DSA-4543-1 sudo -- sudoID: oval:org.secpod.oval:def:604562 | Date: (C)2019-10-15 (M)2023-12-20 |
Class: PATCH | Family: unix |
Joe Vennix discovered that sudo, a program designed to provide limited super user privileges to specific users, when configured to allow a user to run commands as an arbitrary user via the ALL keyword in a Runas specification, allows to run commands as root by specifying the user ID - -1 or 4294967295. This could allow a user with sufficient sudo privileges to run commands as root even if the Runas specification explicitly disallows root access. Details can be found in the upstream advisory at https://www.sudo.ws/alerts/minus_1_uid.html .
Platform: |
Debian 10.x |
Debian 9.x |