The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path.
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Sudo | Sudo_project | * | 1.8.32 (excluding) |
Sudo | Sudo_project | 1.9.0 (including) | 1.9.5 (excluding) |
Red Hat Enterprise Linux 8 | RedHat | sudo-0:1.8.29-7.el8 | * |
Sudo | Ubuntu | bionic | * |
Sudo | Ubuntu | devel | * |
Sudo | Ubuntu | esm-infra-legacy/trusty | * |
Sudo | Ubuntu | focal | * |
Sudo | Ubuntu | groovy | * |
Sudo | Ubuntu | hirsute | * |
Sudo | Ubuntu | impish | * |
Sudo | Ubuntu | jammy | * |
Sudo | Ubuntu | kinetic | * |
Sudo | Ubuntu | lunar | * |
Sudo | Ubuntu | mantic | * |
Sudo | Ubuntu | noble | * |
Sudo | Ubuntu | oracular | * |
Sudo | Ubuntu | precise/esm | * |
Sudo | Ubuntu | trusty | * |
Sudo | Ubuntu | trusty/esm | * |
Sudo | Ubuntu | xenial | * |