oss-sec mailing list archives
Re: CVE request: sudo does not ask for password on GID changes
From: "Todd C. Miller" <Todd.Miller () courtesan com>
Date: Wed, 12 Jan 2011 15:56:23 -0500
On Tue, 11 Jan 2011 15:52:46 MST, Vincent Danen wrote:
A Debian bug report noted that sudo does not access for a password on GID changes, like it does for UID changes. This could allow a user to execute commands using '-g [group]' without being prompted for their password.
This is fixed in sudo 1.7.4p5, available now. I've written up details of the bug in: http://www.sudo.ws/sudo/alerts/runas_group_pw.html - todd
Current thread:
- CVE request: sudo does not ask for password on GID changes Vincent Danen (Jan 11)
- Re: CVE request: sudo does not ask for password on GID changes Josh Bressers (Jan 12)
- Re: CVE request: sudo does not ask for password on GID changes Todd C. Miller (Jan 12)