(RHSA-2010:0475) Moderate: sudo security update

The sudo (superuser do) utility allows system administrators to give
certain users the ability to run commands as root.

A flaw was found in the way sudo handled the presence of duplicated
environment variables. A local user authorized to run commands using sudo
could use this flaw to set additional values for the environment variables
set by sudo, which could result in those values being used by the executed
command instead of the values set by sudo. This could possibly lead to
certain intended restrictions being bypassed, such as the secure_path
setting. (CVE-2010-1646)

Red Hat would like to thank Anders Kaseorg and Evan Broder of Ksplice, Inc.
for responsibly reporting this issue.

Users of sudo should upgrade to this updated package, which contains a
backported patch to correct this issue.