CVE - CVE-2010-0426

CVE-ID
CVE-2010-0426	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by a file named sudoedit in a user's home directory.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:38362 URL:http://www.securityfocus.com/bid/38362 BUGTRAQ:20101027 rPSA-2010-0075-1 sudo URL:http://www.securityfocus.com/archive/1/514489/100/0/threaded CONFIRM:ftp://ftp.sudo.ws/pub/sudo/sudo-1.6.9p21.patch.gz CONFIRM:http://sudo.ws/bugs/show_bug.cgi?id=389 CONFIRM:http://sudo.ws/repos/sudo/rev/88f3181692fe CONFIRM:http://sudo.ws/repos/sudo/rev/f86e1b56d074 CONFIRM:http://wiki.rpath.com/Advisories:rPSA-2010-0075 CONFIRM:http://www.sudo.ws/sudo/stable.html DEBIAN:DSA-2006 URL:http://www.debian.org/security/2010/dsa-2006 FEDORA:FEDORA-2010-6701 URL:http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040578.html FEDORA:FEDORA-2010-6749 URL:http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040588.html GENTOO:GLSA-201003-01 URL:http://www.gentoo.org/security/en/glsa/glsa-201003-01.xml MANDRIVA:MDVSA-2010:049 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2010:049 MISC:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=570737 MISC:http://www.linuxquestions.org/questions/linux-security-4/the-use-of-sudoedit-command-question-785442/ OVAL:oval:org.mitre.oval:def:10814 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10814 OVAL:oval:org.mitre.oval:def:7238 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7238 SECTRACK:1023658 URL:http://securitytracker.com/id?1023658 SECUNIA:38659 URL:http://secunia.com/advisories/38659 SECUNIA:38762 URL:http://secunia.com/advisories/38762 SECUNIA:38795 URL:http://secunia.com/advisories/38795 SECUNIA:38803 URL:http://secunia.com/advisories/38803 SECUNIA:38915 URL:http://secunia.com/advisories/38915 SECUNIA:39399 URL:http://secunia.com/advisories/39399 SLACKWARE:SSA:2010-110-01 URL:http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.577019 SUSE:SUSE-SR:2010:006 URL:http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html UBUNTU:USN-905-1 URL:http://www.ubuntu.com/usn/USN-905-1 VUPEN:ADV-2010-0450 URL:http://www.vupen.com/english/advisories/2010/0450 VUPEN:ADV-2010-0949 URL:http://www.vupen.com/english/advisories/2010/0949
Assigning CNA
Red Hat, Inc.
Date Entry Created
20100127	Disclaimer: The entry creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20100127)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an entry on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select “Other” from dropdown)

Use of the Common Vulnerabilities and Exposures (CVE®) List and the associated references from this website are subject to the terms of use. CVE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Copyright © 1999–2019, The MITRE Corporation. CVE and the CVE logo are registered trademarks of The MITRE Corporation.