blob: f5072945cacc2d25371bc10cb3db5ec571f5298c [file] [log] [blame]
<?xml version="1.0" encoding="utf-8"?>
<glsa id="201009-03">
<title>sudo: Privilege Escalation</title>
The secure path feature and group handling in sudo allow local attackers to
escalate privileges.
<product type="ebuild">sudo</product>
<announced>September 07, 2010</announced>
<revised>September 07, 2010: 01</revised>
<package name="app-admin/sudo" auto="yes" arch="*">
<unaffected range="ge">1.7.4_p3-r1</unaffected>
<vulnerable range="lt">1.7.4_p3-r1</vulnerable>
sudo allows a system administrator to give users the ability to run
commands as other users.
Multiple vulnerabilities have been reported in sudo:
Broder and Anders Kaseorg of Ksplice, Inc. reported that the sudo
'secure path' feature does not properly handle multiple PATH variables
<li>Markus Wuethrich of Swiss Post reported that
sudo fails to restrict access when using Runas groups and the group
(-g) command line option (CVE-2010-2956).</li>
<impact type="high">
A local attacker could exploit these vulnerabilities to gain the
ability to run certain commands with the privileges of other users,
including root, depending on the configuration.
There is no known workaround at this time.
All sudo users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose &quot;&gt;=app-admin/sudo-1.7.4_p3-r1&quot;</code>
<uri link="">CVE-2010-1646</uri>
<uri link="">CVE-2010-2956</uri>
<metadata tag="requester" timestamp="Sun, 13 Jun 2010 19:16:17 +0000">
<metadata tag="bugReady" timestamp="Sun, 13 Jun 2010 19:16:52 +0000">
<metadata tag="submitter" timestamp="Tue, 07 Sep 2010 11:40:54 +0000">