CVE-2010-2956

Publication date 31 August 2010

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Sudo 1.7.0 through 1.7.4p3, when a Runas group is configured, does not properly handle use of the -u option in conjunction with the -g option, which allows local users to gain privileges via a command line containing a "-u root" sequence.

Read the notes from the security team

Status

Package Ubuntu Release Status
sudo 10.04 LTS lucid
Fixed 1.7.2p1-1ubuntu5.2
9.10 karmic
Fixed 1.7.0-1ubuntu2.5
9.04 jaunty
Not affected
8.04 LTS hardy
Not affected
6.06 LTS dapper
Not affected

Notes

jdstrand

root escalation, but requires non-standard sudoers setup sudo 1.6 is not affected (does not have '-g' option)

References

Related Ubuntu Security Notices (USN)

    • USN-983-1
    • Sudo vulnerability
    • 7 September 2010

Other references