Sudo Heap-Based Buffer Overflow Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 06/04/2022. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| privilege management for mac | < 21.1.1 | 21.1.1 |
| privilege management for unix/linux | < 10.3.2-10 | 10.3.2-10 |
| web gateway | = 10.0.4= 8.2.17= 9.2.8 | |
| ontap tools | = 9 | |
| communications performance intelligence center | ≥ 10.3.0.0.0, ≤ 10.3.0.2.1≥ 10.4.0.1.0, ≤ 10.4.0.3.1 | |
| tekelec platform distribution | ≥ 7.4.0, ≤ 7.7.1 | |
| sudo | = 1.9.5≥ 1.8.2, < 1.8.32≥ 1.9.0, < 1.9.5 | 1.8.321.9.5 |
| diskstation manager unified controller | = 3.0 |
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free