CVE-2015-8239 The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.
HighCVSS 7.0
EPSS 0.54%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/sudo(Debian:12) | < 1.8.17p1-1 | 1.8.17p1-1 |
| debian/sudo(Debian:13) | < 1.8.17p1-1 | 1.8.17p1-1 |
| debian/sudo(Debian:14) | < 1.8.17p1-1 | 1.8.17p1-1 |
| sudo project sudo | = 1.8.8 | No fix listed |
| sudo project sudo | = 1.8.8-b1 | No fix listed |
| sudo project sudo | = 1.8.8-b2 | No fix listed |
| sudo project sudo | = 1.8.8-b3 | No fix listed |
| sudo project sudo | = 1.8.8-rc1 | No fix listed |
| sudo project sudo | = 1.8.9 | No fix listed |
| sudo project sudo | = 1.8.9-b1 | No fix listed |
| sudo project sudo | = 1.8.9-b2 | No fix listed |
| sudo project sudo | = 1.8.9-p1 | No fix listed |
| sudo project sudo | = 1.8.9-p2 | No fix listed |
| sudo project sudo | = 1.8.9-p3 | No fix listed |
| sudo project sudo | = 1.8.9-p4 | No fix listed |
| sudo project sudo | = 1.8.9-p5 | No fix listed |
| sudo project sudo | = 1.8.9-rc1 | No fix listed |
| sudo project sudo | = 1.8.9-rc2 | No fix listed |
| sudo project sudo | = 1.8.10 | No fix listed |
| sudo project sudo | = 1.8.10-b1 | No fix listed |
| sudo project sudo | = 1.8.10-b2 | No fix listed |
| sudo project sudo | = 1.8.10-b3 | No fix listed |
| sudo project sudo | = 1.8.10-b4 | No fix listed |
| sudo project sudo | = 1.8.10-p1 | No fix listed |
| sudo project sudo | = 1.8.10-p2 | No fix listed |
Show 44 more
| Product | Affected versions | Fixed in |
|---|---|---|
| sudo project sudo | = 1.8.10-p3 | No fix listed |
| sudo project sudo | = 1.8.10-rc1 | No fix listed |
| sudo project sudo | = 1.8.10-rc2 | No fix listed |
| sudo project sudo | = 1.8.10-rc3 | No fix listed |
| sudo project sudo | = 1.8.11 | No fix listed |
| sudo project sudo | = 1.8.11-b1 | No fix listed |
| sudo project sudo | = 1.8.11-b2 | No fix listed |
| sudo project sudo | = 1.8.11-b3 | No fix listed |
| sudo project sudo | = 1.8.11-b4 | No fix listed |
| sudo project sudo | = 1.8.11-p1 | No fix listed |
| sudo project sudo | = 1.8.11-p2 | No fix listed |
| sudo project sudo | = 1.8.11-rc1 | No fix listed |
| sudo project sudo | = 1.8.11-rc2 | No fix listed |
| sudo project sudo | = 1.8.12 | No fix listed |
| sudo project sudo | = 1.8.12-b1 | No fix listed |
| sudo project sudo | = 1.8.12-b2 | No fix listed |
| sudo project sudo | = 1.8.12-b3 | No fix listed |
| sudo project sudo | = 1.8.12-rc1 | No fix listed |
| sudo project sudo | = 1.8.12-rc2 | No fix listed |
| sudo project sudo | = 1.8.13 | No fix listed |
| sudo project sudo | = 1.8.13-b1 | No fix listed |
| sudo project sudo | = 1.8.13-b2 | No fix listed |
| sudo project sudo | = 1.8.13-b3 | No fix listed |
| sudo project sudo | = 1.8.13-b4 | No fix listed |
| sudo project sudo | = 1.8.13-rc1 | No fix listed |
| sudo project sudo | = 1.8.13-rc2 | No fix listed |
| sudo project sudo | = 1.8.14 | No fix listed |
| sudo project sudo | = 1.8.14-b1 | No fix listed |
| sudo project sudo | = 1.8.14-b2 | No fix listed |
| sudo project sudo | = 1.8.14-b3 | No fix listed |
| sudo project sudo | = 1.8.14-b4 | No fix listed |
| sudo project sudo | = 1.8.14-p1 | No fix listed |
| sudo project sudo | = 1.8.14-p2 | No fix listed |
| sudo project sudo | = 1.8.14-p3 | No fix listed |
| sudo project sudo | = 1.8.14-rc1 | No fix listed |
| sudo project sudo | = 1.8.15 | No fix listed |
| sudo project sudo | = 1.8.15-b1 | No fix listed |
| sudo project sudo | = 1.8.15-b2 | No fix listed |
| sudo project sudo | = 1.8.15-b3 | No fix listed |
| sudo project sudo | = 1.8.15-b4 | No fix listed |
| sudo project sudo | = 1.8.15-b5 | No fix listed |
| sudo project sudo | = 1.8.15-rc1 | No fix listed |
| sudo project sudo | = 1.8.15-rc2 | No fix listed |
| sudo project sudo | = 1.8.15-rc3 | No fix listed |
References
- Debian Security Tracker CVE-2015-8239 vendor-advisory
- [oss-security] 20151118 Re: race condition checking digests/checksums in sudoers mailing-list third-party-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- www.sudo.ws issue-tracking patch third-party-advisory
- www.sudo.ws issue-tracking patch third-party-advisory
- www.sudo.ws issue-tracking patch third-party-advisory
- bugs.debian.org issue-tracking