CVEvulnerability

CVE-2004-1051

7.2 HIGH Published 2005-03-01 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2005-03-01
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C

Description

sudo before 1.6.8p2 allows local users to execute arbitrary commands by using "()" style environment variables to create functions that have the same name as any program within the bash script that is called without using the program's full pathname.

Affected configurations

• mandrakesoft mandrake multi network firewall 8.2 • todd miller sudo 1.5.6 • todd miller sudo 1.5.7 • todd miller sudo 1.5.8 • todd miller sudo 1.5.9 • todd miller sudo 1.6 • todd miller sudo 1.6.1 • todd miller sudo 1.6.2 • todd miller sudo 1.6.3 • todd miller sudo 1.6.3 p1 • todd miller sudo 1.6.3 p2 • todd miller sudo 1.6.3 p3 • todd miller sudo 1.6.3 p4 • todd miller sudo 1.6.3 p5 • todd miller sudo 1.6.3 p6 • todd miller sudo 1.6.3 p7 • todd miller sudo 1.6.4 • todd miller sudo 1.6.4 p1 • todd miller sudo 1.6.4 p2 • todd miller sudo 1.6.5 • todd miller sudo 1.6.5 p1 • todd miller sudo 1.6.5 p2 • todd miller sudo 1.6.6 • todd miller sudo 1.6.7 • todd miller sudo 1.6.8 • todd miller sudo 1.6.8 p1 • debian debian linux 3.0 • mandrakesoft mandrake linux 9.2 • mandrakesoft mandrake linux 10.0 • mandrakesoft mandrake linux 10.1 • mandrakesoft mandrake linux corporate server 2.1 • trustix secure linux 1.5 • trustix secure linux 2.0 • trustix secure linux 2.1 • trustix secure linux 2.2 • ubuntu ubuntu linux 4.1

References