CVE-2009-0034

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-01-30 · updated 2026-06-16
Weakness: CWE-863

Description

parse.c in sudo 1.6.9p17 through 1.6.9p19 does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command.

Affected products

Gratisoft Sudo: 1.6.9-p17, 1.6.9-p18, 1.6.9-p19
VMware ESX: 4.0

References

http://lists.vmware.com/pipermail/security-announce/2009/000060.html
http://osvdb.org/51736
http://secunia.com/advisories/33753
http://secunia.com/advisories/33840
http://secunia.com/advisories/33885
http://secunia.com/advisories/35766
http://wiki.rpath.com/Advisories:rPSA-2009-0021
http://www.gratisoft.us/bugzilla/show_bug.cgi?id=327
http://www.mandriva.com/security/advisories?name=MDVSA-2009:033
http://www.redhat.com/support/errata/RHSA-2009-0267.html
http://www.securityfocus.com/archive/1/500546/100/0/threaded
http://www.securityfocus.com/archive/1/504849/100/0/threaded

Get alerted when CVE-2009-0034 or the next vulnerability affects your stack