check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gid change but no uid change, which allows local users to bypass an intended authentication requirement via the -g option to a sudo command.

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2011-0599 advisory.

    [1.7.4p5-5]
    - patch: log failed user role changes       Resolves: rhbz#665131

    [1.7.4p5-4]
    - added #includedir /etc/sudoers.d to sudoers       Resolves: rhbz#615087

    [1.7.4p5-3]
    - added !visiblepw option to sudoers       Resolves: rhbz#688640

    [1.7.4p5-2]
    - added patch for rhbz#665131       Resolves: rhbz#665131

    [1.7.4p5-1]
    - rebase to latest stable version
    - sudo now uses /var/db/sudo for timestamps
    - new command available: sudoreplay
    - use native audit support
    - sync configuration paths with the nss_ldap package       Resolves: rhbz#615087       Resolves: rhbz#652726       Resolves: rhbz#634159       Resolves: rhbz#603823

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has sudo packages installed that are affected by multiple vulnerabilities:

  - A certain Fedora patch for parse.c in sudo before 1.7.4p5-1.fc14 on Fedora 14 does not properly interpret     a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to     that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a     sudo command. NOTE: this vulnerability exists because of a CVE-2009-0034 regression. (CVE-2011-0008)

  - check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for     command execution that involves a gid change but no uid change, which allows local users to bypass an     intended authentication requirement via the -g option to a sudo command. (CVE-2011-0010)

  - Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to     execute arbitrary code via format string sequences in the program name for sudo. (CVE-2012-0809)

  - sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations     that use a netmask syntax, which allows local users to bypass intended command restrictions in     opportunistic circumstances by executing a command on a host that has an IPv4 address. (CVE-2012-2337)

  - sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate     attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting     the system clock and sudo user timestamp to the epoch. (CVE-2013-1775)

  - sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not     properly validate the controlling terminal device, which allows local users with sudo permissions to     hijack the authorization of another terminal via vectors related to connecting to the standard input,     output, and error file descriptors of another terminal. NOTE: this is one of three closely-related     vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different     affected versions. (CVE-2013-1776)

  - Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which     allows privilege escalation to root via sudoedit -s and a command-line argument that ends with a single     backslash character. (CVE-2021-3156)

  - A heap-based buffer overflow was found in the way sudo parses command line arguments. This flaw is     exploitable by any local user who can execute the sudo command without authentication. Successful     exploitation of this flaw could lead to privilege escalation.  (CVE-2021-3156)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has sudo packages installed that are affected by multiple vulnerabilities:

  - A certain Fedora patch for parse.c in sudo before 1.7.4p5-1.fc14 on Fedora 14 does not properly interpret     a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to     that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a     sudo command. NOTE: this vulnerability exists because of a CVE-2009-0034 regression. (CVE-2011-0008)

  - check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for     command execution that involves a gid change but no uid change, which allows local users to bypass an     intended authentication requirement via the -g option to a sudo command. (CVE-2011-0010)

  - Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to     execute arbitrary code via format string sequences in the program name for sudo. (CVE-2012-0809)

  - sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations     that use a netmask syntax, which allows local users to bypass intended command restrictions in     opportunistic circumstances by executing a command on a host that has an IPv4 address. (CVE-2012-2337)

  - sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate     attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting     the system clock and sudo user timestamp to the epoch. (CVE-2013-1775)

  - sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not     properly validate the controlling terminal device, which allows local users with sudo permissions to     hijack the authorization of another terminal via vectors related to connecting to the standard input,     output, and error file descriptors of another terminal. NOTE: this is one of three closely-related     vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different     affected versions. (CVE-2013-1776)

  - Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines)     in the get_process_ttyname() function resulting in information disclosure and command execution.
    (CVE-2017-1000368)

  - Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which     allows privilege escalation to root via sudoedit -s and a command-line argument that ends with a single     backslash character. (CVE-2021-3156)

  - A heap-based buffer overflow was found in the way sudo parses command line arguments. This flaw is     exploitable by any local user who can execute the sudo command without authentication. Successful     exploitation of this flaw could lead to privilege escalation.  (CVE-2021-3156)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has sudo packages installed that are affected by multiple vulnerabilities:

  - A certain Fedora patch for parse.c in sudo before 1.7.4p5-1.fc14 on Fedora 14 does not properly interpret     a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to     that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a     sudo command. NOTE: this vulnerability exists because of a CVE-2009-0034 regression. (CVE-2011-0008)

  - check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for     command execution that involves a gid change but no uid change, which allows local users to bypass an     intended authentication requirement via the -g option to a sudo command. (CVE-2011-0010)

  - Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to     execute arbitrary code via format string sequences in the program name for sudo. (CVE-2012-0809)

  - sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations     that use a netmask syntax, which allows local users to bypass intended command restrictions in     opportunistic circumstances by executing a command on a host that has an IPv4 address. (CVE-2012-2337)

  - sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate     attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting     the system clock and sudo user timestamp to the epoch. (CVE-2013-1775)

  - sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not     properly validate the controlling terminal device, which allows local users with sudo permissions to     hijack the authorization of another terminal via vectors related to connecting to the standard input,     output, and error file descriptors of another terminal. NOTE: this is one of three closely-related     vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different     affected versions. (CVE-2013-1776)

  - sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file,     which allows local users to open arbitrary files for read access (but not view file contents) by running a     program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log     messages, or repositioning tape drives. (CVE-2014-9680)

  - sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose     full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by /home/*/*/file.txt.
    (CVE-2015-5602)

  - sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run     via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to     run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary     commands with elevated privileges. (CVE-2016-7076)

  - Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in     the get_process_ttyname() function resulting in information disclosure and command execution.
    (CVE-2017-1000367)

  - ** DISPUTED ** In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can     impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user.
    NOTE: The software maintainer believes that this is not a vulnerability because running a command via sudo     as a user not present in the local password database is an intentional feature. Because this behavior     surprised some users, sudo 1.8.30 introduced an option to enable/disable this behavior with the default     being disabled. However, this does not change the fact that sudo was behaving as intended, and as     documented, in earlier versions. (CVE-2019-19232)

  - Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which     allows privilege escalation to root via sudoedit -s and a command-line argument that ends with a single     backslash character. (CVE-2021-3156)

  - A heap-based buffer overflow was found in the way sudo parses command line arguments. This flaw is     exploitable by any local user who can execute the sudo command without authentication. Successful     exploitation of this flaw could lead to privilege escalation.  (CVE-2021-3156)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update of sudo fixes :

  - CVE-2011-0010: Does ask for the user password for GID     changes now.

  - CVE-2010-1646: CVSS v2 Base Score: 6.6 (CWE-264): The     secure environment option can handle multiple occurrence     of PATH now.

  - CVE-2010-1163: CVSS v2 Base Score: 6.9 (CWE-20):
    Improved command matching.

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2012-0309 advisory.

    - added patch for CVE-2011-0010       Resolves: rhbz#757157

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root.

A flaw was found in the sudo password checking logic. In configurations where the sudoers settings allowed a user to run a command using sudo with only the group ID changed, sudo failed to prompt for the user's password before running the specified command with the elevated group privileges. (CVE-2011-0010)

In addition, this update fixes the following bugs :

  - A NULL pointer dereference bug caused the sudo utility     to terminate unexpectedly with a segmentation fault.
    This happened if the utility was run with the -g option     and configured not to demand the password from the user     who ran the sudo utility. With this update, the code has     been modified and the problem no longer occurs.

  - The sudo utility failed to load sudoers from an LDAP     (Lightweight Directory Access Protocol) server after the     sudo tool was upgraded. This happened because the     upgraded nsswitch.conf file did not contain the     instruction to search for sudoers on the LDAP server.
    This update adds the lost instruction to     /etc/nsswitch.conf and the system searches for sources     of sudoers on the local file system and then on LDAP, if     applicable.

  - The sudo tool interpreted a Runas alias specifying a     group incorrectly as a user alias and the alias seemed     to be ignored. With this update, the code for     interpreting such aliases has been modified and the     Runas group aliases are honored as expected.

  - Prior to this update, sudo did not parse comment     characters (#) in the ldap.conf file correctly and could     fail to work. With this update, parsing of the LDAP     configuration file has been modified and the comment     characters are parsed correctly.

  - The sudo utility formats its output to fit the width of     the terminal window. However, this behavior is     undesirable if the output is redirected through a     pipeline. With this update, the output formatting is not     applied in the scenario described.

  - Previously, the sudo utility performed Security-Enhanced     Linux (SELinux) related initialization after switching     to an unprivileged user. This prevented the correct     setup of the SELinux environment before executing the     specified command and could potentially cause an access     denial. The bug has been fixed by backporting the     SELinux related code and the execution model from a     newer version of sudo.

  - On execv(3) function failure, the sudo tool executed an     auditing call before reporting the failure. The call     reset the error state and, consequently, the tool     incorrectly reported that the command succeeded. With     this update, the code has been modified and the problem     no longer occurs.

All users of sudo are advised to upgrade to this updated package, which resolves these issues.

The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root.

A flaw was found in the sudo password checking logic. In configurations where the sudoers settings allowed a user to run a command using sudo with only the group ID changed, sudo failed to prompt for the user's password before running the specified command with the elevated group privileges. (CVE-2011-0010)

This update also fixes the following bugs :

  - When the '/etc/sudoers' file contained entries with     multiple hosts, running the 'sudo -l' command     incorrectly reported that a certain user does not have     permissions to use sudo on the system. With this update,     running the 'sudo -l' command now produces the correct     output. (BZ#603823)

  - Prior to this update, the manual page for sudoers.ldap     was not installed, even though it contains important     information on how to set up an LDAP (Lightweight     Directory Access Protocol) sudoers source, and other     documents refer to it. With this update, the manual page     is now properly included in the package. Additionally,     various POD files have been removed from the package, as     they are required for build purposes only. (BZ#634159)

  - The previous version of sudo did not use the same     location for the LDAP configuration files as the     nss_ldap package. This has been fixed and sudo now looks     for these files in the same location as the nss_ldap     package. (BZ#652726)

  - When a file was edited using the 'sudo -e file' or the     'sudoedit file' command, the editor being executed for     this task was logged only as 'sudoedit'. With this     update, the full path to the executable being used as an     editor is now logged (instead of 'sudoedit').
    (BZ#665131)

  - A comment regarding the 'visiblepw' option of the     'Defaults' directive has been added to the default     '/etc/sudoers' file to clarify its usage. (BZ#688640)

  - This erratum upgrades sudo to upstream version 1.7.4p5,     which provides a number of bug fixes and enhancements     over the previous version. (BZ#615087)

All users of sudo are advised to upgrade to this updated package, which resolves these issues.

The remote host is affected by the vulnerability described in GLSA-201203-06 (sudo: Privilege escalation)

    Two vulnerabilities have been discovered in sudo:
      When the sudoers file is configured with a Runas group, sudo does not         prompt for a password when changing to the new group (CVE-2011-0010).
      A format string vulnerability exists in the 'sudo_debug()' function         (CVE-2012-0809).
  Impact :

    A local attacker could possibly gain the ability to run arbitrary       commands with the privileges of other users or groups, including root.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 5 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2012:0309 advisory.

  - sudo: does not ask for password on GID changes (CVE-2011-0010)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An updated sudo package that fixes one security issue and several bugs is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root.

A flaw was found in the sudo password checking logic. In configurations where the sudoers settings allowed a user to run a command using sudo with only the group ID changed, sudo failed to prompt for the user's password before running the specified command with the elevated group privileges. (CVE-2011-0010)

This update also fixes the following bugs :

* When the '/etc/sudoers' file contained entries with multiple hosts, running the 'sudo -l' command incorrectly reported that a certain user does not have permissions to use sudo on the system. With this update, running the 'sudo -l' command now produces the correct output.
(BZ#603823)

* Prior to this update, the manual page for sudoers.ldap was not installed, even though it contains important information on how to set up an LDAP (Lightweight Directory Access Protocol) sudoers source, and other documents refer to it. With this update, the manual page is now properly included in the package. Additionally, various POD files have been removed from the package, as they are required for build purposes only. (BZ#634159)

* The previous version of sudo did not use the same location for the LDAP configuration files as the nss_ldap package. This has been fixed and sudo now looks for these files in the same location as the nss_ldap package. (BZ#652726)

* When a file was edited using the 'sudo -e file' or the 'sudoedit file' command, the editor being executed for this task was logged only as 'sudoedit'. With this update, the full path to the executable being used as an editor is now logged (instead of 'sudoedit'). (BZ#665131)

* A comment regarding the 'visiblepw' option of the 'Defaults' directive has been added to the default '/etc/sudoers' file to clarify its usage. (BZ#688640)

* This erratum upgrades sudo to upstream version 1.7.4p5, which provides a number of bug fixes and enhancements over the previous version. (BZ#615087)

All users of sudo are advised to upgrade to this updated package, which resolves these issues.

New sudo packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, 13.0, 13.1, and -current to fix a security issue.

Multiple vulnerabilities has been found and corrected in sudo :

A a patch for parse.c in sudo does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command. NOTE: this vulnerability exists because of a CVE-2009-0034 regression (CVE-2011-0008).

check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gid change but no uid change, which allows local users to bypass an intended authentication requirement via the -g option to a sudo command (CVE-2011-0010).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been upgraded to the latest versions (1.7.4p6) which is not affected by these issues.

- rebase to 1.7.4p5

    - fixed sudo-1.7.4p4-getgrouplist.patch

    - fixes CVE-2011-0008, CVE-2011-0010

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Alexander Kurtz discovered that sudo would not prompt for a password when a group was specified in the Runas_Spec. A local attacker could exploit this to execute arbitrary code as the specified group if sudo was configured to allow the attacker to use a program as this group.
The group Runas_Spec is not used in the default installation of Ubuntu.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Todd Miller reports :

Beginning with sudo version 1.7.0 it has been possible to grant permission to run a command using a specified group via sudo's -g option (run as group), if allowed by the sudoers file. A flaw exists in sudo's password checking logic that allows a user to run a command with only the group changed without being prompted for a password.

ID	Name	Product	Family	Severity
181074	Oracle Linux 6 : sudo (ELSA-2011-0599)	Nessus	Oracle Linux Local Security Checks	critical
160804	NewStart CGSL CORE 5.05 / MAIN 5.05 : sudo Multiple Vulnerabilities (NS-SA-2022-0028)	Nessus	NewStart CGSL Local Security Checks	high
154615	NewStart CGSL CORE 5.04 / MAIN 5.04 : sudo Multiple Vulnerabilities (NS-SA-2021-0101)	Nessus	NewStart CGSL Local Security Checks	high
154540	NewStart CGSL MAIN 6.02 : sudo Multiple Vulnerabilities (NS-SA-2021-0120)	Nessus	NewStart CGSL Local Security Checks	high
75751	openSUSE Security Update : sudo (openSUSE-SU-2011:0050-1)	Nessus	SuSE Local Security Checks	medium
68480	Oracle Linux 5 : sudo (ELSA-2012-0309)	Nessus	Oracle Linux Local Security Checks	critical
61271	Scientific Linux Security Update : sudo on SL5.x i386/x86_64 (20120221)	Nessus	Scientific Linux Local Security Checks	medium
61050	Scientific Linux Security Update : sudo on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
58216	GLSA-201203-06 : sudo: Privilege escalation	Nessus	Gentoo Local Security Checks	high
58063	RHEL 5 : sudo (RHSA-2012:0309)	Nessus	Red Hat Local Security Checks	critical
54596	RHEL 6 : sudo (RHSA-2011:0599)	Nessus	Red Hat Local Security Checks	medium
53801	openSUSE Security Update : sudo (openSUSE-SU-2011:0050-1)	Nessus	SuSE Local Security Checks	medium
51944	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / 8.1 / 9.0 / 9.1 / current : sudo (SSA:2011-041-05)	Nessus	Slackware Local Security Checks	medium
51809	Mandriva Linux Security Advisory : sudo (MDVSA-2011:018)	Nessus	Mandriva Local Security Checks	medium
51656	Fedora 13 : sudo-1.7.4p5-1.fc13 (2011-0455)	Nessus	Fedora Local Security Checks	medium
51643	Ubuntu 9.10 / 10.04 LTS / 10.10 : sudo vulnerability (USN-1046-1)	Nessus	Ubuntu Local Security Checks	medium
51566	Fedora 14 : sudo-1.7.4p5-1.fc14 (2011-0470)	Nessus	Fedora Local Security Checks	medium
51521	FreeBSD : sudo -- local privilege escalation (908f4cf2-1e8b-11e0-a587-001b77d09812)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2011-0010

critical

Tenable Plugins

critical

high

high

high

medium

critical

medium

medium

high

critical

medium

medium

medium

medium

medium

medium

medium

medium