NVD

Id
11982  
Name
CVE-2010-0426  
Description
sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by a file named sudoedit in a user"s home directory.  
Reject
 
CVSS Version
2  
CVSS Score
6.9  
Severity
Medium  
CVSS Base Score
6.9  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-18  
Published
2010-02-24  
Modified Date
2011-01-21  
Seq
2010-0426  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
66063 11982 CVE-2010-0426 ftp://ftp.sudo.ws/pub/sudo/sudo-1.6.9p21.patch.gz  View
66064 11982 CVE-2010-0426 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=570737  View
66065 11982 CVE-2010-0426 FEDORA-2010-6701  View
66066 11982 CVE-2010-0426 FEDORA-2010-6749  View
66067 11982 CVE-2010-0426 SUSE-SR:2010:006  View
66068 11982 CVE-2010-0426 oval:org.mitre.oval:def:10814  View
66069 11982 CVE-2010-0426 oval:org.mitre.oval:def:7238  View
66070 11982 CVE-2010-0426 1023658  View
66071 11982 CVE-2010-0426 SSA:2010-110-01  View
66072 11982 CVE-2010-0426 http://sudo.ws/bugs/show_bug.cgi?id=389  View
66073 11982 CVE-2010-0426 http://sudo.ws/repos/sudo/rev/88f3181692fe  View
66074 11982 CVE-2010-0426 http://sudo.ws/repos/sudo/rev/f86e1b56d074  View
66075 11982 CVE-2010-0426 http://wiki.rpath.com/Advisories:rPSA-2010-0075  View
66076 11982 CVE-2010-0426 DSA-2006  View
66077 11982 CVE-2010-0426 GLSA-201003-01  View
66078 11982 CVE-2010-0426 http://www.linuxquestions.org/questions/linux-security-4/the-use-of-sudoedit-command-question-785442/  View
66079 11982 CVE-2010-0426 MDVSA-2010:049  View
66080 11982 CVE-2010-0426 20101027 rPSA-2010-0075-1 sudo  View
66081 11982 CVE-2010-0426 38362  View
66082 11982 CVE-2010-0426 http://www.sudo.ws/sudo/stable.html  View
66083 11982 CVE-2010-0426 USN-905-1  View
66084 11982 CVE-2010-0426 ADV-2010-0450  View
66085 11982 CVE-2010-0426 ADV-2010-0949  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
35368 JVNDB-2010-001148 sudo における権限昇格の脆弱性 sudo には、pseudo-command を有効にしている場合、pseudo-command の名前と任意のディレクトリ内の実行ファイル名のマッチングが許容されるため、権限を取得される脆弱性が存在します。 CVE-2010-0426 43006 CVE-2010-0426 11982 6.9 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001148.html 2010-02-24 2010-05-21 View