Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.9

sudo on Fedora 14 may let local users become root

CVE-2011-0008 · published 15 years ago
Summary

On Fedora 14 systems running sudo version before 1.7.4p5-1.fc14, the program does not correctly read group entries (written as %group) in its permission file. This mistake can allow a regular user who belongs to such a group to run sudo and obtain full administrator rights. Update sudo to the fixed package or apply the latest Fedora security patches.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
todd_miller sudo <= 1.7.4p5
1.3.1
1.5
1.5.2
1.5.3
1.5.6
1.5.7
1.5.8
1.5.9
1.6
1.6.1
1.6.2
102 more version ranges
cpe:2.3:a:todd_miller:sudo:*:*:*:*:*:*:*:*
Original advisory text
A certain Fedora patch for parse.c in sudo before 1.7.4p5-1.fc14 on Fedora 14 does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a user w...
A certain Fedora patch for parse.c in sudo before 1.7.4p5-1.fc14 on Fedora 14 does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command. NOTE: this vulnerability exists because of a CVE-2009-0034 regression.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
6.9 Medium
Exploitation
<1% chance of attack within 30 days
Timeline
Published20 Jan 2011
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2011-0008 · NVD
Track software like this
Free during beta