Sudo 1.7.0 through 1.7.4p3, when a Runas group is configured, does not properly handle use of the -u option in conjunction with the -g option, which allows local users to gain privileges via a command line containing a "-u root" sequence.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade sudo | Dec 1, 2016 | Sep 10, 2010 |
| Debian | — | Upgrade sudo | Jul 30, 2024 | Sep 10, 2010 |
| Freebsd | — | Upgrade sudo | Dec 10, 2025 | Sep 7, 2010 |
| Gentoo Linux | — | Upgrade app-admin/sudo. | Oct 30, 2017 | Sep 10, 2010 |
| Oracle_linux | — | Upgrade sudo | Oct 16, 2024 | Sep 10, 2010 |
| Suse | — | Upgrade sudo | Feb 17, 2015 | Sep 10, 2010 |
| Ubuntu | — | Upgrade sudo-ldapUpgrade sudo | Nov 8, 2024 | Sep 10, 2010 |
| Vmsa 2011 0001 | — | Upgrade VMware ESX 4.1 to build number 348481Upgrade VMware ESX 4.0 to build number 332073 | Jan 5, 2011 | Sep 10, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub