CVE-2009-0034

HIGH 7.8CVE-2009-0034 · Published 30/01/2009 · updated 16/06/2026

In short

CVE-2009-0034 is a HIGH (CVSS 7.8) vulnerability affecting sudo (gratisoft).
Chance of exploitation in the next 30 days (EPSS): 0.41%, higher than 35.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
sudo gratisoft	`= 1.6.9`	No fix yet

Description

parse.c in sudo 1.6.9p17 through 1.6.9p19 does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command.

References

lists.vmware.com/pipermail/security-announce/2009/000060.html · Broken Link
osvdb.org/51736 · Broken Link
secunia.com/advisories/33753 · Not Applicable
secunia.com/advisories/33840 · Not Applicable
secunia.com/advisories/33885 · Not Applicable
secunia.com/advisories/35766 · Not Applicable
wiki.rpath.com/Advisories:rPSA-2009-0021 · Broken Link
gratisoft.us/bugzilla/show_bug.cgi · Product
mandriva.com/security/advisories · Broken Link
redhat.com/support/errata/RHSA-2009-0267.html · Not Applicable
securityfocus.com/archive/1/500546/100/0/threaded · Broken Link
securityfocus.com/archive/1/504849/100/0/threaded · Broken Link

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free