vulnerability note CVE-2010-0427

sudo: group elevation

Synthesis of the vulnerability

When the /etc/sudoers file contains "runas_default", a local attacker can execute a command with privileges of root's groups.

Severity: 2/4. Creation date: 23/02/2010.

Description of the vulnerability

The "runas_default" directive of the /etc/sudoers file defines a default user. For example, if the file contains:   Defaults runas_default=test the user can enter:   sudo command instead of:   sudo -u test command However, when this option is used, the user stays a member of root's groups (root, bin, daemon, sys, adm, disk, wheel), instead of becoming a member of groups of user "test". When the /etc/sudoers file contains "runas_default", a local attacker can therefore execute a command with privileges of root's groups.

Complete Vigil@nce bulletin

Access to the complete Vigil@nce bulletin

Characteristics

Title: sudo: group elevation. Keywords: Defaults elevation group runas_default sudo. Identifiers: CVE-2010-0427, DSA 2006-1, MDVSA-2010:052, RHSA-2010:0122-01, SUSE-SR:2010:006, VIGILANCE-VUL-9469, VMSA-2010-0009, VMSA-2010-0009.1.

Information sources

Publications and announces Source example: Bug 349 - stray groups available if runas_default set

Solutions for this vulnerability

Patch or workaround

Computer vulnerabilities tracking service

The Vigil@nce computer vulnerability tracking service alerts your teams of vulnerabilities or threats impacting your information system.
The Vigil@nce vulnerability database contains several thousand vulnerabilities.
This bulletin is published by the Vigil@nce team, which tracks computer vulnerabilities impacting systems and applications.
Security vulnerability alerts