CVE-2011-0008

Related Files

Mandriva Linux Security Advisory 2011-018

Posted Jan 21, 2011

Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2011-018 - A patch for parse.c in sudo does not properly interpret a system group in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command. NOTE: this vulnerability exists because of a CVE-2009-0034 regression. check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gid change but no uid change, which allows local users to bypass an intended authentication requirement via the -g option to a sudo command.

tags | advisory, local, root

systems | linux, mandriva

advisories | CVE-2011-0008, CVE-2011-0010

SHA-256 | d8fd379e68953f4a687be7bb6ecff5da28e252ae6870a740003011ee2ac4751e

Download | Favorite | View