oss-security - Re: CVE request: sudo does not ask for password on GID changes

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 12 Jan 2011 15:56:23 -0500
From: "Todd C. Miller" <Todd.Miller@...rtesan.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: sudo does not ask for password on GID changes

On Tue, 11 Jan 2011 15:52:46 MST, Vincent Danen wrote:

> A Debian bug report noted that sudo does not access for a password on
> GID changes, like it does for UID changes.  This could allow a user to
> execute commands using '-g [group]' without being prompted for their
> password.

This is fixed in sudo 1.7.4p5, available now.

I've written up details of the bug in:
    http://www.sudo.ws/sudo/alerts/runas_group_pw.html

 - todd

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.