Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2016-7076: sudo before 1.8.18p1 can bypass noexec restriction
CVE-2016-7076 · published 8 years ago
Summary
On systems using sudo versions older than 1.8.18p1, a program that is allowed to run with sudo can trick the system into ignoring the noexec setting, which is meant to stop further commands from being executed. This could let a local user run commands with higher privileges than intended. Updating sudo to version 1.8.18p1 or later, or disabling the noexec option until the update is applied, resolves the risk.
What to do
- Update debian sudo to version 1.8.18p1-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | sudo |
< 1.8.18p1-1 Fix: upgrade to 1.8.18p1-1
|
| Debian:13 | debian | sudo |
< 1.8.18p1-1 Fix: upgrade to 1.8.18p1-1
|
| Debian:14 | debian | sudo |
< 1.8.18p1-1 Fix: upgrade to 1.8.18p1-1
|
| – | sudo_project | sudo |
>= 1.6.8, <= 1.8.18 cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:* |
Original advisory text
sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library function with a user supplied argument. A local user p...
sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges.
References
- https://security-tracker.debian.org/tracker/CVE-2016-7076 Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2872.html Third Party Advisory
- http://www.securityfocus.com/bid/95778 Third Party Advisory VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7076 Issue Tracking
- https://security.netapp.com/advisory/ntap-20181127-0002/
- https://usn.ubuntu.com/3968-1/
- https://usn.ubuntu.com/3968-3/
- https://www.sudo.ws/alerts/noexec_wordexp.html Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-184Incomplete List of Disallowed Inputs
CWE-77Command Injection
Timeline
Published29 May 2018
Updated4 Nov 2026
First seen22 Sep 2026
Track software like this
Free during beta