CVE-2023-42456
CVSS 3.1 Score 8.1 of 10 (high)
Details
Summary
CVE-2023-42456 is a vulnerability in sudo-rs, an implementation of sudo and su, which allows unauthenticated sudo attempts after a configurable timeout. The issue lies in the handling of session files, where a specially crafted username containing `.` and `/` characters can lead to the corruption of specific files, effectively removing system binaries. An attacker needs to create a user with such a constructed username and be able to login as that user to exploit this vulnerability. Version 0.2.1 of sudo-rs patches this issue by using the uid instead of the username for determining the filename and eliminating path traversal. However, an upgrade to this version will result in existing session files being ignored and users being forced to re-authenticate. A workaround is to ensure that no such users exist on the system and that untrusted users do not have the ability to create arbitrary users.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions