PT-2014-1808 · Todd Miller+2 · Sudo+2
Sebastien Macke
·
Publicado
2014-03-10
·
Atualizado
2017-12-16
·
CVE-2014-0106
CVSS v2.0
6.6
Média
| Vetor | AV:L/AC:M/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
sudo versions prior to 1.8.5
sudo-debuginfo-1.7.2p1
sudo-1.7.2p1
Description
The issue allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable, potentially leading to a breach of confidentiality, integrity, and availability of protected information. This can be exploited locally by an authenticated attacker.
Recommendations
For versions prior to 1.8.5, update to version 1.8.5 or later to resolve the issue.
For sudo-debuginfo-1.7.2p1 and sudo-1.7.2p1, update to a version that includes the fix for this issue, as these specific versions are affected.
As a temporary workaround, consider enabling the env reset option to minimize the risk of exploitation.
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Red Hat
Suse
Sudo