7.2

CVE-2004-1051

sudo before 1.6.8p2 allows local users to execute arbitrary commands by using "()" style environment variables to create functions that have the same name as any program within the bash script that is called without using the program's full pathname.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Todd Miller ≫ Sudo Version 1.5.6
Todd Miller ≫ Sudo Version 1.5.7
Todd Miller ≫ Sudo Version 1.5.8
Todd Miller ≫ Sudo Version 1.5.9
Todd Miller ≫ Sudo Version 1.6
Todd Miller ≫ Sudo Version 1.6.1
Todd Miller ≫ Sudo Version 1.6.2
Todd Miller ≫ Sudo Version 1.6.3
Todd Miller ≫ Sudo Version 1.6.3_p1
Todd Miller ≫ Sudo Version 1.6.3_p2
Todd Miller ≫ Sudo Version 1.6.3_p3
Todd Miller ≫ Sudo Version 1.6.3_p4
Todd Miller ≫ Sudo Version 1.6.3_p5
Todd Miller ≫ Sudo Version 1.6.3_p6
Todd Miller ≫ Sudo Version 1.6.3_p7
Todd Miller ≫ Sudo Version 1.6.4
Todd Miller ≫ Sudo Version 1.6.4_p1
Todd Miller ≫ Sudo Version 1.6.4_p2
Todd Miller ≫ Sudo Version 1.6.5
Todd Miller ≫ Sudo Version 1.6.5_p1
Todd Miller ≫ Sudo Version 1.6.5_p2
Todd Miller ≫ Sudo Version 1.6.6
Todd Miller ≫ Sudo Version 1.6.7
Todd Miller ≫ Sudo Version 1.6.8
Todd Miller ≫ Sudo Version 1.6.8_p1
Debian ≫ Debian Linux Version 3.0 Edition alpha
Debian ≫ Debian Linux Version 3.0 Edition arm
Debian ≫ Debian Linux Version 3.0 Edition hppa
Debian ≫ Debian Linux Version 3.0 Edition ia-32
Debian ≫ Debian Linux Version 3.0 Edition ia-64
Debian ≫ Debian Linux Version 3.0 Edition m68k
Debian ≫ Debian Linux Version 3.0 Edition mips
Debian ≫ Debian Linux Version 3.0 Edition mipsel
Debian ≫ Debian Linux Version 3.0 Edition ppc
Debian ≫ Debian Linux Version 3.0 Edition s-390
Debian ≫ Debian Linux Version 3.0 Edition sparc
Mandrakesoft ≫ Mandrake Linux Version 9.2
Mandrakesoft ≫ Mandrake Linux Version 9.2 Edition amd64
Mandrakesoft ≫ Mandrake Linux Version 10.0
Mandrakesoft ≫ Mandrake Linux Version 10.0 Edition amd64
Mandrakesoft ≫ Mandrake Linux Version 10.1
Mandrakesoft ≫ Mandrake Linux Version 10.1 Edition x86_64
Mandrakesoft ≫ Mandrake Linux Corporate Server Version 2.1 Edition x86_64
Trustix ≫ Secure Linux Version 1.5
Trustix ≫ Secure Linux Version 2.0
Trustix ≫ Secure Linux Version 2.1
Trustix ≫ Secure Linux Version 2.2
Ubuntu ≫ Ubuntu Linux Version 4.1 Edition ia64
Ubuntu ≫ Ubuntu Linux Version 4.1 Edition ppc
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.37% 0.684
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://lists.apple.com/archives/security-announce/2005/May/msg00001.html
http://www.trustix.org/errata/2004/0061/
http://marc.info/?l=bugtraq&m=110028877431192&w=2
http://marc.info/?l=bugtraq&m=110598298225675&w=2
http://www.debian.org/security/2004/dsa-596
http://www.mandriva.com/security/advisories?name=MDKSA-2004:133
http://www.securityfocus.com/bid/11668
Patch
Vendor Advisory
http://www.sudo.ws/sudo/alerts/bash_functions.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/18055
https://www.ubuntu.com/usn/usn-28-1/