27 matches found
CVE-2019-25016
In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue...
Command injection
In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue...
CVE-2019-25016
In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue...
CVE-2019-25016
In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue...
CVE-2019-25016
Summary: CVE-2019-25016 affects OpenDoas (versions 6.6–6.8). When the authenticating rule allowed executing any command, the user’s PATH was inappropriately inherited by the resulting shell, enabling potential local privilege escalation. Rules limited to specific commands were not affected. What’...
CVE-2019-25016
In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue...
Duncaen OpenDoas Security Breach
Duncaen OpenDoas is a program from the individual developers at Duncaen that provides limited Sudo functionality for Linux systems. A security vulnerability exists in Duncaen OpenDoas 6.6 through 6.8, which stems from an insecure incomplete reset of paths when the user context is changed...