CVE-2010-1163 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2010-1163 Interim 1 22 2022-11-09T03:42:57Z current 2021-05-30T12:50:55Z 2022-11-09T03:42:57Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2010-1163 The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current working directory has the same name as a pseudo-command in the sudoers file and the PATH contains an entry for ".", which allows local users to execute arbitrary commands via a Trojan horse executable, as demonstrated using sudoedit, a different vulnerability than CVE-2010-0426. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html E-Mail link for SUSE-SR:2011:002 https://lists.opensuse.org/opensuse-updates/2011-01/msg00022.html E-Mail link for openSUSE-SU-2011:0050-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Software Development Kit 12 SP1 SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Desktop 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Software Development Kit 12 SP1 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Software Development Kit 12 SP1 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP1 openSUSE Leap 15.0 openSUSE Tumbleweed sudo-1.8.10p3-1.62 sudo-1.8.10p3-6.16 sudo-1.8.18p1-1.1 sudo-1.8.20p2-1.3 sudo-1.8.20p2-3.7.10 sudo-1.8.22-2.11 sudo-1.8.22-4.3.3 sudo-1.8.22-lp150.2.6 sudo-1.8.27-2.2 sudo-devel-1.8.10p3-1.62 sudo-devel-1.8.10p3-6.16 sudo-devel-1.8.18p1-1.1 sudo-devel-1.8.20p2-1.3 sudo-devel-1.8.20p2-3.7.10 sudo-devel-1.8.22-2.11 sudo-devel-1.8.22-4.3.3 sudo-devel-1.8.27-2.2 sudo-test-1.8.18p1-1.1 sudo-1.8.10p3-1.62 as a component of SUSE Linux Enterprise Desktop 12 sudo-1.8.10p3-1.62 as a component of SUSE Linux Enterprise Desktop 12 SP1 sudo-1.8.10p3-6.16 as a component of SUSE Linux Enterprise Desktop 12 SP2 sudo-1.8.20p2-1.3 as a component of SUSE Linux Enterprise Desktop 12 SP3 sudo-1.8.20p2-3.7.10 as a component of SUSE Linux Enterprise Desktop 12 SP4 sudo-1.8.27-2.2 as a component of SUSE Linux Enterprise High Performance Computing 12 SP5 sudo-1.8.22-2.11 as a component of SUSE Linux Enterprise Module for Basesystem 15 sudo-devel-1.8.22-2.11 as a component of SUSE Linux Enterprise Module for Basesystem 15 sudo-1.8.22-4.3.3 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 sudo-devel-1.8.22-4.3.3 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 sudo-1.8.10p3-1.62 as a component of SUSE Linux Enterprise Server 12 sudo-1.8.10p3-1.62 as a component of SUSE Linux Enterprise Server 12 SP1 sudo-1.8.10p3-6.16 as a component of SUSE Linux Enterprise Server 12 SP2 sudo-1.8.20p2-1.3 as a component of SUSE Linux Enterprise Server 12 SP3 sudo-1.8.20p2-3.7.10 as a component of SUSE Linux Enterprise Server 12 SP4 sudo-1.8.27-2.2 as a component of SUSE Linux Enterprise Server 12 SP5 sudo-1.8.10p3-6.16 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 sudo-devel-1.8.10p3-1.62 as a component of SUSE Linux Enterprise Software Development Kit 12 sudo-devel-1.8.10p3-1.62 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 sudo-devel-1.8.10p3-6.16 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 sudo-devel-1.8.20p2-1.3 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 sudo-devel-1.8.20p2-3.7.10 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 sudo-devel-1.8.27-2.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 sudo-1.8.22-lp150.2.6 as a component of openSUSE Leap 15.0 sudo-1.8.18p1-1.1 as a component of openSUSE Tumbleweed sudo-devel-1.8.18p1-1.1 as a component of openSUSE Tumbleweed sudo-test-1.8.18p1-1.1 as a component of openSUSE Tumbleweed The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current working directory has the same name as a pseudo-command in the sudoers file and the PATH contains an entry for ".", which allows local users to execute arbitrary commands via a Trojan horse executable, as demonstrated using sudoedit, a different vulnerability than CVE-2010-0426. CVE-2010-1163 SUSE Linux Enterprise Desktop 12:sudo-1.8.10p3-1.62 SUSE Linux Enterprise Desktop 12 SP1:sudo-1.8.10p3-1.62 SUSE Linux Enterprise Desktop 12 SP2:sudo-1.8.10p3-6.16 SUSE Linux Enterprise Desktop 12 SP3:sudo-1.8.20p2-1.3 SUSE Linux Enterprise Desktop 12 SP4:sudo-1.8.20p2-3.7.10 SUSE Linux Enterprise High Performance Computing 12 SP5:sudo-1.8.27-2.2 SUSE Linux Enterprise Module for Basesystem 15:sudo-1.8.22-2.11 SUSE Linux Enterprise Module for Basesystem 15:sudo-devel-1.8.22-2.11 SUSE Linux Enterprise Module for Basesystem 15 SP1:sudo-1.8.22-4.3.3 SUSE Linux Enterprise Module for Basesystem 15 SP1:sudo-devel-1.8.22-4.3.3 SUSE Linux Enterprise Server 12:sudo-1.8.10p3-1.62 SUSE Linux Enterprise Server 12 SP1:sudo-1.8.10p3-1.62 SUSE Linux Enterprise Server 12 SP2:sudo-1.8.10p3-6.16 SUSE Linux Enterprise Server 12 SP3:sudo-1.8.20p2-1.3 SUSE Linux Enterprise Server 12 SP4:sudo-1.8.20p2-3.7.10 SUSE Linux Enterprise Server 12 SP5:sudo-1.8.27-2.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:sudo-1.8.10p3-6.16 SUSE Linux Enterprise Software Development Kit 12:sudo-devel-1.8.10p3-1.62 SUSE Linux Enterprise Software Development Kit 12 SP1:sudo-devel-1.8.10p3-1.62 SUSE Linux Enterprise Software Development Kit 12 SP2:sudo-devel-1.8.10p3-6.16 SUSE Linux Enterprise Software Development Kit 12 SP3:sudo-devel-1.8.20p2-1.3 SUSE Linux Enterprise Software Development Kit 12 SP4:sudo-devel-1.8.20p2-3.7.10 SUSE Linux Enterprise Software Development Kit 12 SP5:sudo-devel-1.8.27-2.2 openSUSE Leap 15.0:sudo-1.8.22-lp150.2.6 openSUSE Tumbleweed:sudo-1.8.18p1-1.1 openSUSE Tumbleweed:sudo-devel-1.8.18p1-1.1 openSUSE Tumbleweed:sudo-test-1.8.18p1-1.1 moderate 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C