HPE wars customers of Sudo flaw in Aruba AirWave Management Platform
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-3156 | Heap-Based Buffer Overflow in Sudo Enables Local Privilege Escalation (CVE-2021-3156) CVE-2021-3156 is an off-by-one error (CWE-193) in the Unix Sudo utility that causes a heap-based buffer overflow (CWE-122) in Sudo's handling of command-line arguments. It is triggered locally when an unprivileged user invokes Sudo with specially crafted arguments, requiring no special privileges or non-default configuration. A successful exploit allows the attacker to execute arbitrary code as root, achieving full local privilege escalation on the host. Any Linux, Unix, or other system running a vulnerable version of Sudo is affected, and because Sudo ships by default on virtually all such systems the potential footprint is enormous. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-04-06) and carries a 100% EPSS probability of exploitation within 30 days, indicating active in-the-wild exploitation, though specific ransomware use is unknown. Do: Upgrade Sudo to a patched release (1.9.5p2 or later, or the vendor-supplied update for your distribution) per vendor instructions, as required by the CISA KEV listing. Audit all Unix-like hosts by checking the installed Sudo version through your package manager and prioritize patching multi-user and internet-facing servers. Restricting local shell access and monitoring for anomalous Sudo invocations can reduce risk while patching completes. | 7.8 | 100% | KEV PoC ×12 |
| masstens of millions of Linux/Unix servers, workstations and devices (Sudo is preinstalled on virtually all Linux distributions) |
Full article422 words · extracted from securityaffairs.com · click to collapse
Hewlett Packard Enterprise (HPE) warns of a vulnerability in Sudo open-source program used in its Aruba AirWave management platform.
Hewlett Packard Enterprise (HPE) is warning of a high-severity privilege escalation vulnerability in Sudo open-source program used within its Aruba AirWave management platform. The Aruba AirWave management platform is a real-time monitoring and security alert platform designed by HPE.
An unprivileged and unauthenticated local attacker could exploit the vulnerability to gain root privileges on a vulnerable host.
“A vulnerability in the command line parameter parsing code of sudo could allow an attacker with access to sudo to execute commands or binaries with root privileges. The main impact of this vulnerability would be as part of a “chained attack” where an attacker has achieved a foothold with lower privileges via another vulnerability and then uses this to escalate privileges.” reads the security advisory.
Experts warn that this flaw could be chained with other vulnerabilities by an attacker with lower privileges to escalate them once obtained access to the target system.
The CVE-2021-3156 was discovered by Qualys researchers in January, it has allowed any local user to gain root privileges on Unix-like operating systems without authentication.
Sudo is one of the most important, powerful, and commonly used utilities that comes as a core command pre-installed on macOS and almost every UNIX or Linux-based operating system.
sudo is a program for Unix-like computer operating systems that allows users to run programs with the security privileges of another user, by default the superuser. It originally stood for “superuser do” as the older versions of sudo were designed to run commands only as the superuser.
The Sudo CVE-2021-3156 vulnerability, dubbed Baron Samedit, is a heap-based buffer overflow that was reported on January 13th and disclosed at the end of January to give the development team the time to address the issue.
HPE confirmed that the flaw affected the AirWave management platform prior to version 8.2.13.0 that was released on June 18, 2021.
HPE also provided a workaround for HPE AirWave customers and pointed out that Aruba is not aware of any attacks in the wild against Aruba products exploiting the above vulnerability.
“To minimize the likelihood of an attacker exploiting these vulnerabilities, Aruba recommends that the CLI and web-based management interfaces for AirWave be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.” concludes the advisory.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, CVE-2021-3156)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/121669/security/hpe-sudo-flaw-aruba-airwave-management-platform.html