CVE-2012-0809
sudo 1.8.0-1.8.3p1 - Local Use-After-Free via Format String in sudo_debug
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2012-0809. PoCs published by aeon, joernchen.
AI-analyzed exploit summary This exploit leverages a format string vulnerability in sudo (CVE-2012-0809) combined with a glibc FORTIFY_SOURCE bypass (CVE-2012-0864) to achieve local privilege escalation. It writes a backdoor to disk, compiles it, and executes it with root privileges via environment variable manipulation.
Description
Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbitrary code via format string sequences in the program name for sudo.
Exploits (2)
This exploit leverages a format string vulnerability in sudo (CVE-2012-0809) combined with a glibc FORTIFY_SOURCE bypass (CVE-2012-0864) to achieve local privilege escalation. It writes a backdoor to disk, compiles it, and executes it with root privileges via environment variable manipulation.
This advisory describes a format string vulnerability in sudo versions 1.8.0 to 1.8.3p1, where user-controlled input via argv[0] is passed to vfprintf without proper sanitization. Exploitation can lead to privilege escalation by overwriting critical function calls like setuid().