CVE-2014-9680 sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not view file contents) by...
LowCVSS 3.3
EPSS 0.47%
- Published
- Updated
- Exploit status
- No public exploit known
Description
sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not view file contents) by running a program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log messages, or repositioning tape drives.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/sudo(Debian:12) | < 1.8.12-1 | 1.8.12-1 |
| debian/sudo(Debian:13) | < 1.8.12-1 | 1.8.12-1 |
| debian/sudo(Debian:14) | < 1.8.12-1 | 1.8.12-1 |
| sudo project sudo | <= 1.8.11 | No fix listed |
References
- Debian Security Tracker CVE-2014-9680 vendor-advisory
- [oss-security] 20141016 Abusing TZ for fun (and little profit) exploit mailing-list third-party-advisory
- RHSA-2015:1409 vendor-advisory
- 1033158 vdb-entry
- www.sudo.ws vendor-advisory
- GLSA-201504-02 vendor-advisory
- bugs.debian.org issue-tracking