Description
sudo 1.3.5 through 1.7.10p5 and 1.8.0 through 1.8.6p6, when running on systems without /proc or the sysctl function with the tty_tickets option enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another terminal. NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sudo | 1.8.5p2-1+nmu1 | — |
| Debian 13 | sudo | 1.8.5p2-1+nmu1 | — |
| Debian 12 | sudo | 1.8.5p2-1+nmu1 | — |
| Debian 6.0 | sudo | 1.7.4p4-2.squeeze.4 | DSA-2642-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | sudo +1 | 1.8.6p3-12.el6 | RHSA-2013:1701 |
| RHEL 5 | sudo | 1.7.2p1-28.el5 | RHSA-2013:1353 |
Advisories 3
- RHSA-2013:1701 Red Hat Security Advisory: sudo security, bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2013:1353 Red Hat Security Advisory: sudo security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2642-1 sudo - several issues Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.sudo.ws/repos/sudo/rev/049a12a5cc14
- 58207 vdb-entry
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701839
- RHSA-2013:1701 vendor-advisory
- DSA-2642 vendor-advisory
- [oss-security] 20130227 Re: CVE request: potential bypass of sudo tty_tickets constraints mailing-list
- http://www.sudo.ws/repos/sudo/rev/0c0283d1fafa
- http://www.sudo.ws/sudo/alerts/tty_tickets.html
- APPLE-SA-2015-08-13-2 vendor-advisory
- SSA:2013-065-01 vendor-advisory
- https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/87023
- 62741 vdb-entry
- RHSA-2013:1353 vendor-advisory
- https://support.apple.com/kb/HT205031
- https://bugzilla.redhat.com/show_bug.cgi?id=916365
- sudo-ttytickets-sec-bypass(82453) vdb-entry