RHSA-2009:0267: Moderate: sudo security update
The sudo (superuser do) utility allows system administrators to givecertain users the ability to run commands as root with logging.A flaw was discovered in a way sudo handled group specifications in "runas" lists in the sudoers configuration file. If sudo configuration alloweda user to run commands as any user of some group and the user was also amember of that group, sudo incorrectly allowed them to run defined commandswith the privileges of any system user. This gave the user unintendedprivileges. (CVE-2009-0034)Users of sudo should update to this updated package, which contains abackported patch to resolve this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2009:0267?
The severity of RHSA-2009:0267 is classified as moderate.
Which versions of sudo are affected by RHSA-2009:0267?
RHSA-2009:0267 affects sudo versions prior to 1.6.9p17-3.el5_3.1.
How do I fix RHSA-2009:0267?
To fix RHSA-2009:0267, update sudo to version 1.6.9p17-3.el5_3.1 or later.
What type of vulnerability is described in RHSA-2009:0267?
RHSA-2009:0267 describes a flaw in the way sudo handles group specifications in the sudoers configuration.
What are the potential impacts of RHSA-2009:0267?
The potential impact of RHSA-2009:0267 includes unauthorized command execution as root if the sudo configuration is exploited.