National Cyber Awareness System

Vulnerability Summary for CVE-2010-1163

Overview

The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current working directory has the same name as a pseudo-command in the sudoers file and the PATH contains an entry for ".", which allows local users to execute arbitrary commands via a Trojan horse executable, as demonstrated using sudoedit, a different vulnerability than CVE-2010-0426.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: sudo-sudoefit-privilege-escalation(57836)

Hyperlink:http://xforce.iss.net/xforce/xfdb/57836

External Source: VUPEN

Name: ADV-2011-0212

Hyperlink:http://www.vupen.com/english/advisories/2011/0212

External Source: VUPEN

Name: ADV-2010-1019

Hyperlink:http://www.vupen.com/english/advisories/2010/1019

External Source: VUPEN

Name: ADV-2010-0956

Hyperlink:http://www.vupen.com/english/advisories/2010/0956

External Source: VUPEN

Name: ADV-2010-0949

Hyperlink:http://www.vupen.com/english/advisories/2010/0949

External Source: VUPEN

Name: ADV-2010-0904

Hyperlink:http://www.vupen.com/english/advisories/2010/0904

External Source: VUPEN

Name: ADV-2010-0895

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2010/0895

External Source: VUPEN

Name: ADV-2010-0881

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2010/0881

External Source: UBUNTU

Name: USN-928-1

Hyperlink:http://www.ubuntu.com/usn/USN-928-1

External Source: CONFIRM

Name: http://www.sudo.ws/sudo/alerts/sudoedit_escalate2.html

Hyperlink:http://www.sudo.ws/sudo/alerts/sudoedit_escalate2.html

External Source: BID

Name: 39468

Hyperlink:http://www.securityfocus.com/bid/39468

External Source: BUGTRAQ

Name: 20101027 rPSA-2010-0075-1 sudo

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/514489/100/0/threaded

External Source: BUGTRAQ

Name: 20100422 Re: sudoedit local privilege escalation through PATH manipulation

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/510880/100/0/threaded

External Source: BUGTRAQ

Name: 20100420 Re: sudoedit local privilege escalation through PATH manipulation

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/510846/100/0/threaded

External Source: BUGTRAQ

Name: 20100419 sudoedit local privilege escalation through PATH manipulation

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/510827/100/0/threaded

External Source: REDHAT

Name: RHSA-2010:0361

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0361.html

External Source: OSVDB

Name: 63878

Hyperlink:http://www.osvdb.org/63878

External Source: MANDRIVA

Name: MDVSA-2010:078

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:078

External Source: CONFIRM

Name: http://wiki.rpath.com/Advisories:rPSA-2010-0075

Hyperlink:http://wiki.rpath.com/Advisories:rPSA-2010-0075

External Source: SLACKWARE

Name: SSA:2010-110-01

Hyperlink:http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.577019

External Source: SECUNIA

Name: 43068

Hyperlink:http://secunia.com/advisories/43068

External Source: SECUNIA

Name: 39543

Hyperlink:http://secunia.com/advisories/39543

External Source: SECUNIA

Name: 39474

Type: Advisory

Hyperlink:http://secunia.com/advisories/39474

External Source: SECUNIA

Name: 39399

Hyperlink:http://secunia.com/advisories/39399

External Source: SECUNIA

Name: 39384

Type: Advisory

Hyperlink:http://secunia.com/advisories/39384

External Source: OVAL

Name: oval:org.mitre.oval:def:9382

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9382

External Source: SUSE

Name: SUSE-SR:2011:002

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html

External Source: FEDORA

Name: FEDORA-2010-6756

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039986.html

References to Check Content

Identifier:oval:org.mitre.oval:def:9382

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9382