Fluid Attacks Database

Description

The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 14	sudo	>=0 <1.8.17p1-1	1.8.17p1-1
debian 13	sudo	>=0 <1.8.17p1-1	1.8.17p1-1
debian 11	sudo	>=0 <1.8.17p1-1	1.8.17p1-1
debian 12	sudo	>=0 <1.8.17p1-1	1.8.17p1-1
rpm rhel7	sudo	-	-

Aliases

1. CVE-2015-82392. NVD-2015-82393. OSV-DEBIAN-2015-82394. OSV-2015-82395. SECURITY-TRACKER-CVE-2015-8239

References

1. https://github.com/justinsteven/sudo_digest_toctou_poc_CVE-2015-8239

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.