CVE-2014-9680

LOW

sudo < 1.8.11 - Exposure of Sensitive Information via TZ Environment Variable

Title source: llm

Description

sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not view file contents) by running a program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log messages, or repositioning tape drives.

References (5)

Core 5

Core References

Third Party Advisory vendor-advisory x_refsource_gentoo

https://security.gentoo.org/glsa/201504-02

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1033158

Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_mlist

http://openwall.com/lists/oss-security/2014/10/15/24

Vendor Advisory x_refsource_confirm

http://www.sudo.ws/alerts/tz.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2015-1409.html

Scores

CVSS v3 3.3

EPSS 0.0047

EPSS Percentile 37.4%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE

CWE-200

Status published

Products (1)

sudo_project/sudo < 1.8.11

Published Apr 24, 2017

Tracked Since Feb 18, 2026