NetSight
IP …
medium6.2

CVE-2010-2956

Sudo 1.7.0 through 1.7.4p3, when a Runas group is configured, does not properly handle use of the -u option in conjunction with the -g option, which allows loc…

Impact

Sudo 1.7.0 through 1.7.4p3, when a Runas group is configured, does not properly handle use of the -u option in conjunction with the -g option, which allows local users to gain privileges via a command line containing a "-u root" sequence.

Affected products

VendorProductAffected versions
Todd MillerSudo
Versions 1.7.0, 1.7.1, 1.7.2, 1.7.2p1, 1.7.2p2, 1.7.2p3

References