CVE-2010-2956
Fixed in a distro release EPSS <1%
Sudo 1.7.0 through 1.7.4p3, when a Runas group is configured, does not properly handle use of the -u option in conjunction with the -g option, which allows local users to gain privileges via a command line containing a "-u root" sequence.
Products: todd_miller sudo
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | sudo | 1.7.4p4-1 |
| Debian 13 | sudo | 1.7.4p4-1 |
| Debian 14 | sudo | 1.7.4p4-1 |
| Red Hat Enterprise Linux 5 | sudo | 0:1.7.2p1-8.el5_5 |
| Red Hat Enterprise Linux 5 | sudo-debuginfo | 0:1.7.2p1-8.el5_5 |