medium
4.4
CWE
264
Advisory Published
CVE Published
Updated

CVE-2013-1776

First published: Wed Feb 27 2013(Updated: )

From the upstream advisory: When a user successfully authenticates with sudo, a time stamp file is updated to allow that user to continue running sudo without requiring a password for a preset time period (five minutes by default). This time stamp file can either be common to all of a user's terminals, or it can be specific to the particular terminal the user authenticated themselves on. The terminal-specific time stamp file behavior can be controlled using the "tty_tickets" option in the sudoers file. This option has been enabled by default since sudo 1.7.4. Prior to sudo 1.7.4, the default was to use a single time stamp for all the user's sessions. A vulnerability exists because the user can control which terminal the standard input, output and error file descriptors (0-2) refer to. A malicious user could use this to run commands via sudo without authenticating, so long as there exists a terminal the user has access to where a sudo command was successfully run by that same user within the password timeout period (usually five minutes). The vulnerability does not permit a user to run commands other than those allowed by the sudoers policy. This affects versions 1.3.5 through up to the fixed 1.7.10p6 version, and sudo 1.8.0 through to the fixed 1.8.7p7. The fix for 1.7.x: <a href="http://www.sudo.ws/repos/sudo/rev/0c0283d1fafa">http://www.sudo.ws/repos/sudo/rev/0c0283d1fafa</a> The fix for 1.8.x: <a href="http://www.sudo.ws/repos/sudo/rev/049a12a5cc14">http://www.sudo.ws/repos/sudo/rev/049a12a5cc14</a> External References: <a href="http://www.sudo.ws/sudo/alerts/tty_tickets.html">http://www.sudo.ws/sudo/alerts/tty_tickets.html</a>

Credit: secalert@redhat.com

Affected SoftwareAffected VersionHow to fix
redhat/sudo<1.8.5
1.8.5
redhat/sudo<1.7.10
1.7.10
Apple iOS and macOS<=10.10.4
Todd Miller Sudo=1.8.0
Todd Miller Sudo=1.8.1
Todd Miller Sudo=1.8.1p1
Todd Miller Sudo=1.8.1p2
Todd Miller Sudo=1.8.2
Todd Miller Sudo=1.8.3
Todd Miller Sudo=1.8.3p1
Todd Miller Sudo=1.8.3p2
Todd Miller Sudo=1.8.4
Todd Miller Sudo=1.8.4p1
Todd Miller Sudo=1.8.4p2
Todd Miller Sudo=1.8.4p3
Todd Miller Sudo=1.8.4p4
Todd Miller Sudo=1.8.4p5
Todd Miller Sudo=1.8.5
Todd Miller Sudo=1.3.5
Todd Miller Sudo=1.6
Todd Miller Sudo=1.6.1
Todd Miller Sudo=1.6.2
Todd Miller Sudo=1.6.2p3
Todd Miller Sudo=1.6.3
Todd Miller Sudo=1.6.3_p7
Todd Miller Sudo=1.6.4
Todd Miller Sudo=1.6.4p2
Todd Miller Sudo=1.6.5
Todd Miller Sudo=1.6.6
Todd Miller Sudo=1.6.7
Todd Miller Sudo=1.6.7p5
Todd Miller Sudo=1.6.8
Todd Miller Sudo=1.6.8p12
Todd Miller Sudo=1.6.9
Todd Miller Sudo=1.6.9p20
Todd Miller Sudo=1.6.9p21
Todd Miller Sudo=1.6.9p22
Todd Miller Sudo=1.6.9p23
Todd Miller Sudo=1.7.0
Todd Miller Sudo=1.7.1
Todd Miller Sudo=1.7.2
Todd Miller Sudo=1.7.2p1
Todd Miller Sudo=1.7.2p2
Todd Miller Sudo=1.7.2p3
Todd Miller Sudo=1.7.2p4
Todd Miller Sudo=1.7.2p5
Todd Miller Sudo=1.7.2p6
Todd Miller Sudo=1.7.2p7
Todd Miller Sudo=1.7.3b1
Todd Miller Sudo=1.7.4
Todd Miller Sudo=1.7.4p1
Todd Miller Sudo=1.7.4p2
Todd Miller Sudo=1.7.4p3
Todd Miller Sudo=1.7.4p4
Todd Miller Sudo=1.7.4p5
Todd Miller Sudo=1.7.4p6
Todd Miller Sudo=1.7.5
Todd Miller Sudo=1.7.6
Todd Miller Sudo=1.7.6p1
Todd Miller Sudo=1.7.6p2
Todd Miller Sudo=1.7.7
Todd Miller Sudo=1.7.8
Todd Miller Sudo=1.7.8p1
Todd Miller Sudo=1.7.8p2
Todd Miller Sudo=1.7.9
Todd Miller Sudo=1.7.9p1
Todd Miller Sudo=1.7.10

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2013-1776?

    The severity of CVE-2013-1776 is classified as medium due to potential unauthorized privilege escalation.

  • How do I fix CVE-2013-1776?

    To fix CVE-2013-1776, upgrade to a fixed version of sudo or apply relevant patches as recommended by the software vendor.

  • Which versions of sudo are affected by CVE-2013-1776?

    CVE-2013-1776 affects multiple versions of sudo, specifically versions 1.8.0 through 1.8.5, along with older versions.

  • Is CVE-2013-1776 a remote vulnerability?

    CVE-2013-1776 is not a remote vulnerability; it requires local access to exploit.

  • Can CVE-2013-1776 impact Apple Mac OS X?

    Yes, CVE-2013-1776 impacts Apple Mac OS X versions up to and including 10.10.4.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203