5646 matches found
Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.10 : sudo vulnerabilities (USN-2146-1)
Sebastien Macke discovered that Sudo incorrectly handled blacklisted environment variables when the envreset option was disabled. A local attacker could use this issue to possibly run unintended commands by using blacklisted environment variables. In a default Ubuntu installation, the envreset...
USN-2146-1: Sudo vulnerabilities
Sebastien Macke discovered that Sudo incorrectly filtered environment variables when the envreset option was disabled. A local attacker could use this issue to possibly run unintended commands by using environment variables that were intended to be blocked. In a default Ubuntu installation, the...
RedHat Update for sudo RHSA-2014:0266-01
Check for the Version of sudo OpenVAS Vulnerability Test RedHat Update for sudo RHSA-2014:0266-01 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms o...
Todd Miller Sudo 'validate_env_vars()'本地权限提升漏洞
BUGTRAQ ID: 65997 CVECAN ID: CVE-2014-0106 Sudo是允许系统管理员让普通用户执行一些或者全部的root命令的一个工具，减少了root用户的登陆和管理时间，提高了安全性。 sudo 1.6.9-1.8.4p5版本启用后envreset后，没有正确过滤某些环境变量，在实现上存在本地权限提升漏洞，本地攻击者可利用此漏洞以提升的权限运行任意命令。 0 Todd Miller Sudo 1.6.9 - 1.8.4p5 厂商补丁： Todd Miller ----------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
CentOS Update for sudo CESA-2014:0266 centos5
Check for the Version of sudo OpenVAS Vulnerability Test CentOS Update for sudo CESA-2014:0266 centos5 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...
RedHat Update for sudo RHSA-2014:0266-01
The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CentOS Update for sudo CESA-2014:0266 centos5
The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
DEBIAN-CVE-2014-0106
Sudo 1.6.9 before 1.8.5, when envreset is disabled, does not properly check environment variables for the envdelete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable...
CVE-2014-0106
Sudo 1.6.9 before 1.8.5, when envreset is disabled, does not properly check environment variables for the envdelete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable...
CVE-2014-0106
Sudo 1.6.9 before 1.8.5, when envreset is disabled, does not properly check environment variables for the envdelete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable...
Command injection
Sudo 1.6.9 before 1.8.5, when envreset is disabled, does not properly check environment variables for the envdelete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable...
CVE-2014-0106
Sudo 1.6.9 before 1.8.5, when envreset is disabled, does not properly check environment variables for the envdelete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable...
CVE-2014-0106
CVE-2014-0106 affects Sudo up to version 1.8.5 where env_reset is disabled, and env_delete checks fail to properly sanitize environment variables. This allows local users with sudo permissions to bypass intended command restrictions via crafted environment variables. The vulnerability is tied to ...
CVE-2014-0106
Sudo 1.6.9 before 1.8.5, when envreset is disabled, does not properly check environment variables for the envdelete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable...
CVE-2014-0106
Sudo 1.6.9 before 1.8.5, when envreset is disabled, does not properly check environment variables for the envdelete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable...
Scientific Linux Security Update : sudo on SL5.x i386/x86_64 (20140310)
A flaw was found in the way sudo handled its blacklist of environment variables. When the 'envreset' option was disabled, a user permitted to run certain commands via sudo could use this flaw to run such a command with one of the blacklisted environment variables set, allowing them to run an...
RHEL 5 : sudo (RHSA-2014:0266)
An updated sudo package that fixes one security issue is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
CVE-2014-0106
Sudo 1.6.9 before 1.8.5, when envreset is disabled, does not properly check environment variables for the envdelete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable...
Oracle Linux 5 : sudo (ELSA-2014-0266)
The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2014-0266 advisory. 1.7.2p1-29 - added patch for CVE-2014-0106: certain environment variables not sanitized when envreset is disabled Resolves: rhbz1072210 Tenable has extracted th...
CVE-2014-0106: Improper Input Validation
Sudo 1.6.9 before 1.8.5, when envreset is disabled, does not properly check environment variables for the envdelete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable...