CVE-2017-1000367: sudo_project sudo Race Condition

CVSS: 6.9v2.0MediumModified

AliasesMGASA-2017-0207SUSE-SU-2017:1446-1SUSE-SU-2017:1450-1+7 more

Published 05-06-2017Last modified 05-08-2024

Vulnerability summary

CVE-2017-1000367 is a medium (CVSS 6.9) Race Condition vulnerability in sudo_project sudo. EPSS estimates a 8.00% chance of exploitation in the next 30 days, higher than 94.7% of scored vulnerabilities. 4 public exploits are recorded.

Overall risk

39/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.9/10

010

Medium · v2.0 (NVD)

EPSS score

8.00%

0%100%

Low · +0.05 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits4reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 1 · Related 1

OPENSUSE-SU-2024:11413-1

Timeline

05-06-2017
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.

CVSS metrics

5 scores · 4 sources · 2 versions

v3.06.4v2.06.9

EPSS trend

Probability

8.00%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

+0.05 pp

From 7.95% on 18-09-2026

18-09-202618-10-2026

EPSS score

8.00%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

4 found

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown
referenceUnverified
Exploit Reference (securitytracker.com)
Maturity: unknown

Show all 4 exploits

exploit-databaselocallinuxUnverified
Sudo 1.8.20 - 'get_process_ttyname()' Local Privilege Escalation
Maturity: poc

Weaknesses

CWE · root cause

CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Affected systems

Suse11 products

sudo&distro=SUSE Linux Enterprise Desktop 12 SP1< 1.8.10p3-2.11.1
sudo&distro=SUSE Linux Enterprise Desktop 12 SP2< 1.8.10p3-10.5.1
sudo&distro=SUSE Linux Enterprise Server 12 SP1< 1.8.10p3-2.11.1
sudo&distro=SUSE Linux Enterprise Server 12 SP2< 1.8.10p3-10.5.1
sudo&distro=SUSE Linux Enterprise Server 12-LTSS< 1.8.10p3-2.11.1

Show all 11

Redhat3 products

sudo< 0:1.7.2p1-30.el5_11 | < 0:1.8.6p3-28.el6_9 | < 0:1.8.6p7-22.el7_3
sudo-debuginfo< 0:1.7.2p1-30.el5_11 | < 0:1.8.6p3-28.el6_9 | < 0:1.8.6p7-22.el7_3
sudo-devel< 0:1.8.6p3-28.el6_9 | < 0:1.8.6p7-22.el7_3

Debian1 product

sudo< 1.8.20p1-1 | < 1.8.10p3-1+deb8u4 | < 1.8.5p2-1+nmu3+deb7u3

Mageia1 product

sudo< 1.8.20p2-1.mga5

Sudo_project1 product

sudo≤ 1.8.20

Ubuntu1 product

sudo< 1.8.9p5-1ubuntu1.4 | < 1.8.16-0ubuntu1.4

6 vendors · 18 products

References

39 links

www.ubuntu.com/usn/USN-3304-1Vendor AdvisoryThird Party Advisory
security.gentoo.org/glsa/201705-15Vendor AdvisoryThird Party Advisory
www.securityfocus.com/bid/98745VDB EntryThird Party Advisory
www.sudo.ws/alerts/linux_tty.htmlVendor AdvisoryARTICLEREPORT
seclists.org/fulldisclosure/2017/Jun/3Mailing ListThird Party Advisory
lists.fedoraproject.org/archives/…Vendor Advisory
access.redhat.com/errata/RHSA-2017:1382Vendor AdvisoryThird Party AdvisoryAdvisory
packetstormsecurity.com/files/142783/Sudo-get_process_ttyname-Race-Condition.htmlExploitThird Party AdvisoryVDB Entry
lists.opensuse.org/opensuse-security-announce/2017-05/msg00077.htmlVendor AdvisoryThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2017-05/msg00078.htmlVendor AdvisoryThird Party Advisory

Show all 39 references

www.debian.org/security/2017/dsa-3867Vendor AdvisoryThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2017-05/msg00079.htmlVendor AdvisoryThird Party Advisory
www.exploit-db.com/exploits/42183/ExploitThird Party AdvisoryVDB Entry
www.openwall.com/lists/oss-security/2017/05/30/16Mailing ListExploitThird Party AdvisoryREPORT
access.redhat.com/errata/RHSA-2017:1381Vendor AdvisoryThird Party AdvisoryAdvisory
www.securitytracker.com/id/1038582VDB EntryExploitThird Party Advisory
www.openwall.com/lists/oss-security/2022/12/22/5Mailing List
www.openwall.com/lists/oss-security/2022/12/22/6Mailing List
advisories.mageia.org/MGASA-2017-0207.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=20996REPORT
rhn.redhat.com/errata/RHSA-2017-1382.htmlWEB
www.suse.com/support/update/announcement/2017/suse-su-20171446-1/Advisory
bugzilla.suse.com/1015351REPORT
bugzilla.suse.com/1024145REPORT
bugzilla.suse.com/1039361REPORT
bugzilla.suse.com/981124REPORT
www.suse.com/security/cve/CVE-2017-1000367WEB
www.suse.com/support/update/announcement/2017/suse-su-20171450-1/Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1453074REPORT
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1381.jsonAdvisory
access.redhat.com/security/cve/CVE-2017-1000367REPORT
www.cve.org/CVERecord?id=CVE-2017-1000367AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2017-1000367Advisory
access.redhat.com/security/vulnerabilities/3059071ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1382.jsonAdvisory
ubuntu.com/security/CVE-2017-1000367REPORT
ubuntu.com/security/notices/USN-3304-1Advisory
security-tracker.debian.org/tracker/CVE-2017-1000367Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities