CVE-2017-1000367

Description

Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.

Weakness classification

• CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Primary references

• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Exploit, Third Party Advisory, VDB Entry
• cve@mitre.org — Mailing List, Third Party Advisory
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Exploit, Mailing List, Third Party Advisory
• cve@mitre.org
• cve@mitre.org
• cve@mitre.org — Third Party Advisory, VDB Entry
• cve@mitre.org — Exploit, Third Party Advisory, VDB Entry
• cve@mitre.org — Third Party Advisory