PT-2014-1808 · Todd Miller+2 · Sudo+2
Sebastien Macke
·
Published
2014-03-10
·
Updated
2017-12-16
·
CVE-2014-0106
CVSS v2.0
6.6
Medium
| Vector | AV:L/AC:M/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
sudo versions prior to 1.8.5
sudo-debuginfo-1.7.2p1
sudo-1.7.2p1
Description
The issue allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable, potentially leading to a breach of confidentiality, integrity, and availability of protected information. This can be exploited locally by an authenticated attacker.
Recommendations
For versions prior to 1.8.5, update to version 1.8.5 or later to resolve the issue.
For sudo-debuginfo-1.7.2p1 and sudo-1.7.2p1, update to a version that includes the fix for this issue, as these specific versions are affected.
As a temporary workaround, consider enabling the env reset option to minimize the risk of exploitation.
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Red Hat
Suse
Sudo