Rapid7 Vulnerability & Exploit Database

RHSA-2002:013: Updated sudo package is available

Back to Search

RHSA-2002:013: Updated sudo package is available

Severity
7
CVSS
(AV:L/AC:L/Au:N/C:C/I:C/A:C)
Published
01/31/2002
Created
07/25/2018
Added
03/24/2010
Modified
07/04/2017

Description

This updated sudo package fixes a potential local root exploit.

Versions of sudo prior to 1.6.4 would not clear the environment before sending an email notification about unauthorized sudo attempts, making it possible for an attacker to supply parameters to the mail program. In the worst case, this could lead to a local root exploit. Users of sudo are advised to upgrade to version 1.6.4, which is not vulnerable to this issue.

Solution(s)

  • redhat-upgrade-sudo

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;