Summary
It was discovered that Sudo did not properly parse the contents of
/proc/[pid]/stat when attempting to determine its controlling tty.
A local attacker in some configurations could possibly use this to
overwrite any file on the filesystem, bypassing intended permissions.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | sudo | 1.8.9p5-1ubuntu1.4 |
| Ubuntu · 16.04 LTS 16.04:LTS | sudo | 1.8.16-0ubuntu1.4 |
Vulnerabilities 1
-
Unscored —CVE-2017-1000367 Public exploit
Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process…
References
-
report
https://ubuntu.com/security/CVE-2017-1000367