CVE

Id
62723  
CVE No.
CVE-2013-2776  
Status
Candidate  
Description
sudo 1.3.5 through 1.7.10p5 and 1.8.0 through 1.8.6p6, when running on systems without /proc or the sysctl function with the tty_tickets option enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another terminal. NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.  
Phase
Assigned (20130408)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
626114 62723 CVE-2013-2776 MLIST:[oss-security] 20130227 Re: CVE request: potential bypass of sudo tty_tickets constraints  View
626115 62723 CVE-2013-2776 URL:http://www.openwall.com/lists/oss-security/2013/02/27/31  View
626116 62723 CVE-2013-2776 MISC:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701839  View
626117 62723 CVE-2013-2776 MISC:https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/87023  View
626118 62723 CVE-2013-2776 MISC:https://bugzilla.redhat.com/show_bug.cgi?id=916365  View
626119 62723 CVE-2013-2776 CONFIRM:http://www.sudo.ws/repos/sudo/rev/049a12a5cc14  View
626120 62723 CVE-2013-2776 CONFIRM:http://www.sudo.ws/repos/sudo/rev/0c0283d1fafa  View
626121 62723 CVE-2013-2776 CONFIRM:http://www.sudo.ws/sudo/alerts/tty_tickets.html  View
626122 62723 CVE-2013-2776 CONFIRM:https://support.apple.com/kb/HT205031  View
626123 62723 CVE-2013-2776 CONFIRM:http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html  View
626124 62723 CVE-2013-2776 APPLE:APPLE-SA-2015-08-13-2  View
626125 62723 CVE-2013-2776 URL:http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html  View
626126 62723 CVE-2013-2776 DEBIAN:DSA-2642  View
626127 62723 CVE-2013-2776 URL:http://www.debian.org/security/2013/dsa-2642  View
626128 62723 CVE-2013-2776 REDHAT:RHSA-2013:1353  View
626129 62723 CVE-2013-2776 URL:http://rhn.redhat.com/errata/RHSA-2013-1353.html  View
626130 62723 CVE-2013-2776 REDHAT:RHSA-2013:1701  View
626131 62723 CVE-2013-2776 URL:http://rhn.redhat.com/errata/RHSA-2013-1701.html  View
626132 62723 CVE-2013-2776 SLACKWARE:SSA:2013-065-01  View
626133 62723 CVE-2013-2776 URL:http://www.slackware.com/security/viewer.php?l=slackware-security&y=2013&m=slackware-security.517440  View
626134 62723 CVE-2013-2776 BID:58207  View
626135 62723 CVE-2013-2776 URL:http://www.securityfocus.com/bid/58207  View
626136 62723 CVE-2013-2776 BID:62741  View
626137 62723 CVE-2013-2776 URL:http://www.securityfocus.com/bid/62741  View
626138 62723 CVE-2013-2776 XF:sudo-ttytickets-sec-bypass(82453)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
21223 JVNDB-2013-002798 3S CODESYS Gateway のサーバアプリケーションにおけるサービス運用妨害 (DoS) の脆弱性 3S CODESYS Gateway のサーバアプリケーションには、解放済みメモリの使用 (Use-after-free) により、サービス運用妨害 (デーモンクラッシュ) 状態にされる、または任意のコードを実行される脆弱性が存在します。 CVE-2013-2781 62723 10 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-002798.html  View