CVE-2004-1051 | BDVDB-2026-7382 Detail
Description#
sudo before 1.6.8p2 allows local users to execute arbitrary commands by using "()" style environment variables to create functions that have the same name as any program within the bash script that is called without using the program's full pathname.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- https://www.ubuntu.com/usn/usn-28-1/
- http://www.sudo.ws/sudo/alerts/bash_functions.html
- http://marc.info/?l=bugtraq&m=110598298225675&w=2
- http://marc.info/?l=bugtraq&m=110028877431192&w=2
- http://www.mandriva.com/security/advisories?name=MDKSA-2004:133
- http://lists.apple.com/archives/security-announce/2005/May/msg00001.html
- http://www.securityfocus.com/bid/11668
- http://www.debian.org/security/2004/dsa-596
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18055
- http://www.trustix.org/errata/2004/0061/
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.