National Vulnerability Database (NVD) National Vulnerability Database (CVE-2010-0426)

National Cyber Awareness System

Vulnerability Summary for CVE-2010-0426

Original release date:02/24/2010

Last revised:01/21/2011

Source: US-CERT/NIST

Overview

sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by a file named sudoedit in a user's home directory.

Impact

CVSS Severity (version 2.0):

CVSS v2 Base Score:6.9 (MEDIUM) (AV:L/AC:M/Au:N/C:C/I:C/A:C) (legend)

Impact Subscore: 10.0

Exploitability Subscore: 3.4

CVSS Version 2 Metrics:

Access Vector: Locally exploitable; Victim must voluntarily interact with attack mechanism

Access Complexity: Medium

Authentication: Not required to exploit

Impact Type:Provides administrator access, Allows complete confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service

Vendor Statements (disclaimer)

Official Statement from Red Hat (03/02/2010)

This issue was addressed in Red Hat Enterprise Linux 5 via: https://rhn.redhat.com/errata/RHSA-2010-0122.html It did not affect the versions of the sudo package as shipped with Red Hat Enterprise Linux 3 and 4.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: http://www.sudo.ws/sudo/stable.html

Type: Patch Information

Hyperlink:http://www.sudo.ws/sudo/stable.html

External Source: BID

Name: 38362

Type: Patch Information

Hyperlink:http://www.securityfocus.com/bid/38362

External Source: CONFIRM

Name: ftp://ftp.sudo.ws/pub/sudo/sudo-1.6.9p21.patch.gz

Type: Patch Information

Hyperlink:ftp://ftp.sudo.ws/pub/sudo/sudo-1.6.9p21.patch.gz

External Source: VUPEN

Name: ADV-2010-0949

Hyperlink:http://www.vupen.com/english/advisories/2010/0949

External Source: VUPEN

Name: ADV-2010-0450

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2010/0450

External Source: UBUNTU

Name: USN-905-1

Hyperlink:http://www.ubuntu.com/usn/USN-905-1

External Source: BUGTRAQ

Name: 20101027 rPSA-2010-0075-1 sudo

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/514489/100/0/threaded

External Source: MANDRIVA

Name: MDVSA-2010:049

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:049

External Source: MISC

Name: http://www.linuxquestions.org/questions/linux-security-4/the-use-of-sudoedit-command-question-785442/

Hyperlink:http://www.linuxquestions.org/questions/linux-security-4/the-use-of-sudoedit-command-question-785442/

External Source: GENTOO

Name: GLSA-201003-01

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-201003-01.xml

External Source: DEBIAN

Name: DSA-2006

Hyperlink:http://www.debian.org/security/2010/dsa-2006

External Source: CONFIRM

Name: http://wiki.rpath.com/Advisories:rPSA-2010-0075

Hyperlink:http://wiki.rpath.com/Advisories:rPSA-2010-0075

External Source: CONFIRM

Name: http://sudo.ws/repos/sudo/rev/f86e1b56d074

Hyperlink:http://sudo.ws/repos/sudo/rev/f86e1b56d074

External Source: CONFIRM

Name: http://sudo.ws/repos/sudo/rev/88f3181692fe

Hyperlink:http://sudo.ws/repos/sudo/rev/88f3181692fe

External Source: CONFIRM

Name: http://sudo.ws/bugs/show_bug.cgi?id=389

Hyperlink:http://sudo.ws/bugs/show_bug.cgi?id=389

External Source: SLACKWARE

Name: SSA:2010-110-01

Hyperlink:http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.577019

External Source: SECTRACK

Name: 1023658

Hyperlink:http://securitytracker.com/id?1023658

External Source: SECUNIA

Name: 39399

Hyperlink:http://secunia.com/advisories/39399

External Source: SECUNIA

Name: 38915

Hyperlink:http://secunia.com/advisories/38915

External Source: SECUNIA

Name: 38803

Hyperlink:http://secunia.com/advisories/38803

External Source: SECUNIA

Name: 38795

Hyperlink:http://secunia.com/advisories/38795

External Source: SECUNIA

Name: 38762

Hyperlink:http://secunia.com/advisories/38762

External Source: SECUNIA

Name: 38659

Type: Advisory

Hyperlink:http://secunia.com/advisories/38659

External Source: OVAL

Name: oval:org.mitre.oval:def:7238

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:7238

External Source: OVAL

Name: oval:org.mitre.oval:def:10814

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10814

External Source: SUSE

Name: SUSE-SR:2010:006

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html

External Source: FEDORA

Name: FEDORA-2010-6749

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040588.html

External Source: FEDORA

Name: FEDORA-2010-6701

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040578.html

External Source: MISC

Name: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=570737

Hyperlink:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=570737

References to Check Content

Identifier:oval:org.mitre.oval:def:7238

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:7238

Identifier:oval:org.mitre.oval:def:10814

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10814

Vulnerable software and versions

Configuration 1

* cpe:/a:todd_miller:sudo:1.6

* cpe:/a:todd_miller:sudo:1.6.1

* cpe:/a:todd_miller:sudo:1.6.2

* cpe:/a:todd_miller:sudo:1.6.3

* cpe:/a:todd_miller:sudo:1.6.3_p1

* cpe:/a:todd_miller:sudo:1.6.3_p2

* cpe:/a:todd_miller:sudo:1.6.3_p3

* cpe:/a:todd_miller:sudo:1.6.3_p4

* cpe:/a:todd_miller:sudo:1.6.3_p5

* cpe:/a:todd_miller:sudo:1.6.3_p6

* cpe:/a:todd_miller:sudo:1.6.3_p7

* cpe:/a:todd_miller:sudo:1.6.4_p1

* cpe:/a:todd_miller:sudo:1.6.4_p2

* cpe:/a:todd_miller:sudo:1.6.5_p1

* cpe:/a:todd_miller:sudo:1.6.5_p2

* cpe:/a:todd_miller:sudo:1.6.7_p5

* cpe:/a:todd_miller:sudo:1.6.8_p1

* cpe:/a:todd_miller:sudo:1.6.8_p12

* cpe:/a:todd_miller:sudo:1.6.8_p2

* cpe:/a:todd_miller:sudo:1.6.8_p5

* cpe:/a:todd_miller:sudo:1.6.8_p7

* cpe:/a:todd_miller:sudo:1.6.8_p8

* cpe:/a:todd_miller:sudo:1.6.8_p9

* cpe:/a:todd_miller:sudo:1.6.9_p17

* cpe:/a:todd_miller:sudo:1.6.9_p18

* cpe:/a:todd_miller:sudo:1.6.9_p19

* cpe:/a:todd_miller:sudo:1.7.0

* cpe:/a:todd_miller:sudo:1.7.1

* cpe:/a:todd_miller:sudo:1.7.2

* cpe:/a:todd_miller:sudo:1.7.2p1

* cpe:/a:todd_miller:sudo:1.7.2p2

* cpe:/a:todd_miller:sudo:1.7.2p3

* Denotes Vulnerable Software

Technical Details

Vulnerability Type (View All)

Permissions, Privileges, and Access Control (CWE-264)

CVE Standard Vulnerability Entry:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0426