sudo vulnerability

2010-06-30T00:00:00
ID USN-956-1
Type ubuntu
Reporter Ubuntu
Modified 2010-06-30T00:00:00

Description

Evan Broder and Anders Kaseorg discovered that sudo did not properly sanitize its environment when configured to use secure_path (the default in Ubuntu). A local attacker could exploit this to execute arbitrary code as root if sudo was configured to allow the attacker to use a program that interpreted the PATH environment variable.