CVE-2008-3067

published 2008-07-07

CVE-2008-3067: sudo in SUSE openSUSE 10.3 does not clear the stdin buffer when password entry times out, which might allow local users to obtain a password by reading stdin…

low 2.1 CVSS 3.1

AV L AC L Au N C P I N A N

sudo in SUSE openSUSE 10.3 does not clear the stdin buffer when password entry times out, which might allow local users to obtain a password by reading stdin from the parent process after a sudo child process exits.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	sudo	< sudo 1.6.9p12-1 (bookworm)	sudo 1.6.9p12-1 (bookworm)
sudo_project	sudo	>= 0 < 1.6.9p12-1	1.6.9p12-1
sudo_project	sudo	>= 0 < 1.6.9p12-1	1.6.9p12-1
sudo_project	sudo	>= 0 < 1.6.9p12-1	1.6.9p12-1
sudo_project	sudo	>= 0 < 1.6.9p12-1	1.6.9p12-1
suse	opensuse	—	—

CVSS provenance

nvd 2.1 LOW AV:L/AC:L/Au:N/C:P/I:N/A:N

osv 2.1 LOW

CWE-255