sudo: Privilege escalation

sudo: Privilege escalation A vulnerability in sudo may allow for privilege escalation. sudo 2009-02-06 2009-02-06: 01 256633 local 1.7.0 1.7.0

sudo allows a system administrator to give users the ability to run commands as other users.

Harald Koenig discovered that sudo incorrectly handles group specifications in Runas_Alias (and related) entries when a group is specified in the list (using %group syntax, to allow a user to run commands as any member of that group) and the user is already a member of that group.

A local attacker could possibly run commands as an arbitrary system user (including root).

There is no known workaround at this time.

All sudo users should upgrade to the latest version:


    # emerge --sync
    # emerge --ask --oneshot --verbose ">=app-admin/sudo-1.7.0"

CVE-2009-0034 keytoaster keytoaster keytoaster