Published: 25/10/2005 Updated: 03/10/2018

CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9

VMScore: 409

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

Incomplete blacklist vulnerability in sudo 1.6.8 and previous versions allows local users to gain privileges via the (1) SHELLOPTS and (2) PS4 environment variables before executing a bash script on behalf of another user, which are not cleared even though other variables are.

Vulnerable Product	Search on Vulmon	Subscribe to Product
todd miller sudo 1.6.3_p2
todd miller sudo 1.6.3_p3
todd miller sudo 1.6.3_p4
todd miller sudo 1.6.3p4
todd miller sudo 1.6.3p5
todd miller sudo 1.6.4p2
todd miller sudo 1.6.5
todd miller sudo 1.6.8
todd miller sudo 1.6
todd miller sudo 1.6.3_p5
todd miller sudo 1.6.3_p6
todd miller sudo 1.6.3p6
todd miller sudo 1.6.3p7
todd miller sudo 1.6.5_p1
todd miller sudo 1.6.5_p2
todd miller sudo 1.6.1
todd miller sudo 1.6.2
todd miller sudo 1.6.3_p7
todd miller sudo 1.6.3p1
todd miller sudo 1.6.4
todd miller sudo 1.6.4_p1
todd miller sudo 1.6.5p1
todd miller sudo 1.6.5p2
todd miller sudo 1.6.3
todd miller sudo 1.6.3_p1
todd miller sudo 1.6.3p2
todd miller sudo 1.6.3p3
todd miller sudo 1.6.4_p2
todd miller sudo 1.6.4p1
todd miller sudo 1.6.6
todd miller sudo 1.6.7
todd miller sudo 1.6.7_p5

Tavis Ormandy discovered a privilege escalation vulnerability in sudo On executing shell scripts with sudo, the “P4” and “SHELLOPTS” environment variables were not cleaned properly If sudo is set up to grant limited sudo privileges to normal users this could be exploited to run arbitrary commands as the target user ...

Tavis Ormandy noticed that sudo, a program that provides limited super user privileges to specific users, does not clean the environment sufficiently The SHELLOPTS and PS4 variables are dangerous and are still passed through to the program running as privileged user This can result in the execution of arbitrary commands as privileged user when a ...

CWE-264 http://www.sudo.ws/bugs/show_bug.cgi?id=182 http://www.debian.org/security/2005/dsa-870 http://secunia.com/advisories/17390 http://www.securityfocus.com/advisories/9643 http://www.securityfocus.com/bid/15191 http://secunia.com/advisories/17318 http://secunia.com/advisories/17322 http://secunia.com/advisories/17345 http://secunia.com/advisories/17666 http://www.novell.com/linux/security/advisories/2006_02_sr.html http://secunia.com/advisories/18549 http://www.openpkg.org/security/OpenPKG-SA-2006.002-sudo.html http://docs.info.apple.com/article.html?artnum=305214 http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html http://secunia.com/advisories/24479 http://www.mandriva.com/security/advisories?name=MDKSA-2005:201 http://www.us-cert.gov/cas/techalerts/TA07-072A.html http://www.vupen.com/english/advisories/2007/0930 https://usn.ubuntu.com/213-1/https://usn.ubuntu.com/213-1/https://nvd.nist.gov

CVE-2005-2959

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect