← Back

CVE-2005-2959

nvd nist
Published: Oct 25, 2005Modified: Apr 16, 2026

JSON object

Loading...
4.6
Vector
AV:L/AC:L/Au:N/C:P/I:P/A:P
Exploitability: 3.9 / Impact: 6.4
Source: NVD

Description

Incomplete blacklist vulnerability in sudo 1.6.8 and earlier allows local users to gain privileges via the (1) SHELLOPTS and (2) PS4 environment variables before executing a bash script on behalf of another user, which are not cleared even though other variables are.

Affected (32)

Products: Todd Miller: Sudo
Todd Miller
1 product
Sudo
Configuration A
32 vulnerable
Vulnerable SoftwareAffected Versions
Todd Miller
Sudo
Version 1.6.1
Sudo
Version 1.6.2
Sudo
Version 1.6.3
Sudo
Version 1.6.3_p1
Sudo
Version 1.6.3_p2
Sudo
Version 1.6.3_p3
Sudo
Version 1.6.3_p4
Sudo
Version 1.6.3_p5
Sudo
Version 1.6.3_p6
Sudo
Version 1.6.3_p7
Sudo
Version 1.6.3p1
Sudo
Version 1.6.3p2
Sudo
Version 1.6.3p3
Sudo
Version 1.6.3p4
Sudo
Version 1.6.3p5
Sudo
Version 1.6.3p6
Sudo
Version 1.6.3p7
Sudo
Version 1.6.4
Sudo
Version 1.6.4_p1
Sudo
Version 1.6.4_p2
Sudo
Version 1.6.4p1
Sudo
Version 1.6.4p2
Sudo
Version 1.6.5
Sudo
Version 1.6.5_p1
Sudo
Version 1.6.5_p2
Sudo
Version 1.6.5p1
Sudo
Version 1.6.5p2
Sudo
Version 1.6.6
Sudo
Version 1.6.7
Sudo
Version 1.6.7_p5
Sudo
Version 1.6.8
Sudo
Version 1.6

Related CWEs

CWE-264
CWE-264

References (38)

Source: security@debian.org
Source: security@debian.org
Source: security@debian.org
Vendor Advisory
Source: security@debian.org
Vendor Advisory
Source: security@debian.org
Vendor Advisory
Source: security@debian.org
PatchVendor Advisory
Source: security@debian.org
Vendor Advisory
Source: security@debian.org
Vendor Advisory
Source: security@debian.org
Vendor Advisory
Source: security@debian.org
PatchVendor Advisory
Source: security@debian.org
Source: security@debian.org
Source: security@debian.org
Source: security@debian.org
Vendor Advisory
Source: security@debian.org
Exploit
Source: security@debian.org
Source: security@debian.org
US Government Resource
Source: security@debian.org
Vendor Advisory
Source: security@debian.org
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
US Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.