CVE-2021-3156

Опубликовано: 26 янв. 2021

Источник: nvd

CVSS3: 7.8

CVSS2: 7.2

EPSS Критический

Описание

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

Ссылки

http://packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.html
Exploit
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/161230/Sudo-Buffer-Overflow-Privilege-Escalation.html
Exploit
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/161270/Sudo-1.9.5p1-Buffer-Overflow-Privilege-Escalation.html
Exploit
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/161293/Sudo-1.8.31p2-1.9.5p1-Buffer-Overflow.html
Exploit
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2021/Feb/42
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2021/Jan/79
Exploit
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2024/Feb/3
Exploit
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/01/26/3
Exploit
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/01/27/1
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/01/27/2
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/02/15/1
Exploit
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/09/14/2
Mailing List
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/01/30/6
Exploit
Mailing List
http://www.openwall.com/lists/oss-security/2024/01/30/8
Mailing List
https://kc.mcafee.com/corporate/index?page=content&id=SB10348
Broken Link
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/01/msg00022.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CALA5FTXIQBRRYUA2ZQNJXB6OQMAXEII/
Mailing List
Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LHXK6ICO5AYLGFK2TAX5MZKUXTUKWOJY/
Mailing List
Release Notes
https://security.gentoo.org/glsa/202101-33
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*

Версия от 1.8.2 (включая) до 1.8.32 (исключая)

cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*

Версия от 1.9.0 (включая) до 1.9.5 (исключая)

cpe:2.3:a:sudo_project:sudo:1.9.5:-:*:*:*:*:*:*

cpe:2.3:a:sudo_project:sudo:1.9.5:patch1:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*

cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:oncommand_unified_manager_core_package:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:ontap_tools:9:*:*:*:*:vmware_vsphere:*:*

cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:a:mcafee:web_gateway:8.2.17:*:*:*:*:*:*:*

cpe:2.3:a:mcafee:web_gateway:9.2.8:*:*:*:*:*:*:*

cpe:2.3:a:mcafee:web_gateway:10.0.4:*:*:*:*:*:*:*

Конфигурация 6

Одно из

cpe:2.3:a:synology:diskstation_manager_unified_controller:3.0:*:*:*:*:*:*:*

cpe:2.3:o:synology:diskstation_manager:6.2:*:*:*:*:*:*:*

Конфигурация 7

Одновременно

cpe:2.3:o:synology:skynas_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:synology:skynas:-:*:*:*:*:*:*:*

Конфигурация 8

Одновременно

cpe:2.3:o:synology:vs960hd_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:synology:vs960hd:-:*:*:*:*:*:*:*

Конфигурация 9

Одно из

cpe:2.3:a:beyondtrust:privilege_management_for_mac:*:*:*:*:*:*:*:*

Версия до 21.1.1 (исключая)

cpe:2.3:a:beyondtrust:privilege_management_for_unix\/linux:*:*:*:*:basic:*:*:*

Версия до 10.3.2-10 (исключая)

Конфигурация 10

Одновременно

cpe:2.3:o:oracle:micros_compact_workstation_3_firmware:310:*:*:*:*:*:*:*

cpe:2.3:h:oracle:micros_compact_workstation_3:-:*:*:*:*:*:*:*

Конфигурация 11

Одновременно

cpe:2.3:o:oracle:micros_es400_firmware:*:*:*:*:*:*:*:*

Версия от 400 (включая) до 410 (включая)

cpe:2.3:h:oracle:micros_es400:-:*:*:*:*:*:*:*

Конфигурация 12

Одновременно

cpe:2.3:o:oracle:micros_kitchen_display_system_firmware:210:*:*:*:*:*:*:*

cpe:2.3:h:oracle:micros_kitchen_display_system:-:*:*:*:*:*:*:*

Конфигурация 13

Одновременно

cpe:2.3:o:oracle:micros_workstation_5a_firmware:5a:*:*:*:*:*:*:*

cpe:2.3:h:oracle:micros_workstation_5a:-:*:*:*:*:*:*:*

Конфигурация 14

Одновременно

cpe:2.3:o:oracle:micros_workstation_6_firmware:*:*:*:*:*:*:*:*

Версия от 610 (включая) до 655 (включая)

cpe:2.3:h:oracle:micros_workstation_6:-:*:*:*:*:*:*:*

Конфигурация 15

Одно из

cpe:2.3:a:oracle:communications_performance_intelligence_center:*:*:*:*:*:*:*:*

Версия от 10.3.0.0.0 (включая) до 10.3.0.2.1 (включая)

cpe:2.3:a:oracle:communications_performance_intelligence_center:*:*:*:*:*:*:*:*

Версия от 10.4.0.1.0 (включая) до 10.4.0.3.1 (включая)

cpe:2.3:a:oracle:tekelec_platform_distribution:*:*:*:*:*:*:*:*

Версия от 7.4.0 (включая) до 7.7.1 (включая)

EPSS

Процентиль: 100%

0.92309

Критический

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-193

Связанные уязвимости

CVE-2021-3156

CVSS3: 7.8

ubuntu

около 5 лет назад

CVE-2021-3156

CVSS3: 7.8

redhat

около 5 лет назад

CVE-2021-3156

CVSS3: 7.8

debian

около 5 лет назад

Sudo before 1.9.5p2 contains an off-by-one error that can result in a ...

openSUSE-SU-2021:0602-1

suse-cvrf

почти 5 лет назад

Security update for sudo

SUSE-SU-2024:4389-1

suse-cvrf

около 1 года назад

Security update for sudo

EPSS

Процентиль: 100%

0.92309

Критический

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-193