CVE-2011-0010: Medium severity sudo vulnerability
A Debian bug report [1] indicated that sudo would not ask for a user's password on GID changes, when it should be asking on both UID and GID changes. Normally, sudo does not allow users to change the GID only, but this can be changed by modifying /etc/sudoers to a non-default configuration, such as:
%group ALL=(ALL:ALL) ALL
rather than the more traditional:
%group ALL=(ALL) ALL
If you change the UID with sudo, you are asked for the user's password (unless NOPASSWD is specified), but this is not the case for GID changing:
$ sudo -l [sudo] password for vdanen: Matching Defaults entries for vdanen on this host: requiretty, alwayssethome, envreset, envkeep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LSCOLORS", envkeep+="MAIL PS1 PS2 QTDIR USERNAME LANG LCADDRESS LCCTYPE", envkeep+="LCCOLLATE LCIDENTIFICATION LCMEASUREMENT LCMESSAGES", envkeep+="LCMONETARY LCNAME LCNUMERIC LCPAPER LCTELEPHONE", envkeep+="LCTIME LCALL LANGUAGE LINGUAS XKBCHARSET XAUTHORITY", securepath=/sbin\:/bin\:/usr/sbin\:/usr/bin
User vdanen may run the following commands on this host: (ALL : ALL) ALL $ sudo -g mygroup id uid=1001(vdanen) gid=504(mygroup) groups=1001(vdanen),504(mygroup) $ sudo -k $ sudo -g sudo id uid=1001(vdanen) gid=504(mygroup) groups=1001(vdanen),504(mygroup) $ sudo -k $ sudo -u root id [sudo] password for vdanen: uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
Upstream has corrected this issue upstream [2],[3].
Note that the "ALL:ALL" specification is not valid syntax for sudo 1.6.7p5 as shipped with Red Hat Enterprise Linux 4.
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=609641 [2] http://www.sudo.ws/repos/sudo/rev/fe8a94f96542 [3] http://www.sudo.ws/repos/sudo/rev/07d1b0ce530e
Other sources
check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gid change but no uid change, which allows local users to bypass an intended authentication requirement via the -g option to a sudo command.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-0010?
CVE-2011-0010 is considered to have a medium severity due to potential unauthorized privilege escalation.
How do I fix CVE-2011-0010?
To fix CVE-2011-0010, update the sudo package to a version that is not vulnerable, such as any version after 1.7.4p4.
Which versions of sudo are affected by CVE-2011-0010?
CVE-2011-0010 affects sudo versions 1.7.0, 1.7.1, 1.7.2*, and 1.7.4 up to 1.7.4p4.
What is the workaround for CVE-2011-0010 if I cannot update sudo immediately?
A temporary workaround for CVE-2011-0010 is to configure sudoers to restrict the ability to change groups without requiring a password.
How was CVE-2011-0010 discovered?
CVE-2011-0010 was discovered through a bug report indicating that sudo did not prompt for a password in certain group ID change scenarios.