CVE-2004-1051
High
Description
sudo before 1.6.8p2 allows local users to execute arbitrary commands by using "()" style environment variables to create functions that have the same name as any program within the bash script that is called without using the program's full pathname.
SeverityHigh
CVSS7.2
Exploit probability—
Product
Todd Miller Sudo
PublishedMar 1, 2005
First seenMar 1, 2005
How to fix
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| todd_miller sudo | 1.5.6, 1.5.7, 1.5.8, 1.5.9, 1.6, 1.6.1, 1.6.2, 1.6.3, 1.6.3_p1, 1.6.3_p2, 1.6.3_p3, 1.6.3_p4, 1.6.3_p5, 1.6.3_p6, 1.6.3_p7, 1.6.4, 1.6.4_p1, 1.6.4_p2, 1.6.5, 1.6.5_p1, 1.6.5_p2, 1.6.6, 1.6.7, 1.6.8, 1.6.8_p1 | — |
| mandrakesoft mandrake_multi_network_firewall | 8.2 | — |
| debian debian_linux | 3.0 | — |
| mandrakesoft mandrake_linux | 9.2, 10.0, 10.1 | — |
| mandrakesoft mandrake_linux_corporate_server | 2.1 | — |
| trustix secure_linux | 1.5, 2.0, 2.1, 2.2 | — |
| ubuntu ubuntu_linux | 4.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.