6.6

CVE-2014-0106

Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apple ≫ macOS X Version <= 10.10.4
Todd Miller ≫ Sudo Version 1.6.9
Todd Miller ≫ Sudo Version 1.6.9p20
Todd Miller ≫ Sudo Version 1.6.9p21
Todd Miller ≫ Sudo Version 1.6.9p22
Todd Miller ≫ Sudo Version 1.6.9p23
Todd Miller ≫ Sudo Version 1.7.0
Todd Miller ≫ Sudo Version 1.7.1
Todd Miller ≫ Sudo Version 1.7.2
Todd Miller ≫ Sudo Version 1.7.2p1
Todd Miller ≫ Sudo Version 1.7.2p2
Todd Miller ≫ Sudo Version 1.7.2p3
Todd Miller ≫ Sudo Version 1.7.2p4
Todd Miller ≫ Sudo Version 1.7.2p5
Todd Miller ≫ Sudo Version 1.7.2p6
Todd Miller ≫ Sudo Version 1.7.2p7
Todd Miller ≫ Sudo Version 1.7.3b1
Todd Miller ≫ Sudo Version 1.7.4
Todd Miller ≫ Sudo Version 1.7.4p1
Todd Miller ≫ Sudo Version 1.7.4p2
Todd Miller ≫ Sudo Version 1.7.4p3
Todd Miller ≫ Sudo Version 1.7.4p4
Todd Miller ≫ Sudo Version 1.7.4p5
Todd Miller ≫ Sudo Version 1.7.4p6
Todd Miller ≫ Sudo Version 1.7.5
Todd Miller ≫ Sudo Version 1.7.6
Todd Miller ≫ Sudo Version 1.7.6p1
Todd Miller ≫ Sudo Version 1.7.6p2
Todd Miller ≫ Sudo Version 1.7.7
Todd Miller ≫ Sudo Version 1.7.8
Todd Miller ≫ Sudo Version 1.7.8p1
Todd Miller ≫ Sudo Version 1.7.8p2
Todd Miller ≫ Sudo Version 1.7.9
Todd Miller ≫ Sudo Version 1.7.9p1
Todd Miller ≫ Sudo Version 1.7.10
Todd Miller ≫ Sudo Version 1.7.10p1
Todd Miller ≫ Sudo Version 1.7.10p2
Todd Miller ≫ Sudo Version 1.7.10p3
Todd Miller ≫ Sudo Version 1.7.10p4
Todd Miller ≫ Sudo Version 1.7.10p5
Todd Miller ≫ Sudo Version 1.7.10p6
Todd Miller ≫ Sudo Version 1.7.10p7
Todd Miller ≫ Sudo Version 1.7.10p8
Todd Miller ≫ Sudo Version 1.7.10p9
Todd Miller ≫ Sudo Version 1.7.10p10
Todd Miller ≫ Sudo Version 1.8.0
Todd Miller ≫ Sudo Version 1.8.1
Todd Miller ≫ Sudo Version 1.8.1p1
Todd Miller ≫ Sudo Version 1.8.1p2
Todd Miller ≫ Sudo Version 1.8.2
Todd Miller ≫ Sudo Version 1.8.3
Todd Miller ≫ Sudo Version 1.8.3p1
Todd Miller ≫ Sudo Version 1.8.3p2
Todd Miller ≫ Sudo Version 1.8.4
Todd Miller ≫ Sudo Version 1.8.4p1
Todd Miller ≫ Sudo Version 1.8.4p2
Todd Miller ≫ Sudo Version 1.8.4p3
Todd Miller ≫ Sudo Version 1.8.4p4
Todd Miller ≫ Sudo Version 1.8.4p5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.34% 0.254
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.6 2.7 10
AV:L/AC:M/Au:S/C:C/I:C/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
https://support.apple.com/kb/HT205031
Vendor Advisory
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00003.html
http://rhn.redhat.com/errata/RHSA-2014-0266.html
http://www.openwall.com/lists/oss-security/2014/03/06/2
http://www.securityfocus.com/bid/65997
http://www.sudo.ws/sudo/alerts/env_add.html
Patch
Vendor Advisory
http://www.ubuntu.com/usn/USN-2146-1