CVE-2010-1163

Published: 16 April 2010

The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current working directory has the same name as a pseudo-command in the sudoers file and the PATH contains an entry for ".", which allows local users to execute arbitrary commands via a Trojan horse executable, as demonstrated using sudoedit, a different vulnerability than CVE-2010-0426.

Notes

in Ubuntu 9.04 and earlier, sudo is compiled with secure_path, so
a user must use sudoedit in sudoers and recompile sudo to not use
secure_path. On Karmic, secure_path is configurable via suoders (but still
set at compile-time). Ubuntu does not use 'ignore_dot' by default.

Status

References

• https://ubuntu.com/security/notices/USN-928-1
• http://sudo.ws/sudo/alerts/sudoedit_escalate2.html
• https://www.cve.org/CVERecord?id=CVE-2010-1163
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/563963
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=578275