NVD

Id
38700  
Name
CVE-2013-2777  
Description
sudo before 1.7.10p5 and 1.8.x before 1.8.6p6, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to a session without a controlling terminal device and connecting to the standard input, output, and error file descriptors of another terminal. NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.  
Reject
 
CVSS Version
2  
CVSS Score
4.4  
Severity
Medium  
CVSS Base Score
4.4  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2013-04-08  
Modified Date
2016-03-30  
Seq
2013-2777  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
198311 38700 CVE-2013-2777 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701839  View
198312 38700 CVE-2013-2777 APPLE-SA-2015-08-13-2  View
198313 38700 CVE-2013-2777 RHSA-2013:1701  View
198314 38700 CVE-2013-2777 DSA-2642  View
198315 38700 CVE-2013-2777 [oss-security] 20130227 Re: CVE request: potential bypass of sudo tty_tickets constraints  View
198316 38700 CVE-2013-2777 58207  View
198317 38700 CVE-2013-2777 SSA:2013-065-01  View
198318 38700 CVE-2013-2777 http://www.sudo.ws/repos/sudo/rev/2f3225a2a4a4  View
198319 38700 CVE-2013-2777 http://www.sudo.ws/repos/sudo/rev/bfa23f089bba  View
198320 38700 CVE-2013-2777 http://www.sudo.ws/sudo/alerts/tty_tickets.html  View
198321 38700 CVE-2013-2777 sudo-ttytickets-sec-bypass(82453)  View
198322 38700 CVE-2013-2777 https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/87023  View
198323 38700 CVE-2013-2777 https://bugzilla.redhat.com/show_bug.cgi?id=916365  View
198324 38700 CVE-2013-2777 https://support.apple.com/kb/HT205031  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
20594 JVNDB-2013-002169 sudo における認証をハイジャックされる脆弱性 sudo は、tty_tickets オプションが有効な場合、制御ターミナルデバイス (controlling terminal device) を適切に検証しないため、他のターミナルの認証をハイジャックされる脆弱性が存在します。 CVE-2013-2777 62719 CVE-2013-2777 38700 4.4 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-002169.html 2013-02-27 2015-08-31 View