CVE-2012-2337

sudo: Multiple netmask values used in Host / Host_List configuration cause any host to be allowed access

Severity Score

9.8

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations that use a netmask syntax, which allows local users to bypass intended command restrictions in opportunistic circumstances by executing a command on a host that has an IPv4 address.

sudo v1.6.x y v1.7.x antes de v1.7.9p1, y v1.8.x antes de v1.8.4p5, no admite correctamente las configuraciones que utilizan una sintaxis de la máscara de red, lo que permite a usuarios locales eludir restricciones de comandos en circunstancias oportunistas mediante la ejecución de un comando en un host que tiene una dirección IPv4.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

Attack Vector

Network

Attack Complexity

High

Authentication

Multiple

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2012-04-19 CVE Reserved
2012-05-18 CVE Published
2024-08-06 CVE Updated
2025-03-19 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-264: Permissions, Privileges, and Access Controls

CAPEC

References (12)

URL	Tag	Source
http://secunia.com/advisories/49219	Third Party Advisory
http://secunia.com/advisories/49244	Third Party Advisory
http://secunia.com/advisories/49291	Third Party Advisory
http://secunia.com/advisories/49948	Third Party Advisory
http://www.securitytracker.com/id?1027077	Vdb Entry
https://www.suse.com/security/cve/CVE-2012-2337	X_refsource_misc

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081432.html	2018-01-05
http://www.debian.org/security/2012/dsa-2478	2018-01-05
http://www.mandriva.com/security/advisories?name=MDVSA-2012:079	2018-01-05
http://www.sudo.ws/sudo/alerts/netmask.html	2018-01-05
https://bugzilla.redhat.com/show_bug.cgi?id=820677	2012-07-16
https://access.redhat.com/security/cve/CVE-2012-2337	2012-07-16

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Todd Miller Search vendor "Todd Miller"		Sudo Search vendor "Todd Miller" for product "Sudo"				1.6 Search vendor "Todd Miller" for product "Sudo" and version "1.6"		-		Affected
Todd Miller Search vendor "Todd Miller"		Sudo Search vendor "Todd Miller" for product "Sudo"				1.6.1 Search vendor "Todd Miller" for product "Sudo" and version "1.6.1"		-		Affected
Todd Miller Search vendor "Todd Miller"		Sudo Search vendor "Todd Miller" for product "Sudo"				1.6.2 Search vendor "Todd Miller" for product "Sudo" and version "1.6.2"		-		Affected
Todd Miller Search vendor "Todd Miller"		Sudo Search vendor "Todd Miller" for product "Sudo"				1.6.2p3 Search vendor "Todd Miller" for product "Sudo" and version "1.6.2p3"		-		Affected
Todd Miller Search vendor "Todd Miller"		Sudo Search vendor "Todd Miller" for product "Sudo"				1.6.3 Search vendor "Todd Miller" for product "Sudo" and version "1.6.3"		-		Affected
Todd Miller Search vendor "Todd Miller"		Sudo Search vendor "Todd Miller" for product "Sudo"				1.6.3_p7 Search vendor "Todd Miller" for product "Sudo" and version "1.6.3_p7"		-		Affected
Todd Miller Search vendor "Todd Miller"		Sudo Search vendor "Todd Miller" for product "Sudo"				1.6.4 Search vendor "Todd Miller" for product "Sudo" and version "1.6.4"		-		Affected
Todd Miller Search vendor "Todd Miller"		Sudo Search vendor "Todd Miller" for product "Sudo"				1.6.4p2 Search vendor "Todd Miller" for product "Sudo" and version "1.6.4p2"		-		Affected
Todd Miller Search vendor "Todd Miller"		Sudo Search vendor "Todd Miller" for product "Sudo"				1.6.5 Search vendor "Todd Miller" for product "Sudo" and version "1.6.5"		-		Affected
Todd Miller Search vendor "Todd Miller"		Sudo Search vendor "Todd Miller" for product "Sudo"				1.6.6 Search vendor "Todd Miller" for product "Sudo" and version "1.6.6"		-		Affected
Todd Miller Search vendor "Todd Miller"		Sudo Search vendor "Todd Miller" for product "Sudo"				1.6.7 Search vendor "Todd Miller" for product "Sudo" and version "1.6.7"		-		Affected
Todd Miller Search vendor "Todd Miller"		Sudo Search vendor "Todd Miller" for product "Sudo"				1.6.7p5 Search vendor "Todd Miller" for product "Sudo" and version "1.6.7p5"		-		Affected
Todd Miller Search vendor "Todd Miller"		Sudo Search vendor "Todd Miller" for product "Sudo"				1.6.8 Search vendor "Todd Miller" for product "Sudo" and version "1.6.8"		-		Affected
Todd Miller Search vendor "Todd Miller"		Sudo Search vendor "Todd Miller" for product "Sudo"				1.6.8p12 Search vendor "Todd Miller" for product "Sudo" and version "1.6.8p12"		-		Affected
Todd Miller Search vendor "Todd Miller"		Sudo Search vendor "Todd Miller" for product "Sudo"				1.6.9 Search vendor "Todd Miller" for product "Sudo" and version "1.6.9"		-		Affected
Todd Miller Search vendor "Todd Miller"		Sudo Search vendor "Todd Miller" for product "Sudo"				1.6.9p20 Search vendor "Todd Miller" for product "Sudo" and version "1.6.9p20"		-		Affected
Todd Miller Search vendor "Todd Miller"		Sudo Search vendor "Todd Miller" for product "Sudo"				1.6.9p21 Search vendor "Todd Miller" for product "Sudo" and version "1.6.9p21"		-		Affected
Todd Miller Search vendor "Todd Miller"		Sudo Search vendor "Todd Miller" for product "Sudo"				1.6.9p22 Search vendor "Todd Miller" for product "Sudo" and version "1.6.9p22"		-		Affected
Todd Miller Search vendor "Todd Miller"		Sudo Search vendor "Todd Miller" for product "Sudo"				1.6.9p23 Search vendor "Todd Miller" for product "Sudo" and version "1.6.9p23"		-		Affected