Re: CVE request: sudo does not ask for password on GID changes

["Todd C. Miller" <Todd.Miller () courtesan com>]

On Tue, 11 Jan 2011 15:52:46 MST, Vincent Danen wrote:

> A Debian bug report noted that sudo does not access for a password on
> GID changes, like it does for UID changes.  This could allow a user to
> execute commands using '-g [group]' without being prompted for their
> password.

This is fixed in sudo 1.7.4p5, available now.

I've written up details of the bug in:
    http://www.sudo.ws/sudo/alerts/runas_group_pw.html

 - todd