| Description: | Summary:
The remote host is missing an update for the 'sudo'
package(s) announced via the referenced advisory.
Vulnerability Insight:
Multiple vulnerabilities has been found and corrected in sudo:
A patch for parse.c in sudo does not properly interpret a system
group (aka %group) in the sudoers file during authorization decisions
for a user who belongs to that group, which allows local users to
leverage an applicable sudoers file and gain root privileges via a sudo
command. NOTE: this vulnerability exists because of a CVE-2009-0034
regression (CVE-2011-0008).
check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured,
does not require a password for command execution that involves a
gid change but no uid change, which allows local users to bypass an
intended authentication requirement via the -g option to a sudo command
(CVE-2011-0010).
Packages for 2009.0 are provided as of the Extended Maintenance
Program. The updated packages have been upgraded to the latest versions
(1.7.4p6) which is not affected by these issues.
Affected Software/OS:
sudo on Mandriva Linux 2009.0,
Mandriva Linux 2009.0/X86_64,
Mandriva Linux 2010.0,
Mandriva Linux 2010.0/X86_64,
Mandriva Linux 2010.1,
Mandriva Linux 2010.1/X86_64,
Mandriva Enterprise Server 5,
Mandriva Enterprise Server 5/X86_64
Solution:
Please Install the Updated Packages.
CVSS Score:
6.9
CVSS Vector:
AV:L/AC:M/Au:N/C:C/I:C/A:C
|
