ID

VAR-202101-1926

CVE

CVE-2021-3156

TITLE

Sudo set_cmd() is vulnerable to heap-based buffer overflow

DESCRIPTION

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character. A heap-based overflow has been discovered in the set_cmd() function in sudo, which may allow a local attacker to execute commands with elevated administrator privileges.CVE-2021-3156 AffectedCVE-2021-3156 Affected. sudo has a heap-based buffer overflow due to the implementation of escaping special characters set in command arguments (CWE-122) Vulnerability exists. 2021 Year 2 Moon 5 As of the date macOS , AIX , Solaris It has been reported that it may also be affected by the virus, but it has not been confirmed by the finder. note that, 2021 Year 2 Moon 9 On the day Apple has released a security update to address this issue.A local third party can elevate privileges and execute commands with administrator privileges. Sensormatic Electronics Company ( Johnson Controls subsidiary) Illustra is a surveillance and security camera system. Illustra includes vulnerabilities related to boundary condition determination ( CWE-193 , CVE-2021-3156 ) exists.Installed in the product by a third party under certain conditions Linux Operating system administrator privileges can be obtained. Any local user (sudoers and non-sudoers) can exploit this flaw for root privilege escalation. For the stable distribution (buster), this problem has been fixed in version 1.8.27-1+deb10u3. We recommend that you upgrade your sudo packages. For the detailed security status of sudo please refer to its security tracker page at: https://security-tracker.debian.org/tracker/sudo Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmAQWctfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0Qr2w/5AfAZMSbKestTzvm22w+T5yReGOd2jYXO2SzdqdkIzOVXJ83RrbogkiyK d1ie47Csw51M8L5eT/kf48vkABPqT9S0dlRI7rQ2xbIDWIUcDpnFNCSclSGjI+Sd HqtaQQbR+MdSjGtC8vc8RVEOEQcVvoXrqDPaEniWjA4uTV7Iqj0P3EpH1XolVlZv lw4ZZ+VdDolxhm1QWp/NiMKUlDpv5RLs6jW0oQAKP1RZqMIX44TSEHil/NEs6VeN u5AFUwo5iwYRCUbgi2mB0GxV4CRyb0IN26pGsltYJsReFL1vCMiO9drGMk/WhlqB NGKeF5rLsMKaJCkBEcMntDG1XtFhXuyak2O4atL7H8CwhBZ81Axe+aAynn7IB99B qx3GLfRNSVKHQHBHWEOxqILCS+xWmvL6/uB6xMaAh5CXxhEgs9BIEiPonccmkzQ9 xj6Uw/aWv9ZOUu+Rwmp+bG/V8DKaFKegaQAy0HnhOZ11ruJJB/YicTXSsbxoLSEt hbd0bYAOrZBqcysH8Ed+R2tGxtjoWIDLcv3uUqmttxgd8E5YpGGngaYBleGCnB0s X3JDyd1pvBu7H0vR5k2bVNgm4qQ27jHmeNKRSpvUZv50mRX8NQyv/rrROwkUsVdI 1EnlHYz0E4BUfb15ECWLfN9BM/MyPhkdKadIrrd+zJEwq+KVcHo= =d9gQ -----END PGP SIGNATURE----- . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202101-33 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: sudo: Multiple vulnerabilities Date: January 26, 2021 Bugs: #764986, #767364 ID: 202101-33 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been found in sudo, the worst of which could result in privilege escalation. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-admin/sudo < 1.9.5_p2 >= 1.9.5_p2 Description ========== Multiple vulnerabilities have been discovered in sudo. Please review the CVE identifiers referenced below for details. Impact ===== Local users are able to gain unauthorized privileges on the system or determine the existence of files. Workaround ========= There is no known workaround at this time. Resolution ========= All sudo users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=app-admin/sudo-1.9.5_p2" References ========= [ 1 ] CVE-2021-23239 https://nvd.nist.gov/vuln/detail/CVE-2021-23239 [ 2 ] CVE-2021-23240 https://nvd.nist.gov/vuln/detail/CVE-2021-23240 [ 3 ] CVE-2021-3156 https://nvd.nist.gov/vuln/detail/CVE-2021-3156 [ 4 ] Upstream advisory (CVE-2020-23240) https://www.sudo.ws/alerts/sudoedit_selinux.html [ 5 ] Upstream advisory (CVE-2021-3156) https://www.sudo.ws/alerts/unescape_overflow.html Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202101-33 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ====== Copyright 2021 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5 . 6 ELS) - i386, s390x, x86_64 3. ========================================================================== Ubuntu Security Notice USN-4705-2 January 27, 2021 sudo vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 ESM - Ubuntu 12.04 ESM Summary: Several security issues were fixed in Sudo. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that Sudo incorrectly handled memory when parsing command lines. A local attacker could possibly use this issue to obtain unintended access to the administrator account. (CVE-2021-3156) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 ESM: sudo 1.8.9p5-1ubuntu1.5+esm6 Ubuntu 12.04 ESM: sudo 1.8.3p1-1ubuntu3.10 In general, a standard system update will make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: sudo security update Advisory ID: RHSA-2021:0226-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:0226 Issue date: 2021-01-26 CVE Names: CVE-2021-3156 ==================================================================== 1. Summary: An update for sudo is now available for Red Hat Enterprise Linux 7.2 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server AUS (v. 7.2) - x86_64 Red Hat Enterprise Linux Server Optional AUS (v. 7.2) - x86_64 3. Description: The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fix(es): * sudo: Heap buffer overflow in argument parsing (CVE-2021-3156) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1917684 - CVE-2021-3156 sudo: Heap buffer overflow in argument parsing 6. Package List: Red Hat Enterprise Linux Server AUS (v. 7.2): Source: sudo-1.8.6p7-17.el7_2.3.src.rpm x86_64: sudo-1.8.6p7-17.el7_2.3.x86_64.rpm sudo-debuginfo-1.8.6p7-17.el7_2.3.x86_64.rpm Red Hat Enterprise Linux Server Optional AUS (v. 7.2): x86_64: sudo-debuginfo-1.8.6p7-17.el7_2.3.i686.rpm sudo-debuginfo-1.8.6p7-17.el7_2.3.x86_64.rpm sudo-devel-1.8.6p7-17.el7_2.3.i686.rpm sudo-devel-1.8.6p7-17.el7_2.3.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-3156 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/security/vulnerabilities/RHSB-2021-002 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYBBuftzjgjWX9erEAQhMvw//bFNABGm9rbTjaz82JevupvwJHOPyb1lg sjTNW2x6YlUFH22bEgMgZSHmpuQ69Jca5yrLZkoaDQW/81S1haCvU7hSqE7kvDX9 /Q3GBJnV5ZRxPFI0abWNOV21PAuiSirR99EMB5Yq4o5FCzPkI5i+uIYLnrkdW2+J DPPXiIIt6kAj0k4A+tLRCLkyPbemHz8BIU2M9xUEvsAvs/YAv7lMce+lM7g2CAPx SXnsFejr9iNTTplf9mRGiANTP70ATsZc/6zhz8SiHuCDeF8QmnCQZg+xXVkG5jSY GgGy8zoNWOaTVkY+vPPP7hEo4Vt7QN+dvGn+13ELQQKdxqd68NSE4UcyX3FCEZ1y xS6TRGL2k6Uo2qETkzySx6mjAzlacxoMOwVKnGGjkN0Q0+D8AoluLVDUpaJHRnSU mVhDOoY6N9fRhbptzPoKxW/5hCb4ntxtM3extuU33kMSDp44xHX9oF0KzHbPuODq PuV2BF2wdfrImlEUo+yDioA39uRyaYfuc47xtLhzRutfSNyuv62IPiJmk/5bNgcR hI96vucAauFa82M9cRVXPn7mhEWikH7e6VY16hVPWzMSYBt46mKVrC0uzoaXjf9q CgHbYBhCpVCcpW2DemiTD1Eu4mV+ifNJDGoRUlWpcYdeSERN88esibKABJpGf6nH WsI4aXE4VzQ=mziT -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . 8) - aarch64, ppc64le, s390x, x86_64 3

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

local

TYPE

overflow, root

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

This document was written by Timur Snoke.Statement Date:   February 15, 2021

SOURCES

LAST UPDATE DATE

2025-01-03T19:57:00.025000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE