CVE-2013-2776: Medium severity sudo vulnerability
sudo 1.3.5 through 1.7.10p5 and 1.8.0 through 1.8.6p6, when running on systems without /proc or the sysctl function with the ttytickets option enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another terminal. NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2776?
CVE-2013-2776 has a high severity rating due to its potential to allow local users to hijack sudo privileges from other users.
How do I fix CVE-2013-2776?
To fix CVE-2013-2776, upgrade to sudo version 1.7.10p6 or later, or 1.8.7 or later, where the vulnerability is patched.
Who is affected by CVE-2013-2776?
CVE-2013-2776 affects local users on systems running vulnerable versions of sudo without /proc or sysctl functionalities.
What are the vulnerable versions for CVE-2013-2776?
The vulnerable versions for CVE-2013-2776 range from 1.3.5 to 1.8.6p6 of sudo.
Is CVE-2013-2776 fixed in all distributions?
CVE-2013-2776 is not fixed in all distributions, and users should verify their specific sudo versions against the vulnerability.