Description
sudo 1.6.x before 1.6.9p21, when the runas_default option is used, does not properly set group memberships, which allows local users to gain privileges via a sudo command.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sudo | 1.7.0-1 | — |
| Debian 13 | sudo | 1.7.0-1 | — |
| Debian 12 | sudo | 1.7.0-1 | — |
| Debian 5.0 | sudo | 1.6.9p17-2+lenny1 | DSA-2006-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | sudo | 1.6.9p17-6.el5_4 | RHSA-2010:0122 |
Advisories 2
- RHSA-2010:0122 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2006-1 sudo - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 38803 third-party-advisory
- GLSA-201003-01 vendor-advisory
- http://sudo.ws/repos/sudo/rev/aa0b6c01c462
- 38762 third-party-advisory
- DSA-2006 vendor-advisory
- oval:org.mitre.oval:def:10946 vdb-entry signature
- https://bugzilla.redhat.com/show_bug.cgi?id=567622
- oval:org.mitre.oval:def:7216 vdb-entry signature
- 20101027 rPSA-2010-0075-1 sudo mailing-list
- USN-905-1 vendor-advisory
- http://www.gratisoft.us/bugzilla/attachment.cgi?id=255
- SUSE-SR:2010:006 vendor-advisory
- http://wiki.rpath.com/Advisories:rPSA-2010-0075
- [oss-security] 20100223 CVE assignment notification -- CVE-2010-0427 -- sudo fails to reset group permissions if runas_default set mailing-list
- [oss-security] 20100224 Re: CVE assignment notification -- CVE-2010-0427 -- sudo fails to reset group permissions if runas_default set mailing-list
- 38795 third-party-advisory
- http://www.sudo.ws/cgi-bin/cvsweb/sudo/set_perms.c.diff?r1=1.30.2.7&r2=1.30.2.8
- 38915 third-party-advisory
- http://www.gratisoft.us/bugzilla/show_bug.cgi?id=349
- 1023658 vdb-entry