CVE-2002-0184 Sudo before 1.6.6 contains an off-by-one error that can result in a heap-based buffer overflow that may allow local users to gain root privileges via special characters in the -p (prompt) argument, wh...
HighCVSS 7.8
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Sudo before 1.6.6 contains an off-by-one error that can result in a heap-based buffer overflow that may allow local users to gain root privileges via special characters in the -p (prompt) argument, which are not properly expanded.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sudo project sudo | < 1.6.6 | 1.6.6 |
| debian linux | = 2.2 | No fix listed |
References
- CLA-2002:475 broken-link third-party-advisory vendor-advisory
- 20020425 [Global InterSec 2002041701] Sudo Password Prompt mailing-list
- 20020425 Sudo version 1.6.6 now available (fwd) mailing-list patch
- 20020425 [slackware-security] sudo upgrade fixes a potential vulnerability mailing-list patch
- TSLSA-2002-0046 mailing-list vendor-advisory
- DSA-128 broken-link third-party-advisory vendor-advisory
- sudo-password-expansion-overflow(8936) broken-link vdb-entry
- VU#820083 third-party-advisory us-government-resource
- MDKSA-2002:028 broken-link vendor-advisory
- ESA-20020429-010 broken-link patch vendor-advisory
- SuSE-SA:2002:014 broken-link vendor-advisory
- RHSA-2002:071 broken-link third-party-advisory vendor-advisory
- RHSA-2002:072 broken-link third-party-advisory vendor-advisory
- 4593 broken-link third-party-advisory vdb-entry