CVE-2011-0010
- State
- Published
- Severity
- Not scored
- Published
- Jan 18, 2011
- Updated
- Aug 6, 2024
- Reserved
- Dec 7, 2010
Description
check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gid change but no uid change, which allows local users to bypass an intended authentication requirement via the -g option to a sudo command.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- ADV-2011-0362vdb-entry
- http://www.sudo.ws/sudo/alerts/runas_group_pw.html
- 43068third-party-advisory
- GLSA-201203-06vendor-advisory
- SSA:2011-041-05vendor-advisory
- MDVSA-2011:018vendor-advisory
- http://www.sudo.ws/repos/sudo/rev/07d1b0ce530e
- ADV-2011-0089vdb-entry
- ADV-2011-0212vdb-entry
- 42949third-party-advisory
- [oss-security] 20110111 CVE request: sudo does not ask for password on GID changesmailing-list
- ADV-2011-0182vdb-entry
- FEDORA-2011-0470vendor-advisory
- ADV-2011-0199vdb-entry
- USN-1046-1vendor-advisory
- RHSA-2011:0599vendor-advisory
- [oss-security] 20110112 Re: CVE request: sudo does not ask for password on GID changesmailing-list
- 70400vdb-entry
- 42886third-party-advisory
- SUSE-SR:2011:002vendor-advisory
- sudo-groupid-privilege-escalation(64636)vdb-entry
- 45774vdb-entry
- [oss-security] 20110112 Re: CVE request: sudo does not ask for password on GID changesmailing-list
- 43282third-party-advisory
- FEDORA-2011-0455vendor-advisory
- http://www.sudo.ws/repos/sudo/rev/fe8a94f96542
- ADV-2011-0195vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=668879
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=609641
- 42968third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.