The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an environment that contains multiple PATH variables, which might allow local users to gain privileges via a crafted value of the last PATH variable.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 01:14
Type | Values Removed | Values Added |
---|---|---|
References | () http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042838.html - | |
References | () http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043012.html - | |
References | () http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043026.html - | |
References | () http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html - | |
References | () http://secunia.com/advisories/40002 - Vendor Advisory | |
References | () http://secunia.com/advisories/40188 - | |
References | () http://secunia.com/advisories/40215 - | |
References | () http://secunia.com/advisories/40508 - | |
References | () http://secunia.com/advisories/43068 - | |
References | () http://security.gentoo.org/glsa/glsa-201009-03.xml - | |
References | () http://wiki.rpath.com/Advisories:rPSA-2010-0075 - | |
References | () http://www.debian.org/security/2010/dsa-2062 - | |
References | () http://www.mandriva.com/security/advisories?name=MDVSA-2010:118 - | |
References | () http://www.osvdb.org/65083 - | |
References | () http://www.redhat.com/support/errata/RHSA-2010-0475.html - | |
References | () http://www.securityfocus.com/archive/1/514489/100/0/threaded - | |
References | () http://www.securityfocus.com/bid/40538 - | |
References | () http://www.securitytracker.com/id?1024101 - | |
References | () http://www.sudo.ws/repos/sudo/rev/3057fde43cf0 - Exploit, Patch | |
References | () http://www.sudo.ws/repos/sudo/rev/a09c6812eaec - Exploit, Patch | |
References | () http://www.sudo.ws/sudo/alerts/secure_path.html - Vendor Advisory | |
References | () http://www.vupen.com/english/advisories/2010/1452 - | |
References | () http://www.vupen.com/english/advisories/2010/1478 - | |
References | () http://www.vupen.com/english/advisories/2010/1518 - | |
References | () http://www.vupen.com/english/advisories/2010/1519 - | |
References | () http://www.vupen.com/english/advisories/2011/0212 - | |
References | () https://bugzilla.redhat.com/show_bug.cgi?id=598154 - | |
References | () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10580 - | |
References | () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7338 - |
Information
Published : 2010-06-07 17:12
Updated : 2024-11-21 01:14
NVD link : CVE-2010-1646
Mitre link : CVE-2010-1646
CVE.ORG link : CVE-2010-1646
JSON object : View
Products Affected
todd_miller
- sudo
CWE
CWE-264
Permissions, Privileges, and Access Controls