Decade-Old Vulnerability in Sudo Impacts Several Operating Systems
NJCCIC Advisory
Original Release Date: 2/4/2021
Summary
A Sudo vulnerability, tracked as CVE-2021-3156, can be exploited to allow a user account to gain root level access. The flaw is present in most default Linux+Sudo installations, Apple’s macOS, and IBM AIX systems. While Sudo patched the bug, the vulnerability still exists in the most current version of macOS.
Recommendations
The NJCCIC recommends applying the patch to Sudo, review the Sudo alert and Quays report, and apply patches to affected products as they become available and after appropriate testing.
The NJCCIC is a component organization within the New Jersey Office of Homeland Security and Preparedness. We are the State's one-stop-shop for cyber threat analysis, incident reporting, and information sharing and are committed to making New Jersey more resilient to cyber threats by spreading awareness and promoting the adoption of best practices.
View our Privacy Policy here.
View our Site Index here.