DescriptionSudo 1.7.0 through 1.7.4p3, when a Runas group is configured, does not properly handle use of the -u option in conjunction with the -g option, which allows local users to gain privileges via a command line containing a "-u root" sequence.
Overall state of this security issue: Resolved
This issue is currently rated as having moderate severity.
|National Vulnerability Database|
Note from the SUSE Security TeamThis only affects sudo versions starting from 1.7.2, so only openSUSE 11.2 and 11.3 are affected and will receive fixes. No SUSE Linux Enterprise product is affected by this problem. SUSE Bugzilla entries: 635843 [RESOLVED / FIXED], 637218 [RESOLVED / FIXED]
SUSE Security Advisories:
- SUSE-SR:2010:017, published Tue, 21 Sep 2010 11:00:00 +0000
- openSUSE-SU-2010:0591-1, published Wed, 8 Sep 2010 13:08:08 +0200 (CEST)
SUSE Timeline for this CVECVE page created: Fri Jun 28 07:32:56 2013
CVE page last modified: Fri Oct 7 12:45:57 2022