Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer. The impact could vary depending on the system libraries, compiler, and processor architecture.
The product reads data past the end, or before the beginning, of the intended buffer.
| Link | Tags |
|---|---|
| https://www.sudo.ws/security/advisories/ | vendor advisory |
| https://github.com/sudo-project/sudo/commit/bd209b9f16fcd1270c13db27ae3329c677d48050 | third party advisory patch |
| https://news.ycombinator.com/item?id=33465707 | third party advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2139911 | third party advisory issue tracking |
| https://security.gentoo.org/glsa/202211-08 | third party advisory vendor advisory |