CVE-2021-3156

01/תיאור (מקור, אנגלית)

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

02/מוצרים מושפעים

sudo_project: sudo; fedoraproject: fedora; debian: debian linux; netapp: active iq unified manager; netapp: cloud backup; netapp: hci management node; netapp: oncommand unified manager core package; netapp: ontap select deploy administration utility; netapp: ontap tools; netapp: solidfire; mcafee: web gateway; synology: diskstation manager unified controller; synology: diskstation manager; synology: skynas firmware; synology: skynas

03/קישורים10

• www.openwall.com/lists/oss-security/2021/09/14/2 Mailing ListPatchThird Party Advisory
• www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
• www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
• www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
• www.openwall.com/lists/oss-security/2021/09/14/2 Mailing ListPatchThird Party Advisory
• www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
• www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
• www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
• packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Ov‮… ExploitThird Party AdvisoryVDB Entry
• packetstormsecurity.com/files/161230/Sudo-Buffer-Overflow-Priv‮… ExploitThird Party AdvisoryVDB Entry