CVE Feed

    Dashboard / CVE / CVE-2011-0008

    CVE-2011-0008

    A certain Fedora patch for parse.c in sudo before 1.7.4p5-1.fc14 on Fedora 14 does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command. NOTE: this vulnerability exists because of a CVE-2009-0034 regression.

    Published:Jan 14, 2011
    Last Modified:Apr 11, 2025
    EPS:Jan 20, 2011
    EPSS Score:0.00047
    CVSS Score:6.9

    Affected Products

    Vendor
    Redhat
    Product
    Fedora
    Vendor
    Todd Miller
    Product
    Sudo

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2018-19139 (CVSS 5.5) — An issue has been found in JasPer 2.0.14. There is a memory leak in jas_malloc.c when called from jpc_unk_getp…
    CVE-2014-9278 (CVSS 4) — The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environmen…
    CVE-2011-1011 (CVSS 6.9) — The seunshare_mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of policycoreutil…
    CVE-2009-3080 (CVSS 7.2) — Array index error in the gdth_read_event function in drivers/scsi/gdth.c in the Linux kernel before 2.6.32-rc8…
    CVE-2010-4695 (CVSS 5) — A certain Fedora patch for gif2png.c in gif2png 2.5.1 and 2.5.2, as distributed in gif2png-2.5.1-1200.fc12 on …
    CVE-2009-1573 (CVSS 4.6) — xvfb-run 1.6.1 in Debian GNU/Linux, Ubuntu, Fedora 10, and possibly other operating systems place the magic co…
    CVE-2008-6755 (CVSS 5) — ZoneMinder 1.23.3 on Fedora 10 sets the ownership of /etc/zm.conf to the apache user account, and sets the per…
    CVE-2008-6560 (CVSS 7.8) — Buffer overflow in CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9 and Red Hat Enterprise Linux (RHEL)…
    CVE-2009-0180 (CVSS 7.5) — Certain Fedora build scripts for nfs-utils before 1.1.2-9.fc9 on Fedora 9, and before 1.1.4-6.fc10 on Fedora 1…
    CVE-2008-3832 (CVSS 4.9) — A certain Fedora patch for the utrace subsystem in the Linux kernel before 2.6.26.5-28 on Fedora 8, and before…

    References

    http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053263.html
    http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053341.html
    http://secunia.com/advisories/42968
    http://www.mandriva.com/security/advisories?name=MDVSA-2011:018
    http://www.vupen.com/english/advisories/2011/0195
    http://www.vupen.com/english/advisories/2011/0199
    https://bugzilla.redhat.com/show_bug.cgi?id=668843
    https://exchange.xforce.ibmcloud.com/vulnerabilities/64965
    http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053263.html
    http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053341.html
    http://secunia.com/advisories/42968
    http://www.mandriva.com/security/advisories?name=MDVSA-2011:018
    http://www.vupen.com/english/advisories/2011/0195
    http://www.vupen.com/english/advisories/2011/0199
    https://bugzilla.redhat.com/show_bug.cgi?id=668843
    https://exchange.xforce.ibmcloud.com/vulnerabilities/64965

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High