Test ID:	1.3.6.1.4.1.25623.1.0.880605
Category:	CentOS Local Security Checks
Title:	CentOS Update for sudo CESA-2010:0675 centos5 i386
Summary:	The remote host is missing an update for the 'sudo'; package(s) announced via the referenced advisory.
Description:	Summary: The remote host is missing an update for the 'sudo' package(s) announced via the referenced advisory. Vulnerability Insight: The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root. A flaw was found in the way sudo handled Runas specifications containing both a user and a group list. If a local user were authorized by the sudoers file to perform their sudo commands with the privileges of a specified user and group, they could use this flaw to run those commands with the privileges of either an arbitrary user or group on the system. (CVE-2010-2956) Red Hat would like to thank Markus Wuethrich of Swiss Post - PostFinance for reporting this issue. Users of sudo should upgrade to this updated package, which contains a backported patch to correct this issue. Affected Software/OS: sudo on CentOS 5 Solution: Please install the updated packages. CVSS Score: 6.2 CVSS Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2010-2956 1024392 http://www.securitytracker.com/id?1024392 20101027 rPSA-2010-0075-1 sudo http://www.securityfocus.com/archive/1/514489/100/0/threaded 20110105 VMSA-2011-0001 VMware ESX third party updates for Service Console packages glibc, sudo, and openldap http://www.securityfocus.com/archive/1/515545/100/0/threaded 40508 http://secunia.com/advisories/40508 41316 http://secunia.com/advisories/41316 42787 http://secunia.com/advisories/42787 43019 http://www.securityfocus.com/bid/43019 ADV-2010-2312 http://www.vupen.com/english/advisories/2010/2312 ADV-2010-2318 http://www.vupen.com/english/advisories/2010/2318 ADV-2010-2320 http://www.vupen.com/english/advisories/2010/2320 ADV-2010-2358 http://www.vupen.com/english/advisories/2010/2358 ADV-2011-0025 http://www.vupen.com/english/advisories/2011/0025 FEDORA-2010-14355 http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047516.html GLSA-201009-03 http://security.gentoo.org/glsa/glsa-201009-03.xml MDVSA-2010:175 http://www.mandriva.com/security/advisories?name=MDVSA-2010:175 RHSA-2010:0675 http://www.redhat.com/support/errata/RHSA-2010-0675.html SUSE-SR:2010:017 http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html USN-983-1 http://www.ubuntu.com/usn/USN-983-1 http://wiki.rpath.com/Advisories:rPSA-2010-0075 http://www.sudo.ws/sudo/alerts/runas_group.html http://www.vmware.com/security/advisories/VMSA-2011-0001.html https://bugzilla.redhat.com/show_bug.cgi?id=628628
Copyright	Copyright (C) 2011 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.