Vulnerability Name:

CVE-2010-2956 (CCN-61623)

Assigned:2010-09-07
Published:2010-09-07
Updated:2018-10-10
Summary:Sudo 1.7.0 through 1.7.4p3, when a Runas group is configured, does not properly handle use of the -u option in conjunction with the -g option, which allows local users to gain privileges via a command line containing a "-u root" sequence.
CVSS v3 Severity:5.9 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:6.2 Medium (CVSS v2 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C)
4.6 Medium (Temporal CVSS v2 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
4.4 Medium (CCN CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
6.0 Medium (REDHAT CVSS v2 Vector: AV:L/AC:H/Au:S/C:C/I:C/A:C)
4.5 Medium (REDHAT Temporal CVSS v2 Vector: AV:L/AC:H/Au:S/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): High
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Privileges
References:Source: MITRE
Type: CNA
CVE-2010-2956

Source: FEDORA
Type: UNKNOWN
FEDORA-2010-14355

Source: SUSE
Type: UNKNOWN
SUSE-SR:2010:017

Source: CCN
Type: RHSA-2010-0675
Important: sudo security update

Source: SECUNIA
Type: Vendor Advisory
40508

Source: CCN
Type: SA41316
Sudo Runas Group Matching Vulnerability

Source: SECUNIA
Type: Vendor Advisory
41316

Source: CCN
Type: SA42787
VMware ESX Console OS (COS) Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
42787

Source: GENTOO
Type: UNKNOWN
GLSA-201009-03

Source: CCN
Type: SECTRACK ID: 1024392
Sudo Runas Group Matching Error Lets Local Users Gain Elevated Privileges

Source: CONFIRM
Type: UNKNOWN
http://wiki.rpath.com/Advisories:rPSA-2010-0075

Source: CCN
Type: GLSA-201009-03
sudo: Privilege Escalation

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2010:175

Source: CCN
Type: OSVDB ID: 67842
sudo Runas Group Handling Local Privilege Escalation

Source: REDHAT
Type: UNKNOWN
RHSA-2010:0675

Source: BUGTRAQ
Type: UNKNOWN
20101027 rPSA-2010-0075-1 sudo

Source: BUGTRAQ
Type: UNKNOWN
20110105 VMSA-2011-0001 VMware ESX third party updates for Service Console packages glibc, sudo, and openldap

Source: BID
Type: UNKNOWN
43019

Source: CCN
Type: BID-43019
Todd Miller Sudo Runas Group Local Privilege Escalation Vulnerability

Source: SECTRACK
Type: UNKNOWN
1024392

Source: CCN
Type: Sudo Web Site
Flaw in Runas group matching

Source: CONFIRM
Type: Vendor Advisory
http://www.sudo.ws/sudo/alerts/runas_group.html

Source: UBUNTU
Type: UNKNOWN
USN-983-1

Source: CONFIRM
Type: UNKNOWN
http://www.vmware.com/security/advisories/VMSA-2011-0001.html

Source: VUPEN
Type: UNKNOWN
ADV-2010-2312

Source: VUPEN
Type: UNKNOWN
ADV-2010-2318

Source: VUPEN
Type: UNKNOWN
ADV-2010-2320

Source: VUPEN
Type: UNKNOWN
ADV-2010-2358

Source: VUPEN
Type: UNKNOWN
ADV-2011-0025

Source: CONFIRM
Type: UNKNOWN
https://bugzilla.redhat.com/show_bug.cgi?id=628628

Source: XF
Type: UNKNOWN
sudo-runas-privilege-escalation(61623)

Source: SUSE
Type: SUSE-SR:2010:017
(java-1_4_2-ibm, sudo, libpng, php5, tgt, iscsitarget, aria2, pcsc-lite, tomcat5, tomcat6, lvm2, libvirt, rpm, libtiff, dovecot12)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:todd_miller:sudo:1.7.0:*:*:*:*:*:*:*
  • OR cpe:/a:todd_miller:sudo:1.7.1:*:*:*:*:*:*:*
  • OR cpe:/a:todd_miller:sudo:1.7.2:*:*:*:*:*:*:*
  • OR cpe:/a:todd_miller:sudo:1.7.2p1:*:*:*:*:*:*:*
  • OR cpe:/a:todd_miller:sudo:1.7.2p2:*:*:*:*:*:*:*
  • OR cpe:/a:todd_miller:sudo:1.7.2p3:*:*:*:*:*:*:*
  • OR cpe:/a:todd_miller:sudo:1.7.2p4:*:*:*:*:*:*:*
  • OR cpe:/a:todd_miller:sudo:1.7.2p5:*:*:*:*:*:*:*
  • OR cpe:/a:todd_miller:sudo:1.7.2p6:*:*:*:*:*:*:*
  • OR cpe:/a:todd_miller:sudo:1.7.2p7:*:*:*:*:*:*:*
  • OR cpe:/a:todd_miller:sudo:1.7.3b1:*:*:*:*:*:*:*
  • OR cpe:/a:todd_miller:sudo:1.7.4:*:*:*:*:*:*:*
  • OR cpe:/a:todd_miller:sudo:1.7.4p1:*:*:*:*:*:*:*
  • OR cpe:/a:todd_miller:sudo:1.7.4p2:*:*:*:*:*:*:*
  • OR cpe:/a:todd_miller:sudo:1.7.4p3:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:5::client:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20102956
    V
    		CVE-2010-2956
    2015-11-16
    oval:org.mitre.oval:def:12902
    P
    		USN-983-1 -- sudo vulnerability
    2014-06-30
    oval:org.mitre.oval:def:22912
    P
    		ELSA-2010:0675: sudo security update (Important)
    2014-05-26
    oval:org.mitre.oval:def:21401
    P
    		RHSA-2010:0675: sudo security update (Important)
    2014-02-24
    oval:org.mitre.oval:def:20122
    V
    		VMware ESX third party updates for Service Console packages glibc, sudo, and openldap
    2014-01-20
    oval:com.redhat.rhsa:def:20100675
    P
    		RHSA-2010:0675: sudo security update (Important)
    2010-09-07
    BACK
    todd_miller sudo 1.7.0
    todd_miller sudo 1.7.1
    todd_miller sudo 1.7.2
    todd_miller sudo 1.7.2p1
    todd_miller sudo 1.7.2p2
    todd_miller sudo 1.7.2p3
    todd_miller sudo 1.7.2p4
    todd_miller sudo 1.7.2p5
    todd_miller sudo 1.7.2p6
    todd_miller sudo 1.7.2p7
    todd_miller sudo 1.7.3b1
    todd_miller sudo 1.7.4
    todd_miller sudo 1.7.4p1
    todd_miller sudo 1.7.4p2
    todd_miller sudo 1.7.4p3