Description
sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another terminal. NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sudo | 1.8.5p2-1+nmu1 | — |
| Debian 13 | sudo | 1.8.5p2-1+nmu1 | — |
| Debian 12 | sudo | 1.8.5p2-1+nmu1 | — |
| Debian 6.0 | sudo | 1.7.4p4-2.squeeze.4 | DSA-2642-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | sudo +1 | 1.8.6p3-7.el6 | RHBA-2013:0363 |
| RHEL 5 | sudo | 1.7.2p1-28.el5 | RHSA-2013:1353 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | sudo | 1.8.18p1-1.1 | openSUSE-SU-2024:10551-1 |
Advisories 4
- RHSA-2013:1353 Red Hat Security Advisory: sudo security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHBA-2013:0363 Red Hat Bug Fix Advisory: sudo bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2642-1 sudo - several issues Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10551-1 sudo-1.8.18p1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- 58207 vdb-entry
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701839
- DSA-2642 vendor-advisory
- http://www.sudo.ws/repos/sudo/rev/6b22be4d09f0
- http://www.sudo.ws/repos/sudo/rev/632f8e028191
- [oss-security] 20130227 Re: CVE request: potential bypass of sudo tty_tickets constraints mailing-list
- openSUSE-SU-2013:0495 vendor-advisory
- http://www.sudo.ws/sudo/alerts/tty_tickets.html
- APPLE-SA-2015-08-13-2 vendor-advisory
- SSA:2013-065-01 vendor-advisory
- https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/87023
- RHSA-2013:1353 vendor-advisory
- https://support.apple.com/kb/HT205031
- https://bugzilla.redhat.com/show_bug.cgi?id=916365
- sudo-ttytickets-sec-bypass(82453) vdb-entry