Permissions, Privileges, and Access Controls in Sudo

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU32861

Risk: Low

CVSSv4.0: 6.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2010-0426

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local non-authenticated attacker to execute arbitrary code.

sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by a file named sudoedit in a user's home directory.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Sudo: 1.6.1 - 1.6.9p20

CPE2.3

• cpe:2.3:a:sudo:sudo:1.6.1:*:*:*:*:*:*:*
• cpe:2.3:a:sudo:sudo:1.6.2:*:*:*:*:*:*:*
• cpe:2.3:a:sudo:sudo:1.6.2p3:*:*:*:*:*:*:*

External links

https:ftp://ftp.sudo.ws/pub/sudo/sudo-1.6.9p21.patch.gz
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=570737
https://lists.fedoraproject.org/pipermail/package-announce/2010-May/040578.html
https://lists.fedoraproject.org/pipermail/package-announce/2010-May/040588.html
https://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
https://secunia.com/advisories/38659
https://secunia.com/advisories/38762
https://secunia.com/advisories/38795
https://secunia.com/advisories/38803
https://secunia.com/advisories/38915
https://secunia.com/advisories/39399
https://securitytracker.com/id?1023658
https://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.577019
https://sudo.ws/bugs/show_bug.cgi?id=389
https://sudo.ws/repos/sudo/rev/88f3181692fe
https://sudo.ws/repos/sudo/rev/f86e1b56d074
https://wiki.rpath.com/Advisories:rPSA-2010-0075
https://www.debian.org/security/2010/dsa-2006
https://www.gentoo.org/security/en/glsa/glsa-201003-01.xml
https://www.linuxquestions.org/questions/linux-security-4/the-use-of-sudoedit-command-question-785442/
https://www.mandriva.com/security/advisories?name=MDVSA-2010:049
https://www.securityfocus.com/archive/1/514489/100/0/threaded
https://www.securityfocus.com/bid/38362
https://www.sudo.ws/sudo/stable.html
https://www.ubuntu.com/usn/USN-905-1
https://www.vupen.com/english/advisories/2010/0450
https://www.vupen.com/english/advisories/2010/0949
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10814
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7238

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.