CVE-2007-3149
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
sudo, when linked with MIT Kerberos 5 (krb5), does not properly check whether a user can currently authenticate to Kerberos, which allows local users to gain privileges, in a manner unintended by the sudo security model, via certain KRB5_ environment variable settings. NOTE: another researcher disputes this vulnerability, stating that the attacker must be "a user, who can already log into your system, and can already use sudo."
sudo, cuando está enlazado con MIT Kerberos 5 (krb5), no comprueba correctamente si un usuario pueda validar actualmente a Kerberos, lo cual permite a usuarios locales ganar privilegios, de una forma involuntario por el modelo de seguridad de sudo, a rtavés de ciertas variables de configuración KRB5_ environment. NOTA: Otro investigados cuestiona esta vulnerabilidad, basándose en que el atacante debe ser “un usuario, que puede registrarse en tu sistema, y puede utilizar sudo.”
CVSS Scores
SSVC
- Decision:-
Timeline
- 2007-06-11 CVE Reserved
- 2007-06-11 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-07 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://secunia.com/advisories/26540 | Third Party Advisory | |
| http://www.securityfocus.com/archive/1/470739/100/0/threaded | Mailing List | |
| http://www.securityfocus.com/archive/1/470752/100/0/threaded | Mailing List | |
| http://www.securityfocus.com/archive/1/470774/100/0/threaded | Mailing List | |
| http://www.securityfocus.com/bid/24368 | Vdb Entry | |
| http://www.sudo.ws/cgi-bin/cvsweb/sudo/auth/kerb5.c | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mit Search vendor "Mit" | Kerberos 5 Search vendor "Mit" for product "Kerberos 5" | - | - |
Affected
| ||||||
| Todd Miller Search vendor "Todd Miller" | Sudo Search vendor "Todd Miller" for product "Sudo" | 1.6.8_p12 Search vendor "Todd Miller" for product "Sudo" and version "1.6.8_p12" | - |
Affected
| ||||||