CVEvulnerability

CVE-2014-0106

6.6 MEDIUM Published 2014-03-11 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2014-03-11
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.6 MEDIUM — AV:L/AC:M/Au:S/C:C/I:C/A:C
Weaknesses
CWE-20

Description

Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.

Affected configurations

• apple mac os x (<= 10.10.4) • todd miller sudo 1.6.9 • todd miller sudo 1.6.9p20 • todd miller sudo 1.6.9p21 • todd miller sudo 1.6.9p22 • todd miller sudo 1.6.9p23 • todd miller sudo 1.7.0 • todd miller sudo 1.7.1 • todd miller sudo 1.7.2 • todd miller sudo 1.7.2p1 • todd miller sudo 1.7.2p2 • todd miller sudo 1.7.2p3 • todd miller sudo 1.7.2p4 • todd miller sudo 1.7.2p5 • todd miller sudo 1.7.2p6 • todd miller sudo 1.7.2p7 • todd miller sudo 1.7.3b1 • todd miller sudo 1.7.4 • todd miller sudo 1.7.4p1 • todd miller sudo 1.7.4p2 • todd miller sudo 1.7.4p3 • todd miller sudo 1.7.4p4 • todd miller sudo 1.7.4p5 • todd miller sudo 1.7.4p6 • todd miller sudo 1.7.5 • todd miller sudo 1.7.6 • todd miller sudo 1.7.6p1 • todd miller sudo 1.7.6p2 • todd miller sudo 1.7.7 • todd miller sudo 1.7.8 • todd miller sudo 1.7.8p1 • todd miller sudo 1.7.8p2 • todd miller sudo 1.7.9 • todd miller sudo 1.7.9p1 • todd miller sudo 1.7.10 • todd miller sudo 1.7.10p1 • todd miller sudo 1.7.10p2 • todd miller sudo 1.7.10p3 • todd miller sudo 1.7.10p4 • todd miller sudo 1.7.10p5 • todd miller sudo 1.7.10p6 • todd miller sudo 1.7.10p7 • todd miller sudo 1.7.10p8 • todd miller sudo 1.7.10p9 • todd miller sudo 1.7.10p10 • todd miller sudo 1.8.0 • todd miller sudo 1.8.1 • todd miller sudo 1.8.1p1 • todd miller sudo 1.8.1p2 • todd miller sudo 1.8.2 • todd miller sudo 1.8.3 • todd miller sudo 1.8.3p1 • todd miller sudo 1.8.3p2 • todd miller sudo 1.8.4 • todd miller sudo 1.8.4p1 • todd miller sudo 1.8.4p2 • todd miller sudo 1.8.4p3 • todd miller sudo 1.8.4p4 • todd miller sudo 1.8.4p5

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References