CVE-2009-0034

parse.c in sudo 1.6.9p17 through 1.6.9p19 does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command.
References
Link Resource
http://lists.vmware.com/pipermail/security-announce/2009/000060.html Broken Link
http://osvdb.org/51736 Broken Link
http://secunia.com/advisories/33753 Not Applicable
http://secunia.com/advisories/33840 Not Applicable
http://secunia.com/advisories/33885 Not Applicable
http://secunia.com/advisories/35766 Not Applicable
http://wiki.rpath.com/Advisories:rPSA-2009-0021 Broken Link
http://www.gratisoft.us/bugzilla/show_bug.cgi?id=327 Product Release Notes
http://www.mandriva.com/security/advisories?name=MDVSA-2009:033 Broken Link
http://www.redhat.com/support/errata/RHSA-2009-0267.html Not Applicable
http://www.securityfocus.com/archive/1/500546/100/0/threaded Broken Link Third Party Advisory VDB Entry
http://www.securityfocus.com/archive/1/504849/100/0/threaded Broken Link Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/33517 Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1021688 Broken Link Third Party Advisory VDB Entry
http://www.sudo.ws/cgi-bin/cvsweb/sudo/parse.c.diff?r1=1.160.2.21&r2=1.160.2.22&f=h Broken Link
http://www.vmware.com/security/advisories/VMSA-2009-0009.html Third Party Advisory
http://www.vupen.com/english/advisories/2009/1865 Permissions Required
https://bugzilla.novell.com/show_bug.cgi?id=468923 Issue Tracking Permissions Required
https://issues.rpath.com/browse/RPL-2954 Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10856 Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6462 Broken Link
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gratisoft:sudo:1.6.9:p17:*:*:*:*:*:*
cpe:2.3:a:gratisoft:sudo:1.6.9:p18:*:*:*:*:*:*
cpe:2.3:a:gratisoft:sudo:1.6.9:p19:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:vmware:esx:4.0:*:*:*:*:*:*:*

History

12 Jan 2024, 20:40

Type Values Removed Values Added
CWE CWE-264 CWE-863
CVSS v2 : 6.9
v3 : unknown
v2 : 6.9
v3 : 7.8
First Time Vmware esx
Gratisoft sudo
Gratisoft
Vmware
CPE cpe:2.3:a:todd_miller:sudo:1.6.9_p17:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.9_p18:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.9_p19:*:*:*:*:*:*:*
cpe:2.3:a:gratisoft:sudo:1.6.9:p18:*:*:*:*:*:*
cpe:2.3:a:gratisoft:sudo:1.6.9:p17:*:*:*:*:*:*
cpe:2.3:a:gratisoft:sudo:1.6.9:p19:*:*:*:*:*:*
cpe:2.3:o:vmware:esx:4.0:*:*:*:*:*:*:*
References (SECUNIA) http://secunia.com/advisories/33840 - (SECUNIA) http://secunia.com/advisories/33840 - Not Applicable
References (BID) http://www.securityfocus.com/bid/33517 - (BID) http://www.securityfocus.com/bid/33517 - Broken Link, Third Party Advisory, VDB Entry
References (BUGTRAQ) http://www.securityfocus.com/archive/1/500546/100/0/threaded - (BUGTRAQ) http://www.securityfocus.com/archive/1/500546/100/0/threaded - Broken Link, Third Party Advisory, VDB Entry
References (OSVDB) http://osvdb.org/51736 - (OSVDB) http://osvdb.org/51736 - Broken Link
References (CONFIRM) http://www.sudo.ws/cgi-bin/cvsweb/sudo/parse.c.diff?r1=1.160.2.21&r2=1.160.2.22&f=h - (CONFIRM) http://www.sudo.ws/cgi-bin/cvsweb/sudo/parse.c.diff?r1=1.160.2.21&r2=1.160.2.22&f=h - Broken Link
References (SECTRACK) http://www.securitytracker.com/id?1021688 - (SECTRACK) http://www.securitytracker.com/id?1021688 - Broken Link, Third Party Advisory, VDB Entry
References (CONFIRM) https://bugzilla.novell.com/show_bug.cgi?id=468923 - (CONFIRM) https://bugzilla.novell.com/show_bug.cgi?id=468923 - Issue Tracking, Permissions Required
References (CONFIRM) https://issues.rpath.com/browse/RPL-2954 - (CONFIRM) https://issues.rpath.com/browse/RPL-2954 - Broken Link
References (MLIST) http://lists.vmware.com/pipermail/security-announce/2009/000060.html - (MLIST) http://lists.vmware.com/pipermail/security-announce/2009/000060.html - Broken Link
References (SECUNIA) http://secunia.com/advisories/33885 - (SECUNIA) http://secunia.com/advisories/33885 - Not Applicable
References (CONFIRM) http://www.gratisoft.us/bugzilla/show_bug.cgi?id=327 - (CONFIRM) http://www.gratisoft.us/bugzilla/show_bug.cgi?id=327 - Product, Release Notes
References (OVAL) https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6462 - (OVAL) https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6462 - Broken Link
References (CONFIRM) http://www.vmware.com/security/advisories/VMSA-2009-0009.html - (CONFIRM) http://www.vmware.com/security/advisories/VMSA-2009-0009.html - Third Party Advisory
References (SECUNIA) http://secunia.com/advisories/35766 - (SECUNIA) http://secunia.com/advisories/35766 - Not Applicable
References (OVAL) https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10856 - (OVAL) https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10856 - Broken Link
References (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDVSA-2009:033 - (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDVSA-2009:033 - Broken Link
References (BUGTRAQ) http://www.securityfocus.com/archive/1/504849/100/0/threaded - (BUGTRAQ) http://www.securityfocus.com/archive/1/504849/100/0/threaded - Broken Link, Third Party Advisory, VDB Entry
References (REDHAT) http://www.redhat.com/support/errata/RHSA-2009-0267.html - (REDHAT) http://www.redhat.com/support/errata/RHSA-2009-0267.html - Not Applicable
References (CONFIRM) http://wiki.rpath.com/Advisories:rPSA-2009-0021 - (CONFIRM) http://wiki.rpath.com/Advisories:rPSA-2009-0021 - Broken Link
References (SECUNIA) http://secunia.com/advisories/33753 - (SECUNIA) http://secunia.com/advisories/33753 - Not Applicable
References (VUPEN) http://www.vupen.com/english/advisories/2009/1865 - (VUPEN) http://www.vupen.com/english/advisories/2009/1865 - Permissions Required

Information

Published : 2009-01-30 19:30

Updated : 2024-02-28 11:21


NVD link : CVE-2009-0034

Mitre link : CVE-2009-0034

CVE.ORG link : CVE-2009-0034


JSON object : View

Products Affected

gratisoft

  • sudo

vmware

  • esx
CWE
CWE-863

Incorrect Authorization