sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges.
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
| Link | Tags |
|---|---|
| https://www.sudo.ws/alerts/noexec_wordexp.html | third party advisory |
| http://rhn.redhat.com/errata/RHSA-2016-2872.html | third party advisory vendor advisory |
| http://www.securityfocus.com/bid/95778 | vdb entry third party advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7076 | issue tracking |
| https://security.netapp.com/advisory/ntap-20181127-0002/ | |
| https://usn.ubuntu.com/3968-1/ | vendor advisory |
| https://usn.ubuntu.com/3968-3/ | vendor advisory |