CVE-2010-0427

2010-02-2300:00:00

ubuntu.com

CVSS2

4.4

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

EPSS

Percentile

10.1%

JSON

sudo 1.6.x before 1.6.9p21, when the runas_default option is used, does not
properly set group memberships, which allows local users to gain privileges
via a sudo command.

Bugs

Notes

Author	Note
jdstrand	group privilege escalation, but requires non-default configuration. This only affects 1.6 and not 1.7 Dapper (1.6.8) is not affected

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchsudo< 1.6.9p10-1ubuntu3.6UNKNOWN
ubuntu8.10noarchsudo< 1.6.9p17-1ubuntu2.2UNKNOWN
ubuntu9.04noarchsudo< 1.6.9p17-1ubuntu3.1UNKNOWN