Strix
26.1K

CVE-2012-2337

UnknownEPSS 0.40%

Last modified

CVE-2012-2337 is a vulnerability of currently unknown severity. sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations that use a netmask syntax, which allows local users to bypass intended command restrictions in opportunistic circumstances by executing a command on a host that has an IPv4 address.. EPSS estimates a 0.40% chance of exploitation in the next 30 days.

Description

sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations that use a netmask syntax, which allows local users to bypass intended command restrictions in opportunistic circumstances by executing a command on a host that has an IPv4 address.

Metrics

EPSS Probability
0.40%

31.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
Todd MillerSudo1.6
Todd MillerSudo1.6.1
Todd MillerSudo1.6.2
Todd MillerSudo1.6.2p3
Todd MillerSudo1.6.3
Todd MillerSudo1.6.3_p7
Todd MillerSudo1.6.4
Todd MillerSudo1.6.4p2
Todd MillerSudo1.6.5
Todd MillerSudo1.6.6
Todd MillerSudo1.6.7
Todd MillerSudo1.6.7p5
Todd MillerSudo1.6.8
Todd MillerSudo1.6.8p12
Todd MillerSudo1.6.9
Todd MillerSudo1.6.9p20
Todd MillerSudo1.6.9p21
Todd MillerSudo1.6.9p22
Todd MillerSudo1.6.9p23

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2012-2337?
sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations that use a netmask syntax, which allows local users to bypass intended command restrictions in opportunistic circumstances by executing a command on a host that has an IPv4 address.
How severe is CVE-2012-2337?
Severity scoring for CVE-2012-2337 is pending analysis. The EPSS model estimates a 0.40% probability of exploitation in the next 30 days.
How do I fix CVE-2012-2337?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2012-2337?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST