CVE-2013-1776: Medium severity apple ios and macos vulnerability
From the upstream advisory:
When a user successfully authenticates with sudo, a time stamp file is updated to allow that user to continue running sudo without requiring a password for a preset time period (five minutes by default). This time stamp file can either be common to all of a user's terminals, or it can be specific to the particular terminal the user authenticated themselves on. The terminal-specific time stamp file behavior can be controlled using the "ttytickets" option in the sudoers file. This option has been enabled by default since sudo 1.7.4. Prior to sudo 1.7.4, the default was to use a single time stamp for all the user's sessions.
A vulnerability exists because the user can control which terminal the standard input, output and error file descriptors (0-2) refer to. A malicious user could use this to run commands via sudo without authenticating, so long as there exists a terminal the user has access to where a sudo command was successfully run by that same user within the password timeout period (usually five minutes).
The vulnerability does not permit a user to run commands other than those allowed by the sudoers policy.
This affects versions 1.3.5 through up to the fixed 1.7.10p6 version, and sudo 1.8.0 through to the fixed 1.8.7p7.
The fix for 1.7.x: http://www.sudo.ws/repos/sudo/rev/0c0283d1fafa
The fix for 1.8.x: http://www.sudo.ws/repos/sudo/rev/049a12a5cc14
External References:
http://www.sudo.ws/sudo/alerts/ttytickets.html
Other sources
sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the ttytickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another terminal. NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1776?
The severity of CVE-2013-1776 is classified as medium due to potential unauthorized privilege escalation.
How do I fix CVE-2013-1776?
To fix CVE-2013-1776, upgrade to a fixed version of sudo or apply relevant patches as recommended by the software vendor.
Which versions of sudo are affected by CVE-2013-1776?
CVE-2013-1776 affects multiple versions of sudo, specifically versions 1.8.0 through 1.8.5, along with older versions.
Is CVE-2013-1776 a remote vulnerability?
CVE-2013-1776 is not a remote vulnerability; it requires local access to exploit.
Can CVE-2013-1776 impact Apple Mac OS X?
Yes, CVE-2013-1776 impacts Apple Mac OS X versions up to and including 10.10.4.