Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

CVE-2021-3156

**CentOS Errata and Security Advisory** CESA-2021:0221


The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.

Security Fix(es):

* sudo: Heap buffer overflow in argument parsing (CVE-2021-3156)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

**Merged security bulletin from advisories:**
http://lists.centos.org/pipermail/centos-announce/2021-January/048252.html

**Affected packages:**
sudo
sudo-devel

**Upstream details at:**


CentOS Errata and Security Advisory CESA-2021:0221
The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.
Security Fix(es):
<ul>
<li>sudo: Heap buffer overflow in argument parsing (CVE-2021-3156)</li>
</ul>
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Merged security bulletin from advisories:
<a href="http://lists.centos.org/pipermail/centos-announce/2021-January/048252.html">http://lists.centos.org/pipermail/centos-announce/2021-January/048252.html</a>
Affected packages:
sudo
sudo-devel
Upstream details at:

Centos

sudo security update

USN-4705-1 fixed a vulnerability in Sudo. This update provides  
the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

Original advisory details:

It was discovered that Sudo incorrectly handled memory when parsing command  
lines. A local attacker could possibly use this issue to obtain unintended  
access to the administrator account. (CVE-2021-3156)

USN-4705-1 fixed a vulnerability in Sudo. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.
Original advisory details:
It was discovered that Sudo incorrectly handled memory when parsing command lines. A local attacker could possibly use this issue to obtain unintended access to the administrator account. (CVE-2021-3156)

Ubuntu

Sudo vulnerability

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2534-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                 Salvatore Bonaccorso
January 26, 2021                              https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : sudo
Version        : 1.8.19p1-2.1+deb9u3
CVE ID         : CVE-2021-3156

The Qualys Research Labs discovered a heap-based buffer overflow
vulnerability in sudo, a program designed to provide limited super user
privileges to specific users. Any local user (sudoers and non-sudoers)
can exploit this flaw for root privilege escalation.

For Debian 9 stretch, this problem has been fixed in version
1.8.19p1-2.1+deb9u3.

We recommend that you upgrade your sudo packages.

For the detailed security status of sudo please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/sudo

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


<hr />
Debian LTS Advisory DLA-2534-1 <a href="mailto:debian-lts@lists.debian.org">debian-lts@lists.debian.org</a>
<a href="https://www.debian.org/lts/security/">https://www.debian.org/lts/security/</a> Salvatore Bonaccorso
January 26, 2021 <a href="https://wiki.debian.org/LTS">https://wiki.debian.org/LTS</a>
<hr />
Package : sudo
Version : 1.8.19p1-2.1+deb9u3
CVE ID : CVE-2021-3156
The Qualys Research Labs discovered a heap-based buffer overflow
vulnerability in sudo, a program designed to provide limited super user
privileges to specific users. Any local user (sudoers and non-sudoers)
can exploit this flaw for root privilege escalation.
For Debian 9 stretch, this problem has been fixed in version
1.8.19p1-2.1+deb9u3.
We recommend that you upgrade your sudo packages.
For the detailed security status of sudo please refer to its security
tracker page at:
<a href="https://security-tracker.debian.org/tracker/sudo">https://security-tracker.debian.org/tracker/sudo</a>
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: <a href="https://wiki.debian.org/LTS">https://wiki.debian.org/LTS</a>

Debian

[SECURITY] [DLA 2534-1] sudo security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4839-1                   security@debian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
January 26, 2021                      https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : sudo
CVE ID         : CVE-2021-3156

The Qualys Research Labs discovered a heap-based buffer overflow
vulnerability in sudo, a program designed to provide limited super user
privileges to specific users. Any local user (sudoers and non-sudoers)
can exploit this flaw for root privilege escalation.

For the stable distribution (buster), this problem has been fixed in
version 1.8.27-1+deb10u3.

We recommend that you upgrade your sudo packages.

For the detailed security status of sudo please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/sudo

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org


<hr />
Debian Security Advisory DSA-4839-1 <a href="mailto:security@debian.org">security@debian.org</a>
<a href="https://www.debian.org/security/">https://www.debian.org/security/</a> Salvatore Bonaccorso
January 26, 2021 <a href="https://www.debian.org/security/faq">https://www.debian.org/security/faq</a>
<hr />
Package : sudo
CVE ID : CVE-2021-3156
The Qualys Research Labs discovered a heap-based buffer overflow
vulnerability in sudo, a program designed to provide limited super user
privileges to specific users. Any local user (sudoers and non-sudoers)
can exploit this flaw for root privilege escalation.
For the stable distribution (buster), this problem has been fixed in
version 1.8.27-1+deb10u3.
We recommend that you upgrade your sudo packages.
For the detailed security status of sudo please refer to its security
tracker page at:
<a href="https://security-tracker.debian.org/tracker/sudo">https://security-tracker.debian.org/tracker/sudo</a>
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: <a href="https://www.debian.org/security/">https://www.debian.org/security/</a>
Mailing list: <a href="mailto:debian-security-announce@lists.debian.org">debian-security-announce@lists.debian.org</a>

[SECURITY] [DSA 4839-1] sudo security update

It was discovered that Sudo incorrectly handled memory when parsing command  
lines. A local attacker could possibly use this issue to obtain unintended  
access to the administrator account. (CVE-2021-3156)

It was discovered that the Sudo sudoedit utility incorrectly handled  
checking directory permissions. A local attacker could possibly use this  
issue to bypass file permissions and determine if a directory exists or  
not. (CVE-2021-23239)

It was discovered that Sudo incorrectly handled memory when parsing command lines. A local attacker could possibly use this issue to obtain unintended access to the administrator account. (CVE-2021-3156)
It was discovered that the Sudo sudoedit utility incorrectly handled checking directory permissions. A local attacker could possibly use this issue to bypass file permissions and determine if a directory exists or not. (CVE-2021-23239)

Sudo vulnerabilities

Featured CVEs

Feed of the featured CVEs from Vulcan Remedy Cloud.

Vulcan Remedy Cloud - Featured CVEs

Thank you for downloading from Remedy Cloud!

Please fill out the form to download the CSV

Your Script is On It's Way!

Tell us where to send the script

Your Email Was Successfully Sent!

Email

Your Name

Your fix has been sent successfully!

Suggest a Fix

Search for a CVE below to see all the available fixes

Remedy Cloud

Loading - Vulcan Remedy Cloud

The page you are looking for was moved, removed, renamed or might never existed.

CVE-2021-3156

37 fixes found:

Version Update

sudo security update

Version Update

Sudo vulnerability

Version Update

Sudo vulnerability

Version Update

[SECURITY] [DLA 2534-1] sudo security update

Version Update

[SECURITY] [DSA 4839-1] sudo security update

Version Update

Sudo vulnerabilities

Version Update

Sudo vulnerabilities

Version Update

Sudo vulnerabilities