CVE-2015-8239 : The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local

The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.

Published 2017-10-10 16:29:01

Updated 2017-11-05 21:23:16

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2015-8239

Sudo Project » Sudo » Version: 1.8.15 Update B3
cpe:2.3:a:sudo_project:sudo:1.8.15:b3:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.15 Update B2
cpe:2.3:a:sudo_project:sudo:1.8.15:b2:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.15 Update B1
cpe:2.3:a:sudo_project:sudo:1.8.15:b1:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.14 Update P3
cpe:2.3:a:sudo_project:sudo:1.8.14:p3:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.13 Update B2
cpe:2.3:a:sudo_project:sudo:1.8.13:b2:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.13 Update B1
cpe:2.3:a:sudo_project:sudo:1.8.13:b1:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.12
cpe:2.3:a:sudo_project:sudo:1.8.12:*:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.12 Update RC2
cpe:2.3:a:sudo_project:sudo:1.8.12:rc2:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.10 Update P3
cpe:2.3:a:sudo_project:sudo:1.8.10:p3:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.10 Update P2
cpe:2.3:a:sudo_project:sudo:1.8.10:p2:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.10 Update P1
cpe:2.3:a:sudo_project:sudo:1.8.10:p1:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.10
cpe:2.3:a:sudo_project:sudo:1.8.10:*:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.9
cpe:2.3:a:sudo_project:sudo:1.8.9:*:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.9 Update RC2
cpe:2.3:a:sudo_project:sudo:1.8.9:rc2:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.9 Update RC1
cpe:2.3:a:sudo_project:sudo:1.8.9:rc1:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.9 Update B2
cpe:2.3:a:sudo_project:sudo:1.8.9:b2:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.15
cpe:2.3:a:sudo_project:sudo:1.8.15:*:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.15 Update RC3
cpe:2.3:a:sudo_project:sudo:1.8.15:rc3:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.14 Update B4
cpe:2.3:a:sudo_project:sudo:1.8.14:b4:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.14 Update B3
cpe:2.3:a:sudo_project:sudo:1.8.14:b3:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.14 Update B2
cpe:2.3:a:sudo_project:sudo:1.8.14:b2:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.14 Update B1
cpe:2.3:a:sudo_project:sudo:1.8.14:b1:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.13
cpe:2.3:a:sudo_project:sudo:1.8.13:*:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.11 Update P2
cpe:2.3:a:sudo_project:sudo:1.8.11:p2:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.11 Update P1
cpe:2.3:a:sudo_project:sudo:1.8.11:p1:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.11
cpe:2.3:a:sudo_project:sudo:1.8.11:*:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.11 Update RC2
cpe:2.3:a:sudo_project:sudo:1.8.11:rc2:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.10 Update B3
cpe:2.3:a:sudo_project:sudo:1.8.10:b3:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.10 Update B2
cpe:2.3:a:sudo_project:sudo:1.8.10:b2:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.9 Update P5
cpe:2.3:a:sudo_project:sudo:1.8.9:p5:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.10 Update B1
cpe:2.3:a:sudo_project:sudo:1.8.10:b1:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.8 Update B1
cpe:2.3:a:sudo_project:sudo:1.8.8:b1:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.15 Update RC2
cpe:2.3:a:sudo_project:sudo:1.8.15:rc2:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.15 Update B5
cpe:2.3:a:sudo_project:sudo:1.8.15:b5:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.14 Update P1
cpe:2.3:a:sudo_project:sudo:1.8.14:p1:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.14 Update RC1
cpe:2.3:a:sudo_project:sudo:1.8.14:rc1:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.13 Update RC1
cpe:2.3:a:sudo_project:sudo:1.8.13:rc1:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.13 Update B3
cpe:2.3:a:sudo_project:sudo:1.8.13:b3:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.12 Update RC1
cpe:2.3:a:sudo_project:sudo:1.8.12:rc1:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.12 Update B2
cpe:2.3:a:sudo_project:sudo:1.8.12:b2:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.11 Update B4
cpe:2.3:a:sudo_project:sudo:1.8.11:b4:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.11 Update B2
cpe:2.3:a:sudo_project:sudo:1.8.11:b2:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.10 Update RC2
cpe:2.3:a:sudo_project:sudo:1.8.10:rc2:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.10 Update B4
cpe:2.3:a:sudo_project:sudo:1.8.10:b4:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.9 Update P4
cpe:2.3:a:sudo_project:sudo:1.8.9:p4:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.9 Update P2
cpe:2.3:a:sudo_project:sudo:1.8.9:p2:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.8
cpe:2.3:a:sudo_project:sudo:1.8.8:*:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.8 Update B3
cpe:2.3:a:sudo_project:sudo:1.8.8:b3:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.15 Update RC1
cpe:2.3:a:sudo_project:sudo:1.8.15:rc1:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.15 Update B4
cpe:2.3:a:sudo_project:sudo:1.8.15:b4:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.14 Update P2
cpe:2.3:a:sudo_project:sudo:1.8.14:p2:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.14
cpe:2.3:a:sudo_project:sudo:1.8.14:*:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.13 Update RC2
cpe:2.3:a:sudo_project:sudo:1.8.13:rc2:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.13 Update B4
cpe:2.3:a:sudo_project:sudo:1.8.13:b4:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.12 Update B3
cpe:2.3:a:sudo_project:sudo:1.8.12:b3:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.12 Update B1
cpe:2.3:a:sudo_project:sudo:1.8.12:b1:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.11 Update RC1
cpe:2.3:a:sudo_project:sudo:1.8.11:rc1:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.11 Update B3
cpe:2.3:a:sudo_project:sudo:1.8.11:b3:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.11 Update B1
cpe:2.3:a:sudo_project:sudo:1.8.11:b1:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.10 Update RC3
cpe:2.3:a:sudo_project:sudo:1.8.10:rc3:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.10 Update RC1
cpe:2.3:a:sudo_project:sudo:1.8.10:rc1:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.9 Update P3
cpe:2.3:a:sudo_project:sudo:1.8.9:p3:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.9 Update P1
cpe:2.3:a:sudo_project:sudo:1.8.9:p1:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.9 Update B1
cpe:2.3:a:sudo_project:sudo:1.8.9:b1:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.8 Update RC1
cpe:2.3:a:sudo_project:sudo:1.8.8:rc1:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.8.8 Update B2
cpe:2.3:a:sudo_project:sudo:1.8.8:b2:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2015-8239

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-8239

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.9	MEDIUM	AV:L/AC:M/Au:N/C:C/I:C/A:C	3.4	10.0	NIST
Access Vector: Local Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.0	HIGH	CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	1.0	5.9	NIST
Attack Vector: Local Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2015-8239

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-8239

https://bugzilla.redhat.com/show_bug.cgi?id=1283635

1283635 – (CVE-2015-8239) CVE-2015-8239 sudo: Race condition when checking digests in sudoers
Issue Tracking;Patch;Third Party Advisory
https://www.sudo.ws/repos/sudo/rev/24a3d9215c64

sudo: 24a3d9215c64
Issue Tracking;Patch;Third Party Advisory
https://www.sudo.ws/repos/sudo/rev/397722cdd7ec

sudo: 397722cdd7ec
Issue Tracking;Patch;Third Party Advisory
https://www.sudo.ws/repos/sudo/rev/0cd3cc8fa195

sudo: 0cd3cc8fa195
Issue Tracking;Patch;Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/11/18/22

oss-security - Re: race condition checking digests/checksums in sudoers
Mailing List;Third Party Advisory

Jump to

Vulnerability Details : CVE-2015-8239

Products affected by CVE-2015-8239

Exploit prediction scoring system (EPSS) score for CVE-2015-8239

CVSS scores for CVE-2015-8239

CWE ids for CVE-2015-8239

References for CVE-2015-8239