PT-2010-1084 · Todd Miller+1 · Sudo+1

Published 2010-09-07 · Updated 2018-10-10 · CVE-2010-2956

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Medium

Base vector

AV:L/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sudo versions 1.7.0 through 1.7.4p3

Description The issue allows local users to gain privileges via a command line containing a "-u root" sequence, potentially leading to disruption of confidentiality, integrity, and availability of protected information. The exploitation can be carried out locally.

Recommendations For Sudo versions 1.7.0 through 1.7.4p3, consider updating to a version newer than 1.7.4p3 to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific vulnerability.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-09416

CVE-2010-2956

RHSA-2010:0675

RHSA-2010_0675

Affected Products

Red Hat

Sudo

References · 29

• http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201009-03.xml · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2010-0675.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2010:175 · Vendor Advisory
• http://secunia.com/advisories/40508 · Vendor Advisory
• http://sudo.ws/sudo/alerts/runas_group.html · Vendor Advisory
• http://secunia.com/advisories/41316 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047516.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09416 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-2956 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2956 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2010-2956 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-2956 · Vendor Advisory
• http://ubuntu.com/usn/USN-983-1 · Vendor Advisory
• http://vupen.com/english/advisories/2010/2318 · Note