The Qualys Security team discovered that sudo, a program designed to provide limited super user privileges to specific users, does not properly parse '/proc/[pid]/stat' to read the device number of the tty from field 7 (tty_nr). A sudoers user can take advantage of this flaw on an SELinux-enabled system to obtain full root privileges.

An update for sudo is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.

Security Fix(es) :

* A flaw was found in the way sudo parsed tty information from the process status file in the proc filesystem. A local user with privileges to execute commands via sudo could use this flaw to escalate their privileges to root. (CVE-2017-1000367)

Red Hat would like to thank Qualys Security for reporting this issue.

This update for sudo fixes the following issues: CVE-2017-1000367 :

  - Due to incorrect assumptions in /proc/[pid]/stat     parsing, a local attacker can pretend that his tty is     any file on the filesystem, thus gaining arbitrary file     write access on SELinux-enabled systems. [bsc#1039361]

  - Fix FQDN for hostname. [bsc#1024145]

  - Filter netgroups, they aren't handled by SSSD.
    [bsc#1015351]

  - Fix problems related to 'krb5_ccname' option     [bsc#981124]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sudo fixes the following security issue :

  - CVE-2017-1000368: A follow-up fix to CVE-2017-1000367,     the Linux process name could also contain a newline,     which could be used to trick sudo to read/write to an     arbitrary open terminal. (bsc#1042146) Also the     following non security bug was fixed :

  - Link the 'system_group' plugin with sudo_util library to     resolve the missing sudo_dso_findsym symbol     (bsc#1034560)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - It was found that the original fix for CVE-2017-1000367     was incomplete. A flaw was found in the way sudo parsed     tty information from the process status file in the proc     filesystem. A local user with privileges to execute     commands via sudo could use this flaw to escalate their     privileges to root. (CVE-2017-1000368)

The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2017-1687:02 advisory.

    Sudo (superuser do) allows a system administrator to give certain     users (or groups of users) the ability to run some (or all) commands     as root while logging all commands and arguments. Sudo operates on a     per-command basis.  It is not a replacement for the shell.  Features     include: the ability to restrict what commands a user may run on a     per-host basis, copious logging of each command (providing a clear     audit trail of who did what), a configurable timeout of the sudo     command, and the ability to use the same configuration file (sudoers)     on many different machines.
    Security issues fixed with this release:
    CVE-2017-1000367

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
100521	Debian DSA-3867-1 : sudo - security update	Nessus	Debian Local Security Checks	2017/5/31	2025/12/17	medium
100534	RHEL 6 / 7 : sudo (RHSA-2017:1382)	Nessus	Red Hat Local Security Checks	2017/5/31	2025/12/17	medium
100543	SUSE SLED12 / SLES12 Security Update : sudo (SUSE-SU-2017:1450-1)	Nessus	SuSE Local Security Checks	2017/5/31	2025/12/17	medium
100952	SUSE SLED12 / SLES12 Security Update : sudo (SUSE-SU-2017:1626-1)	Nessus	SuSE Local Security Checks	2017/6/21	2025/12/15	high
101041	Scientific Linux Security Update : sudo on SL6.x, SL7.x i386/x86_64 (20170623)	Nessus	Scientific Linux Local Security Checks	2017/6/26	2025/12/15	high
290058	MiracleLinux 4 : sudo-1.8.6p3-28.AXS4 (AXSA:2017-1687:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	medium

检测

插件搜索

medium

medium

medium

high

high

medium