http://www.ubuntu.com/usn/USN-3304-1
vendor-advisory
https://security.gentoo.org/glsa/201705-15
vendor-advisory
http://www.securityfocus.com/bid/98745
vdb-entry

EPSS Score

16% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.