Description
Sudo before 1.6.6 contains an off-by-one error that can result in a heap-based buffer overflow that may allow local users to gain root privileges via special characters in the -p (prompt) argument, which are not properly expanded.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Sudo 1.6.x - Password Prompt Heap Overflow EDB-21420 · local · Nov 1, 2001 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20020425 Sudo version 1.6.6 now available (fwd) mailing-list
- DSA-128 vendor-advisory
- 20020425 [slackware-security] sudo upgrade fixes a potential vulnerability mailing-list
- RHSA-2002:071 vendor-advisory
- VU#820083 third-party-advisory
- SuSE-SA:2002:014 vendor-advisory
- 20020425 [Global InterSec 2002041701] Sudo Password Prompt mailing-list
- CLA-2002:475 vendor-advisory
- sudo-password-expansion-overflow(8936) vdb-entry
- 4593 vdb-entry
- ESA-20020429-010 vendor-advisory
- TSLSA-2002-0046 vendor-advisory
- RHSA-2002:072 vendor-advisory
- MDKSA-2002:028 vendor-advisory