CVE-2011-0010

Publication date 18 January 2011

Last updated 24 July 2024

Ubuntu priority

check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gid change but no uid change, which allows local users to bypass an intended authentication requirement via the -g option to a sudo command.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
sudo	10.10 maverick	Fixed 1.7.2p7-1ubuntu2.1
	10.04 LTS lucid	Fixed 1.7.2p1-1ubuntu5.3
	9.10 karmic	Fixed 1.7.0-1ubuntu2.6
	8.04 LTS hardy	Not affected
	6.06 LTS dapper	Not affected

Notes

jdstrand

1.6 not affected

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
sudo	Upstream: http://www.sudo.ws/repos/sudo/rev/fe8a94f96542 Upstream: http://www.sudo.ws/repos/sudo/rev/07d1b0ce530e

References

Related Ubuntu Security Notices (USN)