6 Medium
AI Score
Confidence
Low
6.9 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:M/Au:N/C:C/I:C/A:C
0.0004 Low
EPSS
Percentile
5.3%
A certain Fedora patch for parse.c in sudo before 1.7.4p5-1.fc14 on Fedora 14 does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command. NOTE: this vulnerability exists because of a CVE-2009-0034 regression.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 12 | all | sudo | <Β 1.9.13p3-1+deb12u1 | sudo_1.9.13p3-1+deb12u1_all.deb |
Debian | 11 | all | sudo | <Β 1.9.5p2-3+deb11u1 | sudo_1.9.5p2-3+deb11u1_all.deb |
Debian | 10 | all | sudo | <Β 1.8.27-1+deb10u3 | sudo_1.8.27-1+deb10u3_all.deb |
Debian | 999 | all | sudo | <Β 1.9.15p5-3 | sudo_1.9.15p5-3_all.deb |
Debian | 13 | all | sudo | <Β 1.9.15p5-3 | sudo_1.9.15p5-3_all.deb |