PT-2005-4857 · Todd Miller · Sudo

Charles Morris · Published 2005-12-11 · Updated 2024-06-15 · CVE-2005-4158

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sudo versions prior to 1.6.8 p12

Description The issue allows limited local users to cause a Perl script to include and execute arbitrary library files. This is due to the failure to clear certain environment variables when the Perl taint flag is off. The variables PERLLIB, PERL5LIB, and PERL5OPT are not cleared, enabling the inclusion and execution of arbitrary library files with the same name as library files included by the script.

Recommendations For Sudo versions prior to 1.6.8 p12, update to version 1.6.8 p12 or later to resolve the issue. As a temporary workaround, consider setting the Perl taint flag to on to mitigate the risk of exploitation. Restrict access to the environment variables PERLLIB, PERL5LIB, and PERL5OPT to minimize the risk of arbitrary library file execution.

Exploit

Fix

Related Identifiers

CVE-2005-4158

DSA-946-2

OPENSUSE-SU-2024:11413-1

Affected Products

Sudo

References · 38

• 🔥 https://exploit-db.com/exploits/27056 · Exploit
• 🔥 http://securityfocus.com/bid/15394 · Exploit
• 🔥 https://exploit-db.com/exploits/26498 · Exploit
• 🔥 https://exploit-db.com/exploits/27057 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-4158 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2005-4158 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4158 · Security Note
• http://novell.com/linux/security/advisories/2006_02_sr.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:159 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2005:234 · Vendor Advisory
• http://sudo.ws/sudo/alerts/perl_env.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2005-4158 · Vendor Advisory
• http://debian.org/security/2006/dsa-946 · Vendor Advisory
• http://secunia.com/advisories/17534 · Vendor Advisory
• http://trustix.org/errata/2006/0002 · Vendor Advisory