CVE-2013-2777
published 2013-04-08CVE-2013-2777: sudo before 1.7.10p5 and 1.8.x before 1.8.6p6, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows…
PriorityP414medium4.4CVSS 2.0
AVLACMAuNCPIPAP
EPSS
0.36%
29.0th percentile
sudo before 1.7.10p5 and 1.8.x before 1.8.6p6, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to a session without a controlling terminal device and connecting to the standard input, output, and error file descriptors of another terminal. NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.
Affected
81 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | mac_os_x | <= 10.10.4 | — |
| apple | os_x_yosemite_v10.10.5_and_security_update_2015-006 | — | — |
| debian | sudo | < sudo 1.8.5p2-1+nmu1 (bookworm) | sudo 1.8.5p2-1+nmu1 (bookworm) |
| sudo_project | sudo | >= 0 < 1.8.5p2-1+nmu1 | 1.8.5p2-1+nmu1 |
| sudo_project | sudo | >= 0 < 1.8.5p2-1+nmu1 | 1.8.5p2-1+nmu1 |
| sudo_project | sudo | >= 0 < 1.8.5p2-1+nmu1 | 1.8.5p2-1+nmu1 |
| sudo_project | sudo | >= 0 < 1.8.5p2-1+nmu1 | 1.8.5p2-1+nmu1 |
| todd_miller | sudo | <= 1.7.10p4 | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
CVSS provenance
nvdv2.04.4MEDIUMAV:L/AC:M/Au:N/C:P/I:P/A:P
osv4.4MEDIUM
vendor_debian4.4MEDIUM
vendor_redhat4.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qjfx-m5pf-3ccg: sudo before 1
ghsa_unreviewed·2022-05-17·CVSS 4.4
CVE-2013-2777 [MEDIUM] GHSA-qjfx-m5pf-3ccg: sudo before 1
sudo before 1.7.10p5 and 1.8.x before 1.8.6p6, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to a session without a controlling terminal device and connecting to the standard input, output, and error file descriptors of another terminal. NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.
OSV
CVE-2013-2777: sudo before 1
osv·2013-04-08·CVSS 4.4
CVE-2013-2777 [MEDIUM] CVE-2013-2777: sudo before 1
sudo before 1.7.10p5 and 1.8.x before 1.8.6p6, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to a session without a controlling terminal device and connecting to the standard input, output, and error file descriptors of another terminal. NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.
Red Hat
sudo: bypass of tty_tickets constraints
vendor_redhat·2013-02-27·CVSS 4.4
CVE-2013-2777 [MEDIUM] sudo: bypass of tty_tickets constraints
sudo: bypass of tty_tickets constraints
sudo before 1.7.10p5 and 1.8.x before 1.8.6p6, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to a session without a controlling terminal device and connecting to the standard input, output, and error file descriptors of another terminal. NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.
Package: sudo (Red Hat Enterprise Linux 5) - Not affected
Debian
CVE-2013-2777: sudo - sudo before 1.7.10p5 and 1.8.x before 1.8.6p6, when the tty_tickets option is en...
vendor_debian·2013·CVSS 4.4
CVE-2013-2777 [MEDIUM] CVE-2013-2777: sudo - sudo before 1.7.10p5 and 1.8.x before 1.8.6p6, when the tty_tickets option is en...
sudo before 1.7.10p5 and 1.8.x before 1.8.6p6, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to a session without a controlling terminal device and connecting to the standard input, output, and error file descriptors of another terminal. NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.
Scope: local
bookworm: resolved (fixed in 1.8.5p2-1+nmu1)
bullseye: resolved (fixed in 1.8.5p2-1+nmu1)
forky: resolved (fixed in 1.8.5p2-1+nmu1)
sid: resolved (fixed in 1.8.5p2-1+nmu1)
trixie: resolved (fixed in 1.8.5p2-1+nm
Apple
CVE-2013-2777: OS X Yosemite v10.10.5 and Security Update 2015-006
vendor_apple·CVSS 4.4
CVE-2013-2777 [MEDIUM] CVE-2013-2777: OS X Yosemite v10.10.5 and Security Update 2015-006
Apple Security Update: About the security content of OS X Yosemite v10.10.5 and Security Update 2015-006
Product: OS X Yosemite v10.10.5 and Security Update 2015-006
CVE: CVE-2013-2777
Component: CVE-2013-2777
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2013-2777 sudo: bypass of tty_tickets constraints
bugzilla·2013-04-08·CVSS 4.4
CVE-2013-2777 [MEDIUM] CVE-2013-2777 sudo: bypass of tty_tickets constraints
CVE-2013-2777 sudo: bypass of tty_tickets constraints
Common Vulnerabilities and Exposures assigned an identifier CVE-2013-2777 to
the following vulnerability:
Name: CVE-2013-2777
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2777
Assigned: 20130408
Reference: http://www.openwall.com/lists/oss-security/2013/02/27/31
Reference: https://bugzilla.redhat.com/show_bug.cgi?id=916365
Reference: http://www.sudo.ws/repos/sudo/rev/2f3225a2a4a4
Reference: http://www.sudo.ws/repos/sudo/rev/bfa23f089bba
Reference: http://www.sudo.ws/sudo/alerts/tty_tickets.html
Reference: http://www.securityfocus.com/bid/58207
sudo before 1.7.10p5 and 1.8.x before 1.8.6p6, when the tty_tickets
option is enabled, does not properly validate the controlling terminal
device, which allows local users with s
Bugzilla
CVE-2013-1776 sudo: bypass of tty_tickets constraints
bugzilla·2013-02-27·CVSS 4.4
CVE-2013-1776 [MEDIUM] CVE-2013-1776 sudo: bypass of tty_tickets constraints
CVE-2013-1776 sudo: bypass of tty_tickets constraints
From the upstream advisory:
When a user successfully authenticates with sudo, a time stamp file is updated to allow that user to continue running sudo without requiring a password for a preset time period (five minutes by default).
This time stamp file can either be common to all of a user's terminals, or it can be specific to the particular terminal the user authenticated themselves on. The terminal-specific time stamp file behavior can be controlled using the "tty_tickets" option in the sudoers file. This option has been enabled by default since sudo 1.7.4. Prior to sudo 1.7.4, the default was to use a single time stamp for all the user's sessions.
A vulnerability exists because the user can control which terminal the standard inpu
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701839http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1701.htmlhttp://www.debian.org/security/2013/dsa-2642http://www.openwall.com/lists/oss-security/2013/02/27/31http://www.securityfocus.com/bid/58207http://www.slackware.com/security/viewer.php?l=slackware-security&y=2013&m=slackware-security.517440http://www.sudo.ws/repos/sudo/rev/2f3225a2a4a4http://www.sudo.ws/repos/sudo/rev/bfa23f089bbahttp://www.sudo.ws/sudo/alerts/tty_tickets.htmlhttps://bugs.launchpad.net/ubuntu/+source/sudo/+bug/87023https://bugzilla.redhat.com/show_bug.cgi?id=916365https://exchange.xforce.ibmcloud.com/vulnerabilities/82453https://support.apple.com/kb/HT205031http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701839http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1701.htmlhttp://www.debian.org/security/2013/dsa-2642http://www.openwall.com/lists/oss-security/2013/02/27/31http://www.securityfocus.com/bid/58207http://www.slackware.com/security/viewer.php?l=slackware-security&y=2013&m=slackware-security.517440http://www.sudo.ws/repos/sudo/rev/2f3225a2a4a4http://www.sudo.ws/repos/sudo/rev/bfa23f089bbahttp://www.sudo.ws/sudo/alerts/tty_tickets.htmlhttps://bugs.launchpad.net/ubuntu/+source/sudo/+bug/87023https://bugzilla.redhat.com/show_bug.cgi?id=916365https://exchange.xforce.ibmcloud.com/vulnerabilities/82453https://support.apple.com/kb/HT205031
2013-04-08
Published