CVE-2017-1000367

What it actually does

Input validation flaw with embedded spaces in get_process_ttyname() enables information disclosure and arbitrary command execution in affected sudo versions.

Why it matters to the business

Attackers can gain elevated privileges on systems running vulnerable sudo, leading to full host compromise, data theft, or persistence; prevalence in package ecosystems increases exposure risk across many deployments.

How an attack unfolds

An attacker with local access supplies crafted input containing spaces to trigger the validation flaw in ttyname handling, disclosing process information and executing arbitrary commands with elevated privileges.

How to fix it

Upgrade sudo to a fixed version; for rpm-software-management/rpm use commit 404ef011c300207cdb1e531670384564aae04bdc, for Ubuntu 18.04 use 4.14.1+dfsg1-2, for Ubuntu 20.04 use 4.14.2.1+dfsg1-1build2.

How to confirm the fix worked

Verify sudo version is newer than 1.8.20 and test get_process_ttyname() behavior with space-containing inputs; confirm package manager reports the listed fixed versions installed.

Typical attack path

1. Obtain local shell access on target host
2. Invoke sudo with maliciously crafted ttyname input containing spaces
3. Trigger get_process_ttyname() to bypass validation
4. Escalate to root via disclosed information and command execution

How to detect it

Review authentication logs, sudo logs, and process execution history for unusual ttyname entries or space-embedded inputs; look for post-exploitation artifacts such as unexpected root-owned processes or modified binaries.

• sudo logs containing embedded space characters in ttyname fields
• Unexpected execution of commands via sudo with non-standard tty paths

What your security team should do

• Immediately upgrade all affected sudo installations using the exact fixed package versions provided
• Audit sudoers configurations and limit unnecessary sudo access
• Monitor for local privilege escalation attempts and update detection rules
• Prioritize patching on internet-facing or high-value systems given exploit availability