| Description: | Description:
The remote host is missing updates announced in
advisory RHSA-2010:0122.
The sudo (superuser do) utility allows system administrators to give
certain users the ability to run commands as root.
A privilege escalation flaw was found in the way sudo handled the sudoedit
pseudo-command. If a local user were authorized by the sudoers file to use
this pseudo-command, they could possibly leverage this flaw to execute
arbitrary code with the privileges of the root user. (CVE-2010-0426)
The sudo utility did not properly initialize supplementary groups when the
runas_default option (in the sudoers file) was used. If a local user
were authorized by the sudoers file to perform their sudo commands under
the account specified with runas_default, they would receive the root
user's supplementary groups instead of those of the intended target user,
giving them unintended privileges. (CVE-2010-0427)
Users of sudo should upgrade to this updated package, which contains
backported patches to correct these issues.
Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date
http://rhn.redhat.com/errata/RHSA-2010-0122.html
http://www.redhat.com/security/updates/classification/#important
Risk factor : High
CVSS Score:
6.9
|
