Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   


Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker

Category:   Application (Security)  >   Sudo Vendors:
Sudo Environment Variable Validation Error May Let Local Users Run Arbitrary Commands
SecurityTracker Alert ID:  1012224
SecurityTracker URL:
CVE Reference:   CAN-2004-1051   (Links to External Site)
Updated:  Nov 24 2004
Original Entry Date:  Nov 13 2004
Impact:   Execution of arbitrary code via local system, User access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 1.6.8p2
Description:   A vulnerability was reported in sudo. A local user may be able to run arbitrary shell commands.

Liam Helmer reported that the software does not properly validate environment variables. If the bash shell is installed on the target system and the local user has permission to execute bash scripts, then the local user can exploit a sudo feature to substitute arbitrary commands in any non-fully qualified programs called from the bash script.

Impact:   A local user may be able to execute arbitrary commands on the target system.
Solution:   The vendor has released a fixed version (1.6.8p2), available at:

Vendor URL: (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Nov 17 2004 (Mandrake Issues Fix) Sudo Environment Variable Validation Error May Let Local Users Run Arbitrary Commands
Mandrake has released a fix.
Nov 24 2004 (Debian Issues Fix) Sudo Environment Variable Validation Error May Let Local Users Run Arbitrary Commands
Debian has released a fix.
May 4 2005 (Apple Issues Fix) Sudo Environment Variable Validation Error May Let Local Users Run Arbitrary Commands
Apple has released a fix for Mac OS X.

 Source Message Contents

Subject:  Sudo version 1.6.8p2 now available (fwd)

---------- Forwarded message ----------
Date: Fri, 12 Nov 2004 09:21:07 -0700
From: Todd C. Miller <>
Subject: [sudo-announce] Sudo version 1.6.8p2 now available

Sudo version 1.6.8, patchlevel 2 is now available.  It includes a fix
for a security flaw in sudo's environment cleaning that could give a
malicious user with sudo access to a bash script the ability to run
arbitrary commands.  See
for more details.

Changes since Sudo 1.6.8p1:

 o Bash exported functions and the CDPATH variable are now stripped from
   the environment passed to the program to be executed.

Commercial support is now available for Sudo.  If your organization
uses Sudo please consider purchasing a support contract to help
fund additional Sudo development at
Custom enhancements to Sudo may also be contracted.

You can also help out by "purchasing" a copy of Sudo or making a
donation at

Sudo is still free software and I intend for it to remain so but
as I currently lack regular employment I am asking for help from
the Sudo community.  Your support will enable me to continue to
improve Sudo and complete projects such as a proper user's manual
and a major rewrite of large portions of Sudo (currently underway).

Master Web Site:

Web Site Mirrors: (Los Angeles, California, USA) (Fanwood, New Jersey, USA) (Bend, Oregon, USA) (USA) (Argentina) (Australia) (Latvia) (Kaunas, Lithuania) (Russia) (Taiwan)

FTP Mirrors: (Boulder, Colorado, USA) (Boulder, Colorado, USA) (Redwood City, California, USA) (Los Angeles, California, USA) (Beltsville, Maryland, USA) (West Lafayette, Indiana, USA) (Bloomington, Indiana, USA) (Rochester, New York, USA) (Argentina) (Australia) (Austria) (Alberta, Canada) (Hong Kong, China) (Czechoslovakia) (France) (Frankfurt, Germany) (Japan) (Japan) (Japan) (Japan) (Japan) (Poland) (Russia) (Taiwan)

HTTP Mirrors: (Rochester, New York, USA) (East Coast, USA) (West Lafayette, Indiana, USA) (California, USA) (Frankfurt, Germany) (Japan) (Japan) (Poland) (Moscow, Russian Federation) (Taiwan)
sudo-announce mailing list <>
For list information, options, or to unsubscribe, visit:


Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

Copyright 2017, LLC