Vulnerability Details : CVE-2016-7076
sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges.
Products affected by CVE-2016-7076
- cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-7076
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 6 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-7076
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST | |
|
6.6
|
MEDIUM | AV:L/AC:M/Au:S/C:C/I:C/A:C |
2.7
|
10.0
|
Red Hat, Inc. | |
|
7.8
|
HIGH | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST | |
|
6.4
|
MEDIUM | CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
0.5
|
5.9
|
Red Hat, Inc. |
CWE ids for CVE-2016-7076
-
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.Assigned by: nvd@nist.gov (Primary)
-
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses.Assigned by: secalert@redhat.com (Secondary)
References for CVE-2016-7076
-
https://www.sudo.ws/alerts/noexec_wordexp.html
Potential bypass of sudo_noexec.so via wordexp()Third Party Advisory
-
http://www.securityfocus.com/bid/95778
IBM PowerKVM CVE-2016-7076 Local Command Execution VulnerabilityThird Party Advisory;VDB Entry
-
https://usn.ubuntu.com/3968-3/
USN-3968-3: Sudo vulnerabilities | Ubuntu security notices | Ubuntu
-
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7076
1384982 – (CVE-2016-7076) CVE-2016-7076 sudo: noexec bypass via wordexp()Issue Tracking
-
https://usn.ubuntu.com/3968-1/
USN-3968-1: Sudo vulnerabilities | Ubuntu security notices
-
http://rhn.redhat.com/errata/RHSA-2016-2872.html
RHSA-2016:2872 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://security.netapp.com/advisory/ntap-20181127-0002/
CVE-2016-7076 sudo Vulnerability in NetApp Products | NetApp Product Security
Jump to