NVD

Id
38699  
Name
CVE-2013-2776  
Description
sudo 1.3.5 through 1.7.10p5 and 1.8.0 through 1.8.6p6, when running on systems without /proc or the sysctl function with the tty_tickets option enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another terminal. NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.  
Reject
 
CVSS Version
2  
CVSS Score
4.4  
Severity
Medium  
CVSS Base Score
4.4  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2013-04-08  
Modified Date
2016-11-28  
Seq
2013-2776  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
198294 38699 CVE-2013-2776 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701839  View
198295 38699 CVE-2013-2776 APPLE-SA-2015-08-13-2  View
198296 38699 CVE-2013-2776 RHSA-2013:1353  View
198297 38699 CVE-2013-2776 RHSA-2013:1701  View
198298 38699 CVE-2013-2776 DSA-2642  View
198299 38699 CVE-2013-2776 [oss-security] 20130227 Re: CVE request: potential bypass of sudo tty_tickets constraints  View
198300 38699 CVE-2013-2776 http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html  View
198301 38699 CVE-2013-2776 58207  View
198302 38699 CVE-2013-2776 62741  View
198303 38699 CVE-2013-2776 SSA:2013-065-01  View
198304 38699 CVE-2013-2776 http://www.sudo.ws/repos/sudo/rev/049a12a5cc14  View
198305 38699 CVE-2013-2776 http://www.sudo.ws/repos/sudo/rev/0c0283d1fafa  View
198306 38699 CVE-2013-2776 http://www.sudo.ws/sudo/alerts/tty_tickets.html  View
198307 38699 CVE-2013-2776 sudo-ttytickets-sec-bypass(82453)  View
198308 38699 CVE-2013-2776 https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/87023  View
198309 38699 CVE-2013-2776 https://bugzilla.redhat.com/show_bug.cgi?id=916365  View
198310 38699 CVE-2013-2776 https://support.apple.com/kb/HT205031  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
20593 JVNDB-2013-002168 sudo における認証をハイジャックされる脆弱性 sudo は、tty_tickets オプションが有効な状態で /proc または sysctl 関数がないシステム上で稼働している場合、制御ターミナルデバイス (controlling terminal device) を適切に検証しないため、他の端末のターミナルをハイジャックされる脆弱性が存在します。 CVE-2013-2776 62718 CVE-2013-2776 38699 4.4 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-002168.html 2013-02-27 2015-08-31 View