NVD

Id
12696  
Name
CVE-2010-1163  
Description
The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current working directory has the same name as a pseudo-command in the sudoers file and the PATH contains an entry for ".", which allows local users to execute arbitrary commands via a Trojan horse executable, as demonstrated using sudoedit, a different vulnerability than CVE-2010-0426.  
Reject
 
CVSS Version
2  
CVSS Score
6.9  
Severity
Medium  
CVSS Base Score
6.9  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-18  
Published
2010-04-16  
Modified Date
2011-02-17  
Seq
2010-1163  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
69751 12696 CVE-2010-1163 FEDORA-2010-6756  View
69752 12696 CVE-2010-1163 SUSE-SR:2011:002  View
69753 12696 CVE-2010-1163 oval:org.mitre.oval:def:9382  View
69754 12696 CVE-2010-1163 SSA:2010-110-01  View
69755 12696 CVE-2010-1163 http://wiki.rpath.com/Advisories:rPSA-2010-0075  View
69756 12696 CVE-2010-1163 MDVSA-2010:078  View
69757 12696 CVE-2010-1163 RHSA-2010:0361  View
69758 12696 CVE-2010-1163 20100419 sudoedit local privilege escalation through PATH manipulation  View
69759 12696 CVE-2010-1163 20100420 Re: sudoedit local privilege escalation through PATH manipulation  View
69760 12696 CVE-2010-1163 20100422 Re: sudoedit local privilege escalation through PATH manipulation  View
69761 12696 CVE-2010-1163 20101027 rPSA-2010-0075-1 sudo  View
69762 12696 CVE-2010-1163 39468  View
69763 12696 CVE-2010-1163 http://www.sudo.ws/sudo/alerts/sudoedit_escalate2.html  View
69764 12696 CVE-2010-1163 USN-928-1  View
69765 12696 CVE-2010-1163 ADV-2010-0881  View
69766 12696 CVE-2010-1163 ADV-2010-0895  View
69767 12696 CVE-2010-1163 ADV-2010-0904  View
69768 12696 CVE-2010-1163 ADV-2010-0949  View
69769 12696 CVE-2010-1163 ADV-2010-0956  View
69770 12696 CVE-2010-1163 ADV-2010-1019  View
69771 12696 CVE-2010-1163 ADV-2011-0212  View
69772 12696 CVE-2010-1163 sudo-sudoefit-privilege-escalation(57836)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
35672 JVNDB-2010-001452 sudo における任意のコマンドを実行される脆弱性 sudo の command matching 機能には、カレントワーキングディレクトリのファイルに sudoers ファイルのコマンドと同じファイル名がある際の処理に不備があるため、任意のコマンドを実行される脆弱性が存在します。 CVE-2010-1163 43743 CVE-2010-1163 12696 6.9 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001452.html 2010-04-16 2010-09-08 View