NetSight
IP …
medium6.2

CVE-2010-1646

The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an environment that contains multiple PATH v…

Impact

The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an environment that contains multiple PATH variables, which might allow local users to gain privileges via a crafted value of the last PATH variable.

Affected products

VendorProductAffected versions
Todd MillerSudo
Versions 1.3.1, 1.6, 1.6.1, 1.6.2, 1.6.2p1, 1.6.2p2

Weakness classification

CWE-264

References