Description
sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by a file named sudoedit in a user's home directory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sudo | 1.7.2p1-1.2 | — |
| Debian 13 | sudo | 1.7.2p1-1.2 | — |
| Debian 12 | sudo | 1.7.2p1-1.2 | — |
| Debian 5.0 | sudo | 1.6.9p17-2+lenny1 | DSA-2006-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | sudo | 1.6.9p17-6.el5_4 | RHSA-2010:0122 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 3 repositories
-
t0kx/privesc-CVE-2010-0426 ★ 11 · Dec 16, 2017
Sudo 1.6.x <= 1.6.9p21 and 1.7.x <= 1.7.2p4 Local Privilege Escalation and vulnerable container
-
g1vi/CVE-2010-0426 ★ 1 · Feb 1, 2023
sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4 - Privilege escalation with sudo and sudoedit
-
cved-sources/cve-2010-0426 ★ 0 · Jan 6, 2019
cve-2010-0426
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- RHSA-2010:0122 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2006-1 sudo - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 38803 third-party-advisory
- http://sudo.ws/repos/sudo/rev/88f3181692fe
- oval:org.mitre.oval:def:7238 vdb-entry signature
- GLSA-201003-01 vendor-advisory
- MDVSA-2010:049 vendor-advisory
- FEDORA-2010-6701 vendor-advisory
- 38762 third-party-advisory
- DSA-2006 vendor-advisory
- 39399 third-party-advisory
- 38362 vdb-entry
- FEDORA-2010-6749 vendor-advisory
- 20101027 rPSA-2010-0075-1 sudo mailing-list
- USN-905-1 vendor-advisory
- oval:org.mitre.oval:def:10814 vdb-entry signature
- SUSE-SR:2010:006 vendor-advisory
- ADV-2010-0949 vdb-entry
- http://sudo.ws/bugs/show_bug.cgi?id=389
- http://wiki.rpath.com/Advisories:rPSA-2010-0075
- ADV-2010-0450 vdb-entry
- http://www.sudo.ws/sudo/stable.html
- 38659 third-party-advisory
- 38795 third-party-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=570737
- http://www.linuxquestions.org/questions/linux-security-4/the-use-of-sudoedit-command-question-785442/
- 38915 third-party-advisory
- http://sudo.ws/repos/sudo/rev/f86e1b56d074
- 1023658 vdb-entry
- SSA:2010-110-01 vendor-advisory