parse.c in sudo 1.6.9p17 through 1.6.9p19 does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command.
References
Configurations
History
12 Jan 2024, 20:40
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-863 | |
CVSS |
v2 : v3 : |
v2 : 6.9
v3 : 7.8 |
First Time |
Vmware esx
Gratisoft sudo Gratisoft Vmware |
|
CPE | cpe:2.3:a:todd_miller:sudo:1.6.9_p18:*:*:*:*:*:*:* cpe:2.3:a:todd_miller:sudo:1.6.9_p19:*:*:*:*:*:*:* |
cpe:2.3:a:gratisoft:sudo:1.6.9:p18:*:*:*:*:*:* cpe:2.3:a:gratisoft:sudo:1.6.9:p17:*:*:*:*:*:* cpe:2.3:a:gratisoft:sudo:1.6.9:p19:*:*:*:*:*:* cpe:2.3:o:vmware:esx:4.0:*:*:*:*:*:*:* |
References | (SECUNIA) http://secunia.com/advisories/33840 - Not Applicable | |
References | (BID) http://www.securityfocus.com/bid/33517 - Broken Link, Third Party Advisory, VDB Entry | |
References | (BUGTRAQ) http://www.securityfocus.com/archive/1/500546/100/0/threaded - Broken Link, Third Party Advisory, VDB Entry | |
References | (OSVDB) http://osvdb.org/51736 - Broken Link | |
References | (CONFIRM) http://www.sudo.ws/cgi-bin/cvsweb/sudo/parse.c.diff?r1=1.160.2.21&r2=1.160.2.22&f=h - Broken Link | |
References | (SECTRACK) http://www.securitytracker.com/id?1021688 - Broken Link, Third Party Advisory, VDB Entry | |
References | (CONFIRM) https://bugzilla.novell.com/show_bug.cgi?id=468923 - Issue Tracking, Permissions Required | |
References | (CONFIRM) https://issues.rpath.com/browse/RPL-2954 - Broken Link | |
References | (MLIST) http://lists.vmware.com/pipermail/security-announce/2009/000060.html - Broken Link | |
References | (SECUNIA) http://secunia.com/advisories/33885 - Not Applicable | |
References | (CONFIRM) http://www.gratisoft.us/bugzilla/show_bug.cgi?id=327 - Product, Release Notes | |
References | (OVAL) https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6462 - Broken Link | |
References | (CONFIRM) http://www.vmware.com/security/advisories/VMSA-2009-0009.html - Third Party Advisory | |
References | (SECUNIA) http://secunia.com/advisories/35766 - Not Applicable | |
References | (OVAL) https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10856 - Broken Link | |
References | (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDVSA-2009:033 - Broken Link | |
References | (BUGTRAQ) http://www.securityfocus.com/archive/1/504849/100/0/threaded - Broken Link, Third Party Advisory, VDB Entry | |
References | (REDHAT) http://www.redhat.com/support/errata/RHSA-2009-0267.html - Not Applicable | |
References | (CONFIRM) http://wiki.rpath.com/Advisories:rPSA-2009-0021 - Broken Link | |
References | (SECUNIA) http://secunia.com/advisories/33753 - Not Applicable | |
References | (VUPEN) http://www.vupen.com/english/advisories/2009/1865 - Permissions Required |
Information
Published : 2009-01-30 19:30
Updated : 2024-02-28 11:21
NVD link : CVE-2009-0034
Mitre link : CVE-2009-0034
CVE.ORG link : CVE-2009-0034
JSON object : View
Products Affected
gratisoft
- sudo
vmware
- esx
CWE
CWE-863
Incorrect Authorization