CVE-2010-0426
published 2010-02-24CVE-2010-0426: sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of…
PriorityP426medium6.9CVSS 2.0
AVLACMAuNCCICAC
EPSS
1.13%
62.9th percentile
sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by a file named sudoedit in a user's home directory.
Affected
48 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | sudo | < sudo 1.7.2p1-1.2 (bookworm) | sudo 1.7.2p1-1.2 (bookworm) |
| debian | sudo | < sudo 1.7.2p6-1 (bookworm) | sudo 1.7.2p6-1 (bookworm) |
| sudo_project | sudo | >= 0 < 1.7.2p1-1.2 | 1.7.2p1-1.2 |
| sudo_project | sudo | >= 0 < 1.7.2p6-1 | 1.7.2p6-1 |
| sudo_project | sudo | >= 0 < 1.7.2p1-1.2 | 1.7.2p1-1.2 |
| sudo_project | sudo | >= 0 < 1.7.2p6-1 | 1.7.2p6-1 |
| sudo_project | sudo | >= 0 < 1.7.2p1-1.2 | 1.7.2p1-1.2 |
| sudo_project | sudo | >= 0 < 1.7.2p6-1 | 1.7.2p6-1 |
| sudo_project | sudo | >= 0 < 1.7.2p1-1.2 | 1.7.2p1-1.2 |
| sudo_project | sudo | >= 0 < 1.7.2p6-1 | 1.7.2p6-1 |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
CVSS provenance
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
osv6.9MEDIUM
vendor_debian6.9MEDIUM
vendor_redhat6.9MEDIUM
vendor_ubuntu6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9j25-f2ww-m5pf: sudo 1
ghsa_unreviewed·2022-05-03
CVE-2010-0426 [MEDIUM] GHSA-9j25-f2ww-m5pf: sudo 1
sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by a file named sudoedit in a user's home directory.
GHSA
GHSA-hh7m-2j26-qw2m: The command matching functionality in sudo 1
ghsa_unreviewed·2022-05-02·CVSS 6.9
CVE-2010-1163 [MEDIUM] CWE-20 GHSA-hh7m-2j26-qw2m: The command matching functionality in sudo 1
The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current working directory has the same name as a pseudo-command in the sudoers file and the PATH contains an entry for ".", which allows local users to execute arbitrary commands via a Trojan horse executable, as demonstrated using sudoedit, a different vulnerability than CVE-2010-0426.
OSV
CVE-2010-1163: The command matching functionality in sudo 1
osv·2010-04-16·CVSS 6.9
CVE-2010-1163 [MEDIUM] CVE-2010-1163: The command matching functionality in sudo 1
The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current working directory has the same name as a pseudo-command in the sudoers file and the PATH contains an entry for ".", which allows local users to execute arbitrary commands via a Trojan horse executable, as demonstrated using sudoedit, a different vulnerability than CVE-2010-0426.
OSV
CVE-2010-0426: sudo 1
osv·2010-02-24·CVSS 6.9
CVE-2010-0426 [MEDIUM] CVE-2010-0426: sudo 1
sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by a file named sudoedit in a user's home directory.
Ubuntu
Sudo vulnerability
vendor_ubuntu·2010-04-15·CVSS 6.9
[MEDIUM] Sudo vulnerability
Title: Sudo vulnerability
Summary: Sudo vulnerability
Valerio Costamagna discovered that sudo did not properly validate the path
for the 'sudoedit' pseudo-command when the PATH contained only a dot ('.').
If secure_path and ignore_dot were disabled, a local attacker could exploit
this to execute arbitrary code as root if sudo was configured to allow the
attacker to use sudoedit. By default, secure_path is used and the sudoedit
pseudo-command is not used in Ubuntu. This is a different but related issue
to CVE-2010-0426.
Instructions: In general, a standard system upgrade is sufficient to effect the
necessary changes.
Red Hat
sudo: incomplete fix for the sudoedit privilege escalation issue CVE-2010-0426
vendor_redhat·2010-04-13·CVSS 6.9
CVE-2010-1163 [MEDIUM] sudo: incomplete fix for the sudoedit privilege escalation issue CVE-2010-0426
sudo: incomplete fix for the sudoedit privilege escalation issue CVE-2010-0426
The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current working directory has the same name as a pseudo-command in the sudoers file and the PATH contains an entry for ".", which allows local users to execute arbitrary commands via a Trojan horse executable, as demonstrated using sudoedit, a different vulnerability than CVE-2010-0426.
Package: sudo (Red Hat Enterprise Linux 4) - Not affected
Package: sudo (Red Hat Enterprise Linux 6) - Not affected
Ubuntu
sudo vulnerabilities
vendor_ubuntu·2010-02-26·CVSS 6.9
CVE-2010-0426 [MEDIUM] sudo vulnerabilities
Title: sudo vulnerabilities
Summary: sudo vulnerabilities
It was discovered that sudo did not properly validate the path for the
'sudoedit' pseudo-command. A local attacker could exploit this to execute
arbitrary code as root if sudo was configured to allow the attacker to use
sudoedit. The sudoedit pseudo-command is not used in the default
installation of Ubuntu. (CVE-2010-0426)
It was discovered that sudo did not reset group permissions when the
'runas_default' configuration option was used. A local attacker could
exploit this to escalate group privileges if sudo was configured to allow
the attacker to run commands under the runas_default account. The
runas_default configuration option is not used in the default installation
of Ubuntu. This issue affected Ubuntu 8.04 LTS, 8.10 and 9.0
Red Hat
sudo: sudoedit option can possibly allow for arbitrary code execution
vendor_redhat·2010-02-21·CVSS 6.9
CVE-2010-0426 [MEDIUM] sudo: sudoedit option can possibly allow for arbitrary code execution
sudo: sudoedit option can possibly allow for arbitrary code execution
sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by a file named sudoedit in a user's home directory.
Statement: It did not affect the versions of the sudo package as shipped with Red Hat Enterprise Linux 3 and 4.
Debian
CVE-2010-0426: sudo - sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is en...
vendor_debian·2010·CVSS 6.9
CVE-2010-0426 [MEDIUM] CVE-2010-0426: sudo - sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is en...
sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by a file named sudoedit in a user's home directory.
Scope: local
bookworm: resolved (fixed in 1.7.2p1-1.2)
bullseye: resolved (fixed in 1.7.2p1-1.2)
forky: resolved (fixed in 1.7.2p1-1.2)
sid: resolved (fixed in 1.7.2p1-1.2)
trixie: resolved (fixed in 1.7.2p1-1.2)
Debian
CVE-2010-1163: sudo - The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not proper...
vendor_debian·2010·CVSS 6.9
CVE-2010-1163 [MEDIUM] CVE-2010-1163: sudo - The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not proper...
The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current working directory has the same name as a pseudo-command in the sudoers file and the PATH contains an entry for ".", which allows local users to execute arbitrary commands via a Trojan horse executable, as demonstrated using sudoedit, a different vulnerability than CVE-2010-0426.
Scope: local
bookworm: resolved (fixed in 1.7.2p6-1)
bullseye: resolved (fixed in 1.7.2p6-1)
forky: resolved (fixed in 1.7.2p6-1)
sid: resolved (fixed in 1.7.2p6-1)
trixie: resolved (fixed in 1.7.2p6-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2010-1163 sudo: incomplete fix for the sudoedit privilege escalation issue CVE-2010-0426
bugzilla·2010-04-08·CVSS 6.9
CVE-2010-1163 [MEDIUM] CVE-2010-1163 sudo: incomplete fix for the sudoedit privilege escalation issue CVE-2010-0426
CVE-2010-1163 sudo: incomplete fix for the sudoedit privilege escalation issue CVE-2010-0426
It was discovered that the original upstream fix for the sudo's sudoedit privilege escalation flaw known as CVE-2010-0426 (see bug #567337) did not fully resolve the issue. In configurations where sudo's ignore_dot option was set to off (default is on), the user allowed to sudoedit some file with the privileges of some user could run arbitrary command with the privileges of that user.
Acknowledgements:
Red Hat would like to thank Todd C. Miller, the upstream sudo maintainer, for responsibly reporting this issue. Upstream acknowledges Valerio Costamagna as the original reporter.
Discussion:
Created attachment 405247
Upstream patch
---
As with the original flaw, sudo versions in Red Hat Enterp
Bugzilla
CVE-2010-0426 sudo: sudoedit option can possibly allow for arbitrary code execution [Fedora all]
bugzilla·2010-02-23·CVSS 6.9
CVE-2010-0426 [MEDIUM] CVE-2010-0426 sudo: sudoedit option can possibly allow for arbitrary code execution [Fedora all]
CVE-2010-0426 sudo: sudoedit option can possibly allow for arbitrary code execution [Fedora all]
This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected Fedora versions.
For comments that are specific to the vulnerability please use bugs filed against "Security Response" product referenced in "Blocks" field.
bug #567337:
CVE-2010-0426 sudo: sudoedit option can possibly allow for arbitrary code execution
When creating a Bodhi update request, please include the bug IDs of the respective parent bugs filed against the "Security Response" product. Please mention CVE ids in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=567337
Ple
Bugzilla
CVE-2010-0426 sudo: sudoedit option can possibly allow for arbitrary code execution
bugzilla·2010-02-22·CVSS 6.9
CVE-2010-0426 [MEDIUM] CVE-2010-0426 sudo: sudoedit option can possibly allow for arbitrary code execution
CVE-2010-0426 sudo: sudoedit option can possibly allow for arbitrary code execution
It was reported [1] that sudoedit can allow for arbitrary code execution due to the sudoers configuration file not properly handling the special command name "sudoedit". In the sudoers file, the sudoedit special command is supposed to allow a user to use sudoedit to edit a specified file as another user (i.e. as an alias to sudo -e), however it can be abused to allow for the execution of arbitrary code.
In sudoers, defining something like: "user ALL=(ALL) sudoedit /etc/sysconfig/autofs" should grant the user the rights to edit /etc/sysconfig/autofs using the /usr/bin/sudoedit command or "sudo -e /etc/sysconfig/autofs", however:
% sudoedit /etc/sysconfig/autofs
[opens file in vim]
% sudoedit /etc/sysconfi
ftp://ftp.sudo.ws/pub/sudo/sudo-1.6.9p21.patch.gzhttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=570737http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040578.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-May/040588.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.htmlhttp://secunia.com/advisories/38659http://secunia.com/advisories/38762http://secunia.com/advisories/38795http://secunia.com/advisories/38803http://secunia.com/advisories/38915http://secunia.com/advisories/39399http://securitytracker.com/id?1023658http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.577019http://sudo.ws/bugs/show_bug.cgi?id=389http://sudo.ws/repos/sudo/rev/88f3181692fehttp://sudo.ws/repos/sudo/rev/f86e1b56d074http://wiki.rpath.com/Advisories:rPSA-2010-0075http://www.debian.org/security/2010/dsa-2006http://www.gentoo.org/security/en/glsa/glsa-201003-01.xmlhttp://www.linuxquestions.org/questions/linux-security-4/the-use-of-sudoedit-command-question-785442/http://www.mandriva.com/security/advisories?name=MDVSA-2010:049http://www.securityfocus.com/archive/1/514489/100/0/threadedhttp://www.securityfocus.com/bid/38362http://www.sudo.ws/sudo/stable.htmlhttp://www.ubuntu.com/usn/USN-905-1http://www.vupen.com/english/advisories/2010/0450http://www.vupen.com/english/advisories/2010/0949https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10814https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7238ftp://ftp.sudo.ws/pub/sudo/sudo-1.6.9p21.patch.gzhttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=570737http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040578.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-May/040588.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.htmlhttp://secunia.com/advisories/38659http://secunia.com/advisories/38762http://secunia.com/advisories/38795http://secunia.com/advisories/38803http://secunia.com/advisories/38915http://secunia.com/advisories/39399http://securitytracker.com/id?1023658http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.577019http://sudo.ws/bugs/show_bug.cgi?id=389http://sudo.ws/repos/sudo/rev/88f3181692fehttp://sudo.ws/repos/sudo/rev/f86e1b56d074http://wiki.rpath.com/Advisories:rPSA-2010-0075http://www.debian.org/security/2010/dsa-2006http://www.gentoo.org/security/en/glsa/glsa-201003-01.xmlhttp://www.linuxquestions.org/questions/linux-security-4/the-use-of-sudoedit-command-question-785442/http://www.mandriva.com/security/advisories?name=MDVSA-2010:049http://www.securityfocus.com/archive/1/514489/100/0/threadedhttp://www.securityfocus.com/bid/38362http://www.sudo.ws/sudo/stable.htmlhttp://www.ubuntu.com/usn/USN-905-1http://www.vupen.com/english/advisories/2010/0450http://www.vupen.com/english/advisories/2010/0949https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10814https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7238
2010-02-24
Published