CVE-2017-1000367: CVE-2017-1000367

Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2017-1000367

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

N/A

Source: NVD (National Vulnerability Database)

Vulnerability Description

Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.

Source: NVD (National Vulnerability Database)

CVSS Information

N/A

Source: NVD (National Vulnerability Database)

Vulnerability Type

N/A

Source: NVD (National Vulnerability Database)

Vulnerability Title

Sudo 输入验证错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Sudo是软件开发者Todd C. Miller所研发的一套用于类Unix操作系统下并允许用户通过安全的方式使用特殊的权限执行命令的程序。 Sudo 1.8.20及之前的版本中的‘get_process_ttyname()’函数存在输入验证漏洞。攻击者可利用该漏洞获取信息，执行代码。

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	n/a	n/a	-

II. Public POCs for CVE-2017-1000367

#	POC Description	Source Link	Shenlong Link
1	None	https://github.com/c0d3z3r0/sudo-CVE-2017-1000367	POC Details
2	None	https://github.com/homjxi0e/CVE-2017-1000367	POC Details
3	own implementation of the CVE-2017-1000367 sudo privilege escalation vulnerability in python	https://github.com/pucerpocok/sudo_exploit	POC Details
4	CVE-2017-1000367	https://github.com/letsr00t/CVE-2017-1000367	POC Details

AI-Generated POCPremium

No public POC found.

III. Intelligence Information for CVE-2017-1000367

Please Login to view more intelligence information

https://www.sudo.ws/alerts/linux_tty.html
http://packetstormsecurity.com/files/142783/Sudo-get_process_ttyname-Race-Condition.html
http://www.securityfocus.com/bid/98745vdb-entry
https://www.exploit-db.com/exploits/42183/exploit
http://www.securitytracker.com/id/1038582vdb-entry
http://www.debian.org/security/2017/dsa-3867vendor-advisory
https://access.redhat.com/errata/RHSA-2017:1382vendor-advisory
https://access.redhat.com/errata/RHSA-2017:1381vendor-advisory
https://security.gentoo.org/glsa/201705-15vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00077.htmlvendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00078.htmlvendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00079.htmlvendor-advisory
http://www.openwall.com/lists/oss-security/2022/12/22/5mailing-list
http://www.openwall.com/lists/oss-security/2022/12/22/6mailing-list
http://seclists.org/fulldisclosure/2017/Jun/3mailing-list
http://www.openwall.com/lists/oss-security/2017/05/30/16mailing-list
https://nvd.nist.gov/vuln/detail/CVE-2017-1000367

IV. Related Vulnerabilities

Same product: n/a

Same vendor: n/a

V. Comments for CVE-2017-1000367

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

I. Basic Information for CVE-2017-1000367

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2017-1000367

III. Intelligence Information for CVE-2017-1000367

IV. Related Vulnerabilities

V. Comments for CVE-2017-1000367

Leave a comment