CVE-2023-42456

Summary

CVE-2023-42456 is a vulnerability in sudo-rs, an implementation of sudo and su, which allows unauthenticated sudo attempts after a configurable timeout. The issue lies in the handling of session files, where a specially crafted username containing `.` and `/` characters can lead to the corruption of specific files, effectively removing system binaries. An attacker needs to create a user with such a constructed username and be able to login as that user to exploit this vulnerability. Version 0.2.1 of sudo-rs patches this issue by using the uid instead of the username for determining the filename and eliminating path traversal. However, an upgrade to this version will result in existing session files being ignored and users being forced to re-authenticate. A workaround is to ensure that no such users exist on the system and that untrusted users do not have the ability to create arbitrary users.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.