[SECURITY] [DSA 946-1] New sudo packages fix privilege escalation

-------------------------------------------------------------------------- Debian Security Advisory DSA 946-1 [email protected] http://www.debian.org/security/ Martin Schulze January 20th, 2006 http://www.debian.org/security/faq -...

Mandrake Linux Security Advisory : sudo (MDKSA-2005:234)

Charles Morris discovered a vulnerability in sudo versions prior to 1.6.8p12 where, when the perl taint flag is off, sudo does not clear the PERLLIB, PERL5LIB, and PERL5OPT environment variables, which could allow limited local users to cause a perl script to include and execute arbitrary library...

Ubuntu 4.10 / 5.04 / 5.10 : sudo vulnerability (USN-213-1)

Tavis Ormandy discovered a privilege escalation vulnerability in sudo. On executing shell scripts with sudo, the 'P4' and 'SHELLOPTS' environment variables were not cleaned properly. If sudo is set up to grant limited sudo privileges to normal users this could be exploited to run arbitrary comman...

Ubuntu 4.10 / 5.04 : sudo vulnerability (USN-142-1)

Charles Morris discovered a race condition in sudo which could lead to privilege escalation. If /etc/sudoers allowed a user the execution of selected programs, and this was followed by another line containing the pseudo-command 'ALL', that user could execute arbitrary commands with sudo by creati...

Ubuntu 4.10 : sudo vulnerability (USN-28-1)

Liam Helmer discovered an input validation flaw in sudo. When the standard shell 'bash' starts up, it searches the environment for variables with a value beginning with ''. For each of these variables a function with the same name is created, with the function body filled in from the environment...

DEBIAN-CVE-2006-0151

sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable, which allows limited local users to gain privileges via a Python script, a variant of CVE-2005-4158...

CVE-2006-0151

sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable, which allows limited local users to gain privileges via a Python script, a variant of CVE-2005-4158...

CVE-2006-0151

sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable, which allows limited local users to gain privileges via a Python script, a variant of CVE-2005-4158...

CVE-2006-0151

sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable, which allows limited local users to gain privileges via a Python script, a variant of CVE-2005-4158...

CVE-2006-0151

sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable, which allows limited local users to gain privileges via a Python script, a variant of CVE-2005-4158...

CVE-2006-0151

CVE-2006-0151 is a local privilege escalation in sudo where the PYTHONINSPECT environment variable is not cleared (variant of CVE-2005-4158). The issue affects sudo 1.6.8 and related versions and can allow limited local users to gain privileges via a Python script executed under sudo. Public docu...

USN-235-2: sudo vulnerability

USN-235-1 fixed a vulnerability in sudo's handling of environment variables. Tavis Ormandy noticed that sudo did not filter out the PYTHONINSPECT environment variable, so that users with the limited privilege of calling a python script with sudo could still escalate their privileges. For referenc...

Sudo 1.6.x - Environment Variable Handling Security Bypass (1)

Sudo 1.6.x - Environment Variable Handling Security Bypass 1 source: https://www.securityfocus.com/bid/16184/info Sudo is prone to a security-bypass vulnerability that could lead to arbitrary code execution. This issue is due to an error in the application when handling environment variables. A...

Sudo 1.6.x - Environment Variable Handling Security Bypass (2)

source: https://www.securityfocus.com/bid/16184/info Sudo is prone to a security-bypass vulnerability that could lead to arbitrary code execution. This issue is due to an error in the application when handling environment variables. A local attacker with the ability to run Python scripts can...

Sudo 1.6.x - Environment Variable Handling Security Bypass (2)

Sudo 1.6.x - Environment Variable Handling Security Bypass 2 source: https://www.securityfocus.com/bid/16184/info Sudo is prone to a security-bypass vulnerability that could lead to arbitrary code execution. This issue is due to an error in the application when handling environment variables. A...

Sudo 1.6.x - Environment Variable Handling Security Bypass (1)

source: https://www.securityfocus.com/bid/16184/info Sudo is prone to a security-bypass vulnerability that could lead to arbitrary code execution. This issue is due to an error in the application when handling environment variables. A local attacker with the ability to run Python scripts can...

sudo privilege escalation

few envoronment vaqriables used by bash perl and python are not cleaned...

[Full-disclosure] [USN-235-2] sudo vulnerability

=========================================================== Ubuntu Security Notice USN-235-2 January 09, 2006 sudo vulnerability CVE-2005-4158 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 4.10 Warty Warthog Ubuntu 5.04...

CVE-2005-3629

initscripts in Red Hat Enterprise Linux 4 does not properly handle certain environment variables when /sbin/service is executed, which allows local users with sudo permissions for /sbin/service to gain root privileges via unknown vectors...

Fedora Core 4 : sudo-1.6.8p8-2.4 (2005-1147)

Sat Dec 16 2006 Karel Zak 1.6.8p8-2.4 - fix 175295 - SECURITY: CRM 764618: Perl scripts run via Sudo can be subverted Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and...