CVE-2010-2956: Medium severity Todd Miller Sudo vulnerability
A security flaw was found in the way Sudo performed matching for user described by a password against the list of members, allowed to run particular sudo command, when the group option was specified on the command line. If a local, unprivileged user was authorized by sudoers file to run their sudo commands with permissions of a particular group (different to their own), it could lead to privilege escalation (execution of that sudo command with permissions of privileged user account (root)).
Acknowledgements:
Red Hat would like to thank Markus Wuethrich of Swiss Post - PostFinance for reporting this issue.
Other sources
Sudo 1.7.0 through 1.7.4p3, when a Runas group is configured, does not properly handle use of the -u option in conjunction with the -g option, which allows local users to gain privileges via a command line containing a "-u root" sequence.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2956?
CVE-2010-2956 has been classified as a medium severity vulnerability.
How do I fix CVE-2010-2956?
To mitigate CVE-2010-2956, update your Sudo installation to the latest version that addresses this vulnerability.
Which versions of Sudo are affected by CVE-2010-2956?
CVE-2010-2956 affects Sudo versions 1.7.0, 1.7.1, 1.7.2, and 1.7.4 up to specific patch levels.
What type of attack does CVE-2010-2956 allow?
CVE-2010-2956 allows a local, unprivileged user to escalate privileges by exploiting misconfigured sudoers rules.
Is there a workaround for CVE-2010-2956?
As a temporary workaround for CVE-2010-2956, consider reviewing and restricting sudo permissions for unprivileged users.