CVE-2010-0427

sudo 1.6.x before 1.6.9p21, when the runasdefault option is used, does not properly set group memberships, which allows local users to gain privileges via a sudo command...

CVE-2010-0427

sudo 1.6.x before 1.6.9p21, when the runasdefault option is used, does not properly set group memberships, which allows local users to gain privileges via a sudo command...

CVE-2010-0427

CVE-2010-0427 affects sudo 1.6.x before 1.6.9p21. When the runas_default option is used, sudo does not properly set group memberships, allowing local users to gain privileges via a sudo command. The issue is documented in multiple advisories and open-vas/Nessus entries (e.g., AXSA-2010-134:01 for...

Sudo sudoedit命令本地权限提升漏洞

BUGTRAQ ID: 38362 CVECAN ID: CVE-2010-0426 Sudo是一款允许用户以其他用户权限安全地执行命令的程序，广泛使用在Linux和Unix操作系统下。 由于处理sudoedit命令时的错误，拥有sudoedit权限的本地用户可以以root用户权限执行任意代码。成功攻击要求sudoedit命令没有在sudoers文件中指定完整路径。 Todd Miller Sudo 1.7 Todd Miller Sudo 1.6 Todd Miller ----------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Directory traversal

sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by...

CVE-2010-0426

sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by...

DEBIAN-CVE-2010-0426

sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by...

CVE-2010-0426

sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by...

CVE-2010-0426

sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by...

CVE-2010-0426

sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by...

CVE-2010-0426

CVE-2010-0426 affects sudo 1.6.x < 1.6.9p21 and 1.7.x

CVE-2010-0427

sudo 1.6.x before 1.6.9p21, when the runasdefault option is used, does not properly set group memberships, which allows local users to gain privileges via a sudo command...

Security fix for the ALT Linux 5 package sudo version 1:1.6.8p12-alt7

Feb. 23, 2010 Dmitry V. Levin 1:1.6.8p12-alt7 - Backported upstream fix for CVE-2010-0426 a flaw in sudoedit could give a user with permission to run sudoedit the ability to run arbitrary commands...

Security fix for the ALT Linux 6 package sudo version 1:1.6.8p12-alt7

Feb. 23, 2010 Dmitry V. Levin 1:1.6.8p12-alt7 - Backported upstream fix for CVE-2010-0426 a flaw in sudoedit could give a user with permission to run sudoedit the ability to run arbitrary commands; envreset sudoers option had to be explicitly disabled to make an attack possible...

CVE-2010-0426

sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by...

Security fix for the ALT Linux 8 package sudo version 1:1.6.8p12-alt7

Feb. 23, 2010 Dmitry V. Levin 1:1.6.8p12-alt7 - Backported upstream fix for CVE-2010-0426 a flaw in sudoedit could give a user with permission to run sudoedit the ability to run arbitrary commands; envreset sudoers option had to be explicitly disabled to make an attack possible...

CVE-2009-4648

Accellion Secure File Transfer Appliance before 80105 does not properly restrict access to sensitive commands and arguments that run with extra sudo privileges, which allows local administrators to gain privileges via 1 arbitrary arguments in the --filemove action in /usr/local/bin/admin.pl, or a...

sudo -- Privilege escalation with sudoedit

Todd Miller reports: When sudo performs its command matching, there is a special case for pseudo-commands in the sudoers file currently, the only pseudo-command is sudoedit. Unlike a regular command, pseudo-commands do not begin with a slash '/'. The flaw is that sudo's the matching code would on...

SLES9: Security update for sudo

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: sudo More details may also be found by searching for keyword 5015295 within the SuSE Enterprise Server 9 patch database at...

SLES9: Security update for sudo

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: sudo For more information, please visit the referenced security advisories. More details may also be found by searching for keyword 5019263 within the SuSE...