CVE-2012-0809

Published: 1 February 2012

Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbitrary code via format string sequences in the program name for sudo.

Notes

per upstream, introduced in 1.8, so only 12.04 affected
-D_FORTIFY_SOURCE=2 in combination with ASLR and NX should
adequately protect against this until an update is provided

Status

References

• http://www.gratisoft.us/sudo/alerts/sudo_debug.html
• https://www.cve.org/CVERecord?id=CVE-2012-0809
• NVD
• Launchpad
• Debian