Vulnerabilities > CVE-2010-0426 - Permissions, Privileges, and Access Controls vulnerability in Todd Miller Sudo

047910
CVSS 6.9 - MEDIUM
Attack vector
LOCAL
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
local
todd-miller
CWE-264
nessus

Summary

sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by a file named sudoedit in a user's home directory.

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Accessing, Modifying or Executing Executable Files
    An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Blue Boxing
    This type of attack against older telephone switches and trunks has been around for decades. A tone is sent by an adversary to impersonate a supervisor signal which has the effect of rerouting or usurping command of the line. While the US infrastructure proper may not contain widespread vulnerabilities to this type of attack, many companies are connected globally through call centers and business process outsourcing. These international systems may be operated in countries which have not upgraded Telco infrastructure and so are vulnerable to Blue boxing. Blue boxing is a result of failure on the part of the system to enforce strong authorization for administrative functions. While the infrastructure is different than standard current applications like web applications, there are historical lessons to be learned to upgrade the access control for administrative functions.
  • Restful Privilege Elevation
    Rest uses standard HTTP (Get, Put, Delete) style permissions methods, but these are not necessarily correlated generally with back end programs. Strict interpretation of HTTP get methods means that these HTTP Get services should not be used to delete information on the server, but there is no access control mechanism to back up this logic. This means that unless the services are properly ACL'd and the application's service implementation are following these guidelines then an HTTP request can easily execute a delete or update on the server side. The attacker identifies a HTTP Get URL such as http://victimsite/updateOrder, which calls out to a program to update orders on a database or other resource. The URL is not idempotent so the request can be submitted multiple times by the attacker, additionally, the attacker may be able to exploit the URL published as a Get method that actually performs updates (instead of merely retrieving data). This may result in malicious or inadvertent altering of data on the server.
  • Target Programs with Elevated Privileges
    This attack targets programs running with elevated privileges. The attacker would try to leverage a bug in the running program and get arbitrary code to execute with elevated privileges. For instance an attacker would look for programs that write to the system directories or registry keys (such as HKLM, which stores a number of critical Windows environment variables). These programs are typically running with elevated privileges and have usually not been designed with security in mind. Such programs are excellent exploit targets because they yield lots of power when they break. The malicious user try to execute its code at the same level as a privileged system call.

Nessus

  • NASL familySlackware Local Security Checks
    NASL idSLACKWARE_SSA_2010-110-01.NASL
    descriptionNew sudo packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, 13.0, and -current to fix security issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id45581
    published2010-04-21
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/45581
    titleSlackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / 13.0 / 8.1 / 9.0 / 9.1 / current : sudo (SSA:2010-110-01)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Slackware Security Advisory 2010-110-01. The text 
    # itself is copyright (C) Slackware Linux, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(45581);
      script_version("1.13");
      script_cvs_date("Date: 2019/10/25 13:36:21");
    
      script_cve_id("CVE-2010-0426", "CVE-2010-1163");
      script_bugtraq_id(38362, 39468);
      script_xref(name:"SSA", value:"2010-110-01");
    
      script_name(english:"Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / 13.0 / 8.1 / 9.0 / 9.1 / current : sudo (SSA:2010-110-01)");
      script_summary(english:"Checks for updated package in /var/log/packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Slackware host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "New sudo packages are available for Slackware 8.1, 9.0, 9.1, 10.0,
    10.1, 10.2, 11.0, 12.0, 12.1, 12.2, 13.0, and -current to fix security
    issues."
      );
      # http://www.slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.577019
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?9dbaf1f7"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected sudo package.");
      script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_cwe_id(264);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:slackware:slackware_linux:sudo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:10.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:10.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:10.2");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:11.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:12.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:12.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:12.2");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:13.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:8.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:9.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:9.1");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2010/04/20");
      script_set_attribute(attribute:"plugin_publication_date", value:"2010/04/21");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2010-2019 Tenable Network Security, Inc.");
      script_family(english:"Slackware Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Slackware/release", "Host/Slackware/packages");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("slackware.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Slackware/release")) audit(AUDIT_OS_NOT, "Slackware");
    if (!get_kb_item("Host/Slackware/packages")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Slackware", cpu);
    
    
    flag = 0;
    if (slackware_check(osver:"8.1", pkgname:"sudo", pkgver:"1.7.2p6", pkgarch:"i386", pkgnum:"1_slack8.1")) flag++;
    
    if (slackware_check(osver:"9.0", pkgname:"sudo", pkgver:"1.7.2p6", pkgarch:"i386", pkgnum:"1_slack9.0")) flag++;
    
    if (slackware_check(osver:"9.1", pkgname:"sudo", pkgver:"1.7.2p6", pkgarch:"i486", pkgnum:"1_slack9.1")) flag++;
    
    if (slackware_check(osver:"10.0", pkgname:"sudo", pkgver:"1.7.2p6", pkgarch:"i486", pkgnum:"1_slack10.0")) flag++;
    
    if (slackware_check(osver:"10.1", pkgname:"sudo", pkgver:"1.7.2p6", pkgarch:"i486", pkgnum:"1_slack10.1")) flag++;
    
    if (slackware_check(osver:"10.2", pkgname:"sudo", pkgver:"1.7.2p6", pkgarch:"i486", pkgnum:"1_slack10.2")) flag++;
    
    if (slackware_check(osver:"11.0", pkgname:"sudo", pkgver:"1.7.2p6", pkgarch:"i486", pkgnum:"1_slack11.0")) flag++;
    
    if (slackware_check(osver:"12.0", pkgname:"sudo", pkgver:"1.7.2p6", pkgarch:"i486", pkgnum:"1_slack12.0")) flag++;
    
    if (slackware_check(osver:"12.1", pkgname:"sudo", pkgver:"1.7.2p6", pkgarch:"i486", pkgnum:"1_slack12.1")) flag++;
    
    if (slackware_check(osver:"12.2", pkgname:"sudo", pkgver:"1.7.2p6", pkgarch:"i486", pkgnum:"1_slack12.2")) flag++;
    
    if (slackware_check(osver:"13.0", pkgname:"sudo", pkgver:"1.7.2p6", pkgarch:"i486", pkgnum:"1_slack13.0")) flag++;
    if (slackware_check(osver:"13.0", arch:"x86_64", pkgname:"sudo", pkgver:"1.7.2p6", pkgarch:"x86_64", pkgnum:"1_slack13.0")) flag++;
    
    if (slackware_check(osver:"current", pkgname:"sudo", pkgver:"1.7.2p6", pkgarch:"i486", pkgnum:"1")) flag++;
    if (slackware_check(osver:"current", arch:"x86_64", pkgname:"sudo", pkgver:"1.7.2p6", pkgarch:"x86_64", pkgnum:"1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:slackware_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2010-0476.NASL
    descriptionAn updated rhev-hypervisor package that fixes two security issues, multiple bugs, and adds enhancements is now available. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The rhev-hypervisor package provides a Red Hat Enterprise Virtualization Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor is a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes everything necessary to run and manage virtual machines: A subset of the Red Hat Enterprise Linux operating environment and the Red Hat Enterprise Virtualization Agent. Note: Red Hat Enterprise Virtualization Hypervisor is only available for the Intel 64 and AMD64 architectures with virtualization extensions. A flaw was found in the way QEMU-KVM handled erroneous data provided by the Linux virtio-net driver, used by guest operating systems. Due to a deficiency in the TSO (TCP segment offloading) implementation, a guest
    last seen2020-06-01
    modified2020-06-02
    plugin id79275
    published2014-11-17
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/79275
    titleRHEL 5 : rhev-hypervisor (RHSA-2010:0476)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201003-01.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201003-01 (sudo: Privilege escalation) Multiple vulnerabilities have been discovered in sudo: Glenn Waller and neonsignal reported that sudo does not properly handle access control of the
    last seen2020-06-01
    modified2020-06-02
    plugin id44971
    published2010-03-04
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/44971
    titleGLSA-201003-01 : sudo: Privilege escalation
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20100226_SUDO_ON_SL5_X.NASL
    descriptionCVE-2010-0426 sudo: sudoedit option can possibly allow for arbitrary code execution CVE-2010-0427 sudo: Fails to reset group permissions if runas_default set A privilege escalation flaw was found in the way sudo handled the sudoedit pseudo-command. If a local user were authorized by the sudoers file to use this pseudo-command, they could possibly leverage this flaw to execute arbitrary code with the privileges of the root user. (CVE-2010-0426) The sudo utility did not properly initialize supplementary groups when the
    last seen2020-06-01
    modified2020-06-02
    plugin id60739
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60739
    titleScientific Linux Security Update : sudo on SL5.x i386/x86_64
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2006.NASL
    descriptionSeveral vulnerabilities have been discovered in sudo, a program designed to allow a sysadmin to give limited root privileges to users. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2010-0426 It was discovered that sudo when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file. - CVE-2010-0427 It was discovered that sudo when the runas_default option is used, does not properly set group memberships, which allows local users to gain privileges via a sudo command.
    last seen2020-06-01
    modified2020-06-02
    plugin id44970
    published2010-03-04
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/44970
    titleDebian DSA-2006-1 : sudo - several vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_1_SUDO-100301.NASL
    descriptionThis update fixes two security issues : - CVE-2010-0427:CVSS v2 Base Score: 6.6 Sudo failed to properly reset group permissions, when
    last seen2020-06-01
    modified2020-06-02
    plugin id45012
    published2010-03-09
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/45012
    titleopenSUSE Security Update : sudo (sudo-2083)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2010-0361.NASL
    descriptionFrom Red Hat Security Advisory 2010:0361 : An updated sudo package that fixes one security issue is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root. The RHBA-2010:0212 sudo update released as part of Red Hat Enterprise Linux 5.5 added the ability to change the value of the ignore_dot option in the
    last seen2020-06-01
    modified2020-06-02
    plugin id68033
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/68033
    titleOracle Linux 5 : sudo (ELSA-2010-0361)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_0_SUDO-100301.NASL
    descriptionThis update fixes two security issues : - CVE-2010-0427:CVSS v2 Base Score: 6.6 Sudo failed to properly reset group permissions, when
    last seen2020-06-01
    modified2020-06-02
    plugin id45011
    published2010-03-09
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/45011
    titleopenSUSE Security Update : sudo (sudo-2083)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2010-6749.NASL
    description - update to new upstream version - merged .audit and .libaudit patch - added sudoers.ldap.5* to files - http://sudo.ws/sudo/alerts/sudoedit_escalate2.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id47448
    published2010-07-01
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/47448
    titleFedora 11 : sudo-1.7.2p6-1.fc11 (2010-6749)
  • NASL familyVMware ESX Local Security Checks
    NASL idVMWARE_VMSA-2010-0009.NASL
    descriptiona. Service Console update for COS kernel Updated COS package
    last seen2020-06-01
    modified2020-06-02
    plugin id46765
    published2010-06-01
    reporterThis script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/46765
    titleVMSA-2010-0009 : ESXi ntp and ESX Service Console third-party updates
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2010-0361.NASL
    descriptionAn updated sudo package that fixes one security issue is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root. The RHBA-2010:0212 sudo update released as part of Red Hat Enterprise Linux 5.5 added the ability to change the value of the ignore_dot option in the
    last seen2020-06-01
    modified2020-06-02
    plugin id46302
    published2010-05-11
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/46302
    titleRHEL 5 : sudo (RHSA-2010:0361)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2010-0361.NASL
    descriptionAn updated sudo package that fixes one security issue is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root. The RHBA-2010:0212 sudo update released as part of Red Hat Enterprise Linux 5.5 added the ability to change the value of the ignore_dot option in the
    last seen2020-06-01
    modified2020-06-02
    plugin id46756
    published2010-06-01
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/46756
    titleCentOS 5 : sudo (CESA-2010:0361)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-928-1.NASL
    descriptionValerio Costamagna discovered that sudo did not properly validate the path for the
    last seen2020-06-01
    modified2020-06-02
    plugin id45550
    published2010-04-16
    reporterUbuntu Security Notice (C) 2010-2019 Canonical, Inc. / NASL script (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/45550
    titleUbuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : sudo vulnerability (USN-928-1)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2010-0122.NASL
    descriptionAn updated sudo package that fixes two security issues is now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root. A privilege escalation flaw was found in the way sudo handled the sudoedit pseudo-command. If a local user were authorized by the sudoers file to use this pseudo-command, they could possibly leverage this flaw to execute arbitrary code with the privileges of the root user. (CVE-2010-0426) The sudo utility did not properly initialize supplementary groups when the
    last seen2020-06-01
    modified2020-06-02
    plugin id44924
    published2010-03-01
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/44924
    titleRHEL 5 : sudo (RHSA-2010:0122)
  • NASL familyVMware ESX Local Security Checks
    NASL idVMWARE_VMSA-2010-0009_REMOTE.NASL
    descriptionThe remote VMware ESX / ESXi host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several components and third-party libraries : - libpng - VMnc Codec - vmrun - VMware Remote Console (VMrc) - VMware Tools - vmware-authd
    last seen2020-06-01
    modified2020-06-02
    plugin id89740
    published2016-03-08
    reporterThis script is Copyright (C) 2016-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/89740
    titleVMware ESX / ESXi Third-Party Libraries and Components (VMSA-2010-0009) (remote check)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2010-3359.NASL
    description - update to new upstream version - fixes CVE-2010-0426 sudo: sudoedit option can possibly allow for arbitrary code execution [Fedora all] (#567676) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id47309
    published2010-07-01
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/47309
    titleFedora 12 : sudo-1.7.2p5-1.fc12 (2010-3359)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-905-1.NASL
    descriptionIt was discovered that sudo did not properly validate the path for the
    last seen2020-06-01
    modified2020-06-02
    plugin id44936
    published2010-03-01
    reporterUbuntu Security Notice (C) 2010-2019 Canonical, Inc. / NASL script (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/44936
    titleUbuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : sudo vulnerabilities (USN-905-1)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2010-3415.NASL
    description - update to new upstream version - backported changes from F-12 - fixes CVE-2010-0426 sudo: sudoedit option can possibly allow for arbitrary code execution [Fedora all] (#567676) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id47313
    published2010-07-01
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/47313
    titleFedora 11 : sudo-1.7.2p5-1.fc11 (2010-3415)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SUDO-6892.NASL
    descriptionThis update fixes the following security issue : - A privilege escalation flaw was found in the way sudo used to check file paths for pseudocommands. If local, unprivileged user was authorized by sudoers file to edit one or more files, it could lead to execution of arbitrary code, with the privileges of privileged system user (root). (CVE-2010-0426:CVSS v2 Base Score: 6.6)
    last seen2020-06-01
    modified2020-06-02
    plugin id49927
    published2010-10-11
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/49927
    titleSuSE 10 Security Update : sudo (ZYPP Patch Number 6892)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_018A84D0254811DFB4A300E0815B8DA8.NASL
    descriptionTodd Miller reports : When sudo performs its command matching, there is a special case for pseudo-commands in the sudoers file (currently, the only pseudo-command is sudoedit). Unlike a regular command, pseudo-commands do not begin with a slash (
    last seen2020-06-01
    modified2020-06-02
    plugin id44952
    published2010-03-02
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/44952
    titleFreeBSD : sudo -- Privilege escalation with sudoedit (018a84d0-2548-11df-b4a3-00e0815b8da8)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2010-3352.NASL
    description - update to new upstream version - fixes CVE-2010-0426 sudo: sudoedit option can possibly allow for arbitrary code execution [Fedora all] (#567676) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id47308
    published2010-07-01
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/47308
    titleFedora 13 : sudo-1.7.2p5-1.fc13 (2010-3352)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_SUDO-100301.NASL
    descriptionThis update fixes two security issues : - Sudo failed to properly reset group permissions, when
    last seen2020-06-01
    modified2020-06-02
    plugin id45014
    published2010-03-09
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/45014
    titleSuSE 11 Security Update : sudo (SAT Patch Number 2084)
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2010-078.NASL
    descriptionA vulnerability has been found and corrected in sudo : The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current working directory has the same name as a pseudo-command in the sudoers file and the PATH contains an entry for ., which allows local users to execute arbitrary commands via a Trojan horse executable, as demonstrated using sudoedit, a different vulnerability than CVE-2010-0426 (CVE-2010-1163). Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers. The updated packages have been patched to correct this issue. Update : Packages for 2009.0 are provided due to the Extended Maintenance Program.
    last seen2020-06-01
    modified2020-06-02
    plugin id45564
    published2010-04-19
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/45564
    titleMandriva Linux Security Advisory : sudo (MDVSA-2010:078-1)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2010-6756.NASL
    description - update to new upstream version - merged .audit and .libaudit patch - added sudoers.ldap.5* to files - http://sudo.ws/sudo/alerts/sudoedit_escalate2.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id47449
    published2010-07-01
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/47449
    titleFedora 13 : sudo-1.7.2p6-1.fc13 (2010-6756)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2010-0122.NASL
    descriptionAn updated sudo package that fixes two security issues is now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root. A privilege escalation flaw was found in the way sudo handled the sudoedit pseudo-command. If a local user were authorized by the sudoers file to use this pseudo-command, they could possibly leverage this flaw to execute arbitrary code with the privileges of the root user. (CVE-2010-0426) The sudo utility did not properly initialize supplementary groups when the
    last seen2020-06-01
    modified2020-06-02
    plugin id44949
    published2010-03-02
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/44949
    titleCentOS 5 : sudo (CESA-2010:0122)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SUDO-6891.NASL
    descriptionThis update fixes the following security issue : - A privilege escalation flaw was found in the way sudo used to check file paths for pseudocommands. If local, unprivileged user was authorized by sudoers file to edit one or more files, it could lead to execution of arbitrary code, with the privileges of privileged system user (root). (CVE-2010-0426:CVSS v2 Base Score: 6.6)
    last seen2020-06-01
    modified2020-06-02
    plugin id45015
    published2010-03-09
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/45015
    titleSuSE 10 Security Update : sudo (ZYPP Patch Number 6891)
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2010-049.NASL
    descriptionA vulnerability has been found and corrected in sudo : sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by a file named sudoedit in a user
    last seen2020-06-01
    modified2020-06-02
    plugin id44919
    published2010-02-26
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/44919
    titleMandriva Linux Security Advisory : sudo (MDVSA-2010:049)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_2_SUDO-100301.NASL
    descriptionThis update fixes two security issues : - CVE-2010-0427:CVSS v2 Base Score: 6.6 Sudo failed to properly reset group permissions, when
    last seen2020-06-01
    modified2020-06-02
    plugin id45013
    published2010-03-09
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/45013
    titleopenSUSE Security Update : sudo (sudo-2083)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2010-6701.NASL
    description - update to new upstream version - merged .audit and .libaudit patch - added sudoers.ldap.5* to files - http://sudo.ws/sudo/alerts/sudoedit_escalate2.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id47444
    published2010-07-01
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/47444
    titleFedora 12 : sudo-1.7.2p6-1.fc12 (2010-6701)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2010-0122.NASL
    descriptionFrom Red Hat Security Advisory 2010:0122 : An updated sudo package that fixes two security issues is now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root. A privilege escalation flaw was found in the way sudo handled the sudoedit pseudo-command. If a local user were authorized by the sudoers file to use this pseudo-command, they could possibly leverage this flaw to execute arbitrary code with the privileges of the root user. (CVE-2010-0426) The sudo utility did not properly initialize supplementary groups when the
    last seen2020-06-01
    modified2020-06-02
    plugin id68002
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/68002
    titleOracle Linux 5 : sudo (ELSA-2010-0122)

Oval

  • accepted2013-04-29T04:09:00.800-04:00
    classvulnerability
    contributors
    • nameAharon Chernin
      organizationSCAP.com, LLC
    • nameDragos Prisaca
      organizationG2, Inc.
    definition_extensions
    • commentThe operating system installed on the system is Red Hat Enterprise Linux 5
      ovaloval:org.mitre.oval:def:11414
    • commentThe operating system installed on the system is CentOS Linux 5.x
      ovaloval:org.mitre.oval:def:15802
    • commentOracle Linux 5.x
      ovaloval:org.mitre.oval:def:15459
    descriptionsudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by a file named sudoedit in a user's home directory.
    familyunix
    idoval:org.mitre.oval:def:10814
    statusaccepted
    submitted2010-07-09T03:56:16-04:00
    titlesudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by a file named sudoedit in a user's home directory.
    version18
  • accepted2014-01-20T04:01:33.462-05:00
    classvulnerability
    contributors
    • nameJ. Daniel Brown
      organizationDTCC
    • nameChris Coffin
      organizationThe MITRE Corporation
    definition_extensions
    commentVMware ESX Server 4.0 is installed
    ovaloval:org.mitre.oval:def:6293
    descriptionsudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by a file named sudoedit in a user's home directory.
    familyunix
    idoval:org.mitre.oval:def:7238
    statusaccepted
    submitted2010-06-01T17:30:00.000-05:00
    titleSudo 'sudoedit' Local Privilege Escalation Vulnerability
    version8

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/88672/2010-02-sudo.txt
idPACKETSTORM:88672
last seen2016-12-05
published2010-04-20
reporterMaurizio Agazzini
sourcehttps://packetstormsecurity.com/files/88672/Sudo-1.7.2p5-Local-Privilege-Escalation.html
titleSudo 1.7.2p5 Local Privilege Escalation

Redhat

rpms
  • sudo-0:1.6.9p17-6.el5_4
  • sudo-debuginfo-0:1.6.9p17-6.el5_4

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 38362 CVE(CAN) ID: CVE-2010-0426 Sudo是一款允许用户以其他用户权限安全地执行命令的程序,广泛使用在Linux和Unix操作系统下。 由于处理sudoedit命令时的错误,拥有sudoedit权限的本地用户可以以root用户权限执行任意代码。成功攻击要求sudoedit命令没有在sudoers文件中指定完整路径。 Todd Miller Sudo 1.7 Todd Miller Sudo 1.6 Todd Miller ----------- 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: http://www.sudo.ws/sudo/dist/sudo-1.7.2p4.tar.gz
idSSV:19186
last seen2017-11-19
modified2010-02-25
published2010-02-25
reporterRoot
titleSudo sudoedit命令本地权限提升漏洞

Statements

contributorTomas Hoger
lastmodified2010-03-02
organizationRed Hat
statementThis issue was addressed in Red Hat Enterprise Linux 5 via: https://rhn.redhat.com/errata/RHSA-2010-0122.html It did not affect the versions of the sudo package as shipped with Red Hat Enterprise Linux 3 and 4.

References