Published: 07/06/2010 Updated: 10/10/2018

CVSS v2 Base Score: 6.2 | Impact Score: 10 | Exploitability Score: 1.9

VMScore: 552

Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C

The secure path feature in env.c in sudo 1.3.1 up to and including 1.6.9p22 and 1.7.0 up to and including 1.7.2p6 does not properly handle an environment that contains multiple PATH variables, which might allow local users to gain privileges via a crafted value of the last PATH variable.

Vulnerable Product	Search on Vulmon	Subscribe to Product
todd miller sudo 1.3.1
todd miller sudo 1.7.0
todd miller sudo 1.7.2p5
todd miller sudo 1.7.2p6
todd miller sudo 1.6.2p2
todd miller sudo 1.6.2p3
todd miller sudo 1.6.3
todd miller sudo 1.6.3p7
todd miller sudo 1.6.4
todd miller sudo 1.6.7
todd miller sudo 1.6.7p1
todd miller sudo 1.6.8p3
todd miller sudo 1.6.8p4
todd miller sudo 1.6.8p11
todd miller sudo 1.6.8p12
todd miller sudo 1.6.9p6
todd miller sudo 1.6.9p7
todd miller sudo 1.6.9p15
todd miller sudo 1.6.9p16
todd miller sudo 1.7.2p1
todd miller sudo 1.7.2p2
todd miller sudo 1.6
todd miller sudo 1.6.1
todd miller sudo 1.6.3p3
todd miller sudo 1.6.3p4
todd miller sudo 1.6.5
todd miller sudo 1.6.5p1
todd miller sudo 1.6.7p4
todd miller sudo 1.6.7p5
todd miller sudo 1.6.8p7
todd miller sudo 1.6.8p8
todd miller sudo 1.6.9p2
todd miller sudo 1.6.9p3
todd miller sudo 1.6.9p10
todd miller sudo 1.6.9p11
todd miller sudo 1.6.9p19
todd miller sudo 1.6.9p20
todd miller sudo 1.7.2p3
todd miller sudo 1.7.2p4
todd miller sudo 1.6.2
todd miller sudo 1.6.2p1
todd miller sudo 1.6.3p5
todd miller sudo 1.6.3p6
todd miller sudo 1.6.5p2
todd miller sudo 1.6.6
todd miller sudo 1.6.8
todd miller sudo 1.6.8p1
todd miller sudo 1.6.8p2
todd miller sudo 1.6.8p9
todd miller sudo 1.6.8p10
todd miller sudo 1.6.9p4
todd miller sudo 1.6.9p5
todd miller sudo 1.6.9p12
todd miller sudo 1.6.9p13
todd miller sudo 1.6.9p14
todd miller sudo 1.6.9p21
todd miller sudo 1.7.1
todd miller sudo 1.7.2
todd miller sudo 1.7.2p7
todd miller sudo 1.6.9p22
todd miller sudo 1.6.3p1
todd miller sudo 1.6.3p2
todd miller sudo 1.6.4p1
todd miller sudo 1.6.4p2
todd miller sudo 1.6.7p2
todd miller sudo 1.6.7p3
todd miller sudo 1.6.8p5
todd miller sudo 1.6.8p6
todd miller sudo 1.6.9
todd miller sudo 1.6.9p1
todd miller sudo 1.6.9p8
todd miller sudo 1.6.9p9
todd miller sudo 1.6.9p17
todd miller sudo 1.6.9p18

Under certain conditions, a user might be able to run commands with administrative privileges ...

Debian Bug report logs - #595935 CVE-2010-1646: Flaw in Runas group matching Package: sudo; Maintainer for sudo is Bdale Garbee <bdale@gagcom>; Source for sudo is src:sudo (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <muehlenhoff@univentionde> Date: Tue, 7 Sep 2010 12:39:01 UTC Severity: grave Tags: secu ...

Debian Bug report logs - #585394 CVE-2010-1646: Sudo's secure path option can be circumvented Package: sudo; Maintainer for sudo is Bdale Garbee <bdale@gagcom>; Source for sudo is src:sudo (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <muehlenhoff@univentionde> Date: Thu, 10 Jun 2010 09:21:01 UTC Severity: ...

Anders Kaseorg and Evan Broder discovered a vulnerability in sudo, a program designed to allow a sysadmin to give limited root privileges to users, that allows a user with sudo permissions on certain programs to use those programs with an untrusted value of PATH This could possibly lead to certain intended restrictions being bypassed, such as the ...

CWE-264 http://www.sudo.ws/sudo/alerts/secure_path.html http://secunia.com/advisories/40002 http://www.sudo.ws/repos/sudo/rev/3057fde43cf0 http://www.securityfocus.com/bid/40538 https://bugzilla.redhat.com/show_bug.cgi?id=598154 http://www.sudo.ws/repos/sudo/rev/a09c6812eaec http://www.osvdb.org/65083 http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042838.html http://www.vupen.com/english/advisories/2010/1452 http://secunia.com/advisories/40188 http://www.vupen.com/english/advisories/2010/1519 http://www.vupen.com/english/advisories/2010/1518 http://www.debian.org/security/2010/dsa-2062 http://www.mandriva.com/security/advisories?name=MDVSA-2010:118 http://www.securitytracker.com/id?1024101 http://secunia.com/advisories/40215 http://www.vupen.com/english/advisories/2010/1478 http://www.redhat.com/support/errata/RHSA-2010-0475.html http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043026.html http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043012.html http://security.gentoo.org/glsa/glsa-201009-03.xml http://secunia.com/advisories/40508 http://wiki.rpath.com/Advisories:rPSA-2010-0075 http://www.vupen.com/english/advisories/2011/0212 http://secunia.com/advisories/43068 http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7338 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10580 http://www.securityfocus.com/archive/1/514489/100/0/threaded https://usn.ubuntu.com/956-1/https://nvd.nist.gov

CVE-2010-1646

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect