Authorization Bypass

2019-01-1508:58:20

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

6.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:S/C:C/I:C/A:C

JSON

sudo is vulnerable to authorization bypass attacks. The vulnerability exists as Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.

CPENameOperatorVersion
sudoeq1.7.2p1__9.el5_5
sudoeq1.7.2p1__13.el5
sudoeq1.7.2p1__10.el5
sudoeq1.7.2p1__28.el5
sudoeq1.6.9p17__3.el5_3.1
sudoeq1.6.9p17__3.el5
sudoeq1.7.2p1__14.el5_8.4
sudoeq1.6.9p17__5.el5
sudoeq1.7.2p1__8.el5_5
sudoeq1.7.2p1__14.el5_8.3

Name	Operator	Version
sudo	eq	1.7.2p1__9.el5_5
sudo	eq	1.7.2p1__13.el5
sudo	eq	1.7.2p1__10.el5
sudo	eq	1.7.2p1__28.el5
sudo	eq	1.6.9p17__3.el5_3.1
sudo	eq	1.6.9p17__3.el5
sudo	eq	1.7.2p1__14.el5_8.4
sudo	eq	1.6.9p17__5.el5
sudo	eq	1.7.2p1__8.el5_5
sudo	eq	1.7.2p1__14.el5_8.3