CVE-2016-7032
published 2017-04-14CVE-2016-7032: sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that calls the (1)…
PriorityP428high7CVSS 3.0
AVLACHPRLUINSUCHIHAH
EPSS
0.34%
26.0th percentile
sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that calls the (1) system or (2) popen function.
Affected
34 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | sudo | < sudo 1.8.15-1 (bookworm) | sudo 1.8.15-1 (bookworm) |
| sudo_project | sudo | >= 0 < 1.8.15-1 | 1.8.15-1 |
| sudo_project | sudo | >= 0 < 1.8.15-1 | 1.8.15-1 |
| sudo_project | sudo | >= 0 < 1.8.15-1 | 1.8.15-1 |
| sudo_project | sudo | >= 0 < 1.8.15-1 | 1.8.15-1 |
| sudo_project | sudo | >= 0 < 1.8.9p5-1ubuntu1.5+esm5 | 1.8.9p5-1ubuntu1.5+esm5 |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
CVSS provenance
nvdv3.07.0HIGHCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
osv7.0HIGH
vendor_debian7.0HIGH
vendor_redhat7.0HIGH
vendor_ubuntu7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Sudo vulnerabilities
vendor_ubuntu·2020-09-28·CVSS 7.0
CVE-2016-7032 [HIGH] Sudo vulnerabilities
Title: Sudo vulnerabilities
Summary: Several security issues were fixed in Sudo.
USN-3968-1 fixed several vulnerabilities in Sudo. This update provides
the corresponding update for Ubuntu 14.04 ESM.
Original advisory details:
Florian Weimer discovered that Sudo incorrectly handled the noexec
restriction when used with certain applications. A local attacker could
possibly use this issue to bypass configured restrictions and execute
arbitrary commands. (CVE-2016-7076, CVE-2016-7032)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
sudo: noexec bypass via system() and popen()
vendor_redhat·2016-10-26·CVSS 7.0
CVE-2016-7032 [HIGH] CWE-184 sudo: noexec bypass via system() and popen()
sudo: noexec bypass via system() and popen()
sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that calls the (1) system or (2) popen function.
It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed system() or popen() C library functions with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could use this flaw to execute arbitrary commands with elevated privileges.
Package: sudo (Red Hat Enterprise Linux 5) - Will not fix
Debian
CVE-2016-7032: sudo - sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass ...
vendor_debian·2016·CVSS 7.0
CVE-2016-7032 [HIGH] CVE-2016-7032: sudo - sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass ...
sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that calls the (1) system or (2) popen function.
Scope: local
bookworm: resolved (fixed in 1.8.15-1)
bullseye: resolved (fixed in 1.8.15-1)
forky: resolved (fixed in 1.8.15-1)
sid: resolved (fixed in 1.8.15-1)
trixie: resolved (fixed in 1.8.15-1)
GHSA
GHSA-wmxc-c63f-gpf8: sudo_noexec
ghsa_unreviewed·2022-05-13
CVE-2016-7032 [HIGH] CWE-284 GHSA-wmxc-c63f-gpf8: sudo_noexec
sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that calls the (1) system or (2) popen function.
OSV
sudo vulnerabilities
osv·2020-09-28·CVSS 7.0
CVE-2016-7076 [HIGH] sudo vulnerabilities
sudo vulnerabilities
USN-3968-1 fixed several vulnerabilities in Sudo. This update provides
the corresponding update for Ubuntu 14.04 ESM.
Original advisory details:
Florian Weimer discovered that Sudo incorrectly handled the noexec
restriction when used with certain applications. A local attacker could
possibly use this issue to bypass configured restrictions and execute
arbitrary commands. (CVE-2016-7076, CVE-2016-7032)
OSV
CVE-2016-7032: sudo_noexec
osv·2017-04-14·CVSS 7.0
CVE-2016-7032 [HIGH] CVE-2016-7032: sudo_noexec
sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that calls the (1) system or (2) popen function.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-7076 sudo: noexec bypass via wordexp()
bugzilla·2016-10-14·CVSS 7.0
CVE-2016-7076 [HIGH] CVE-2016-7076 sudo: noexec bypass via wordexp()
CVE-2016-7076 sudo: noexec bypass via wordexp()
The sudo allows the use of NOEXEC tag it its configuration to define that program executed via sudo can not execute any other commands. This restriction is implemented via dynamic library which is preloaded for the executed program and which implements wrappers for various exec functions.
It was discovered that the wrapping of exec functions is insufficient to block command execution via glibc APIs that internally call one of the exec functions - system() or popen() (see CVE-2016-7032 tracked via bug 1372830), and wordexp (CVE-2016-7076, tracked via this bug).
This issue was originally tracked under single CVE via bug 1372830, but the CVE assignment was split because of different versions in which problems for system()/popen() and wordexp(
Bugzilla
CVE-2016-7032 sudo: noexec bypass via system() and popen()
bugzilla·2016-09-02·CVSS 7.0
CVE-2016-7032 [HIGH] CVE-2016-7032 sudo: noexec bypass via system() and popen()
CVE-2016-7032 sudo: noexec bypass via system() and popen()
Florian Weimer of Red Hat reports:
the sudoers manual page says this:
EXEC and NOEXEC
If sudo has been compiled with noexec support and the underly‐
ing operating system supports it, the NOEXEC tag can be used to
prevent a dynamically-linked executable from running further
commands itself.
In the following example, user aaron may run /usr/bin/more and
/usr/bin/vi but shell escapes will be disabled.
aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
And:
To enable noexec for a command, use the NOEXEC tag as
documented in the User Specification section above.
Here is that example again:
aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
This allows user aaron to run /usr/bin/more and
/usr/bin/vi with noexec enabled. This wil
http://rhn.redhat.com/errata/RHSA-2016-2872.htmlhttp://www.securityfocus.com/bid/95776https://bugzilla.redhat.com/show_bug.cgi?id=1372830https://usn.ubuntu.com/3968-3/https://www.sudo.ws/alerts/noexec_bypass.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2872.htmlhttp://www.securityfocus.com/bid/95776https://bugzilla.redhat.com/show_bug.cgi?id=1372830https://usn.ubuntu.com/3968-3/https://www.sudo.ws/alerts/noexec_bypass.html
2017-04-14
Published