- Vulnerability/
- RHSA-2010:0122
RHSA-2010:0122: Important: sudo security update
First published: Fri Feb 26 2010(Updated: )
The sudo (superuser do) utility allows system administrators to give<br>certain users the ability to run commands as root.<br>A privilege escalation flaw was found in the way sudo handled the sudoedit<br>pseudo-command. If a local user were authorized by the sudoers file to use<br>this pseudo-command, they could possibly leverage this flaw to execute<br>arbitrary code with the privileges of the root user. (CVE-2010-0426)<br>The sudo utility did not properly initialize supplementary groups when the<br>"runas_default" option (in the sudoers file) was used. If a local user<br>were authorized by the sudoers file to perform their sudo commands under<br>the account specified with "runas_default", they would receive the root<br>user's supplementary groups instead of those of the intended target user,<br>giving them unintended privileges. (CVE-2010-0427)<br>Users of sudo should upgrade to this updated package, which contains<br>backported patches to correct these issues.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/sudo | <1.6.9p17-6.el5_4 | 1.6.9p17-6.el5_4 |
| redhat/sudo | <1.6.9p17-6.el5_4 | 1.6.9p17-6.el5_4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of RHSA-2010:0122?
The severity of RHSA-2010:0122 is classified as important due to the privilege escalation flaw in sudo.
How do I fix RHSA-2010:0122?
To fix RHSA-2010:0122, you need to update the sudo package to version 1.6.9p17-6.el5_4.
Who is affected by RHSA-2010:0122?
Users who have authorized local accounts in the sudoers file on affected systems are vulnerable to RHSA-2010:0122.
What is the risk if RHSA-2010:0122 is not addressed?
If RHSA-2010:0122 is not addressed, local users could exploit the vulnerability to escalate their privileges and gain root access.
Which software versions are vulnerable to RHSA-2010:0122?
Sudo versions prior to 1.6.9p17-6.el5_4 on Red Hat Enterprise Linux 5 are vulnerable to RHSA-2010:0122.
- agent/severity
- agent/references
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- collector/redhat-errata
- source/Red Hat
- anchor-id/RHSA-2010:0122
- agent/software-canonical-lookup
- agent/remedy
- agent/title
- agent/description
- agent/event
- agent/trending
- agent/tags
- agent/source
- package-manager/redhat