Veracode Vulnerability DatabaseVERACODE:23584Privilege Escalation
6.9 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:M/Au:N/C:C/I:C/A:C
sudo is vulnerable to privilege escalation. The vulnerability exists as a flaw was discovered in a way sudo handled group specifications in βrun asβ lists in the sudoers configuration file. If sudo configuration allowed a user to run commands as any user of some group and the user was also a member of that group, sudo incorrectly allowed them to run defined commands with the privileges of any system user. This gave the user unintended privileges.
| CPE | Name | Operator | Version |
|---|---|---|---|
| sudo | eq | 1.6.8p12__12.el5 | |
| sudo | eq | 1.6.8p12__12.el5 |
References
lists.vmware.com/pipermail/security-announce/2009/000060.html
osvdb.org/51736
secunia.com/advisories/33753
secunia.com/advisories/33840
secunia.com/advisories/33885
secunia.com/advisories/35766
wiki.rpath.com/Advisories:rPSA-2009-0021
www.gratisoft.us/bugzilla/show_bug.cgi?id=327
www.mandriva.com/security/advisories?name=MDVSA-2009:033
www.redhat.com/security/updates/classification/#moderate
www.redhat.com/support/errata/RHSA-2009-0267.html
www.securityfocus.com/archive/1/500546/100/0/threaded
www.securityfocus.com/archive/1/504849/100/0/threaded
www.securityfocus.com/bid/33517
www.securitytracker.com/id?1021688
www.sudo.ws/cgi-bin/cvsweb/sudo/parse.c.diff?r1=1.160.2.21&r2=1.160.2.22&f=h
www.vmware.com/security/advisories/VMSA-2009-0009.html
www.vupen.com/english/advisories/2009/1865
access.redhat.com/errata/RHSA-2009:0267
bugzilla.novell.com/show_bug.cgi?id=468923
issues.rpath.com/browse/RPL-2954
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10856
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6462
Related
6.9 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:M/Au:N/C:C/I:C/A:C