NVD

Id
14387  
Name
CVE-2010-2956  
Description
Sudo 1.7.0 through 1.7.4p3, when a Runas group is configured, does not properly handle use of the -u option in conjunction with the -g option, which allows local users to gain privileges via a command line containing a "-u root" sequence.  
Reject
 
CVSS Version
2  
CVSS Score
6.2  
Severity
Medium  
CVSS Base Score
6.2  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
1.9  
CVSS Vector
(AV:L/AC:H/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-18  
Published
2010-09-10  
Modified Date
2011-01-21  
Seq
2010-2956  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
79676 14387 CVE-2010-2956 FEDORA-2010-14355  View
79677 14387 CVE-2010-2956 SUSE-SR:2010:017  View
79678 14387 CVE-2010-2956 GLSA-201009-03  View
79679 14387 CVE-2010-2956 http://wiki.rpath.com/Advisories:rPSA-2010-0075  View
79680 14387 CVE-2010-2956 MDVSA-2010:175  View
79681 14387 CVE-2010-2956 RHSA-2010:0675  View
79682 14387 CVE-2010-2956 20101027 rPSA-2010-0075-1 sudo  View
79683 14387 CVE-2010-2956 20110105 VMSA-2011-0001 VMware ESX third party updates for Service Console packages glibc, sudo, and openldap  View
79684 14387 CVE-2010-2956 43019  View
79685 14387 CVE-2010-2956 1024392  View
79686 14387 CVE-2010-2956 http://www.sudo.ws/sudo/alerts/runas_group.html  View
79687 14387 CVE-2010-2956 USN-983-1  View
79688 14387 CVE-2010-2956 http://www.vmware.com/security/advisories/VMSA-2011-0001.html  View
79689 14387 CVE-2010-2956 ADV-2010-2312  View
79690 14387 CVE-2010-2956 ADV-2010-2318  View
79691 14387 CVE-2010-2956 ADV-2010-2320  View
79692 14387 CVE-2010-2956 ADV-2010-2358  View
79693 14387 CVE-2010-2956 ADV-2011-0025  View
79694 14387 CVE-2010-2956 https://bugzilla.redhat.com/show_bug.cgi?id=628628  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
36279 JVNDB-2010-002059 sudo における権限昇格の脆弱性 sudo には、Runas グループが設定される際、-u と -g オプションのマッチング処理を適切に行わないため、権限を取得される脆弱性が存在します。 CVE-2010-2956 45536 CVE-2010-2956 14387 6.2 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-002059.html 2010-09-07 2011-01-14 View