NetSight
IP …
medium6.6

CVE-2014-0106

Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users wit…

Impact

Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.

Affected products

VendorProductAffected versions
AppleMac Os X
through 10.10.4
Todd MillerSudo
Versions 1.6.9, 1.6.9p20, 1.6.9p21, 1.6.9p22, 1.6.9p23, 1.7.0

Weakness classification

CWE-20

References