CVE-2015-5602 Privilege escalation in n/a

High 7.2 Published 17 Nov 2015 Updated 6 Aug 2024

Local attackers can escalate privileges via symlink attacks in sudoedit when wildcards are used in sudoers paths.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2015-5602?

CVE-2015-5602 is a high-severity vulnerability in n/a, published on 17 Nov 2015. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by "/home/*/*/file.txt."

Weakness: CWE-264

Which versions are affected by CVE-2015-5602?

It affects 1 product.

Products include Sudo Project Sudo.

How do I fix CVE-2015-5602?

Upgrade to a fixed version.

Is CVE-2015-5602 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2015-5602 exists.

Public exploit code: 1 Exploit-DB entry and 2 proofs of concept on GitHub.

Sources

Also known as DEBIAN-CVE-2015-5602, DLA-382-1, DSA-3440-1, GHSA-cxqf-2pgv-vx9p, MGASA-2015-0443, UBUNTU-CVE-2015-5602.