CVE-2011-0010
First published: Tue Jan 11 2011(Updated: )
A Debian bug report [1] indicated that sudo would not ask for a user's password on GID changes, when it should be asking on both UID and GID changes. Normally, sudo does not allow users to change the GID only, but this can be changed by modifying /etc/sudoers to a non-default configuration, such as: %group ALL=(ALL:ALL) ALL rather than the more traditional: %group ALL=(ALL) ALL If you change the UID with sudo, you are asked for the user's password (unless NOPASSWD is specified), but this is not the case for GID changing: $ sudo -l [sudo] password for vdanen: Matching Defaults entries for vdanen on this host: requiretty, always_set_home, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin User vdanen may run the following commands on this host: (ALL : ALL) ALL $ sudo -g mygroup id uid=1001(vdanen) gid=504(mygroup) groups=1001(vdanen),504(mygroup) $ sudo -k $ sudo -g sudo id uid=1001(vdanen) gid=504(mygroup) groups=1001(vdanen),504(mygroup) $ sudo -k $ sudo -u root id [sudo] password for vdanen: uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) Upstream has corrected this issue upstream [2],[3]. Note that the "ALL:ALL" specification is not valid syntax for sudo 1.6.7p5 as shipped with Red Hat Enterprise Linux 4. [1] <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=609641">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=609641</a> [2] <a href="http://www.sudo.ws/repos/sudo/rev/fe8a94f96542">http://www.sudo.ws/repos/sudo/rev/fe8a94f96542</a> [3] <a href="http://www.sudo.ws/repos/sudo/rev/07d1b0ce530e">http://www.sudo.ws/repos/sudo/rev/07d1b0ce530e</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Todd Miller Sudo | =1.7.2p4 | |
| Todd Miller Sudo | =1.7.0 | |
| Todd Miller Sudo | =1.7.4p2 | |
| Todd Miller Sudo | =1.7.1 | |
| Todd Miller Sudo | =1.7.2p2 | |
| Todd Miller Sudo | =1.7.2p7 | |
| Todd Miller Sudo | =1.7.2 | |
| Todd Miller Sudo | =1.7.4 | |
| Todd Miller Sudo | =1.7.4p3 | |
| Todd Miller Sudo | =1.7.3b1 | |
| Todd Miller Sudo | =1.7.2p1 | |
| Todd Miller Sudo | =1.7.2p3 | |
| Todd Miller Sudo | =1.7.4p4 | |
| Todd Miller Sudo | =1.7.2p5 | |
| Todd Miller Sudo | =1.7.4p1 | |
| Todd Miller Sudo | =1.7.2p6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.sudo.ws/sudo/alerts/runas_group_pw.html
- http://www.vupen.com/english/advisories/2011/0089
- http://openwall.com/lists/oss-security/2011/01/12/3
- https://bugzilla.redhat.com/show_bug.cgi?id=668879
- http://www.osvdb.org/70400
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=609641
- http://www.securityfocus.com/bid/45774
- http://openwall.com/lists/oss-security/2011/01/12/1
- http://www.sudo.ws/repos/sudo/rev/07d1b0ce530e
- http://secunia.com/advisories/42886
- http://openwall.com/lists/oss-security/2011/01/11/3
- http://www.sudo.ws/repos/sudo/rev/fe8a94f96542
- http://secunia.com/advisories/42949
- http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053263.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:018
- http://secunia.com/advisories/42968
- http://www.ubuntu.com/usn/USN-1046-1
- http://www.vupen.com/english/advisories/2011/0182
- http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053341.html
- http://www.vupen.com/english/advisories/2011/0199
- http://www.vupen.com/english/advisories/2011/0195
- http://www.vupen.com/english/advisories/2011/0362
- http://secunia.com/advisories/43282
- http://www.vupen.com/english/advisories/2011/0212
- http://secunia.com/advisories/43068
- http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.593654
- http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
- http://www.redhat.com/support/errata/RHSA-2011-0599.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/64636
- http://security.gentoo.org/glsa/glsa-201203-06.xml
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=669472
- https://rhn.redhat.com/errata/RHSA-2011-0599.html
- https://rhn.redhat.com/errata/RHSA-2012-0309.html
- collector/nvd-historical
- collector/nvd-index
- agent/references
- agent/severity
- agent/author
- agent/weakness
- agent/type
- agent/description
- agent/event
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-0010
- vendor/todd miller
- canonical/todd miller sudo
- version/todd miller sudo/1.7.2p4
- version/todd miller sudo/1.7.0
- version/todd miller sudo/1.7.4p2
- version/todd miller sudo/1.7.1
- version/todd miller sudo/1.7.2p2
- version/todd miller sudo/1.7.2p7
- version/todd miller sudo/1.7.2
- version/todd miller sudo/1.7.4
- version/todd miller sudo/1.7.4p3
- version/todd miller sudo/1.7.3b1
- version/todd miller sudo/1.7.2p1
- version/todd miller sudo/1.7.2p3
- version/todd miller sudo/1.7.4p4
- version/todd miller sudo/1.7.2p5
- version/todd miller sudo/1.7.4p1
- version/todd miller sudo/1.7.2p6