ELSA-2021-9019: 
Linux Oracle vulnerability analysis and mitigation

A security vulnerability was identified in sudo package for Oracle Linux 6, tracked as ELSA-2021-9019. The vulnerability was disclosed on January 27, 2021, and affects sudo versions prior to 1.8.6p3-29.0.2.el6_10.3 (Oracle Linux Errata).

The vulnerability is related to a heap-based buffer overflow in the set_cmd() function in sudo, which could allow local attackers to execute commands with elevated administrator privileges. The issue was assigned CVE-2021-3156 and affected multiple Unix-based operating systems (CERT VU).

If exploited, this vulnerability allows a local non-administrative user to elevate their privileges to execute commands with administrator privileges, potentially gaining full control over the affected system (CERT VU).

The vulnerability can be exploited by local attackers who have access to the affected machine. No additional execution privileges are needed for exploitation, and user interaction is not required (CERT VU).

Oracle has released a security patch to address this vulnerability. Users should update to sudo version 1.8.6p3-29.0.2.el6_10.3 or later. The fix has been backported from Oracle Linux 7 (Oracle Linux Errata).