CVE-2005-2959

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2005-2959
Incomplete blacklist vulnerability in sudo 1.6.8 and earlier allows local users to gain privileges via the (1) SHELLOPTS and (2) PS4 environment variables before executing a bash script on behalf of another user, which are not cleared even though other variables are.

4.6 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://docs.info.apple.com/article.html?artnum=305214
http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html
http://secunia.com/advisories/17318 Vendor Advisory
http://secunia.com/advisories/17322 Vendor Advisory
http://secunia.com/advisories/17345 Vendor Advisory
http://secunia.com/advisories/17390 Patch Vendor Advisory
http://secunia.com/advisories/17666 Vendor Advisory
http://secunia.com/advisories/18549 Vendor Advisory
http://secunia.com/advisories/24479 Vendor Advisory
http://www.debian.org/security/2005/dsa-870 Patch Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2005:201
http://www.novell.com/linux/security/advisories/2006_02_sr.html
http://www.openpkg.org/security/OpenPKG-SA-2006.002-sudo.html
http://www.securityfocus.com/advisories/9643 Vendor Advisory
http://www.securityfocus.com/bid/15191 Exploit
http://www.sudo.ws/bugs/show_bug.cgi?id=182
http://www.us-cert.gov/cas/techalerts/TA07-072A.html US Government Resource
http://www.vupen.com/english/advisories/2007/0930 Vendor Advisory
https://usn.ubuntu.com/213-1/
http://docs.info.apple.com/article.html?artnum=305214
http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html
http://secunia.com/advisories/17318 Vendor Advisory
http://secunia.com/advisories/17322 Vendor Advisory
http://secunia.com/advisories/17345 Vendor Advisory
http://secunia.com/advisories/17390 Patch Vendor Advisory
http://secunia.com/advisories/17666 Vendor Advisory
http://secunia.com/advisories/18549 Vendor Advisory
http://secunia.com/advisories/24479 Vendor Advisory
http://www.debian.org/security/2005/dsa-870 Patch Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2005:201
http://www.novell.com/linux/security/advisories/2006_02_sr.html
http://www.openpkg.org/security/OpenPKG-SA-2006.002-sudo.html
http://www.securityfocus.com/advisories/9643 Vendor Advisory
http://www.securityfocus.com/bid/15191 Exploit
http://www.sudo.ws/bugs/show_bug.cgi?id=182
http://www.us-cert.gov/cas/techalerts/TA07-072A.html US Government Resource
http://www.vupen.com/english/advisories/2007/0930 Vendor Advisory
https://usn.ubuntu.com/213-1/
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:todd_miller:sudo:1.6:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.1:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.2:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.3:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.3_p1:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.3_p2:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.3_p3:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.3_p4:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.3_p5:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.3_p6:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.3_p7:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.3p1:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.3p2:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.3p3:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.3p4:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.3p5:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.3p6:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.3p7:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.4:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.4_p1:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.4_p2:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.4p1:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.4p2:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.5:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.5_p1:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.5_p2:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.5p1:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.5p2:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.6:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.7:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.7_p5:*:*:*:*:*:*:*
cpe:2.3:a:todd_miller:sudo:1.6.8:*:*:*:*:*:*:*
History

21 Nov 2024, 00:00

Type Values Removed Values Added
References () http://docs.info.apple.com/article.html?artnum=305214 - () http://docs.info.apple.com/article.html?artnum=305214 -
References () http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html - () http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html -
References () http://secunia.com/advisories/17318 - Vendor Advisory () http://secunia.com/advisories/17318 - Vendor Advisory
References () http://secunia.com/advisories/17322 - Vendor Advisory () http://secunia.com/advisories/17322 - Vendor Advisory
References () http://secunia.com/advisories/17345 - Vendor Advisory () http://secunia.com/advisories/17345 - Vendor Advisory
References () http://secunia.com/advisories/17390 - Patch, Vendor Advisory () http://secunia.com/advisories/17390 - Patch, Vendor Advisory
References () http://secunia.com/advisories/17666 - Vendor Advisory () http://secunia.com/advisories/17666 - Vendor Advisory
References () http://secunia.com/advisories/18549 - Vendor Advisory () http://secunia.com/advisories/18549 - Vendor Advisory
References () http://secunia.com/advisories/24479 - Vendor Advisory () http://secunia.com/advisories/24479 - Vendor Advisory
References () http://www.debian.org/security/2005/dsa-870 - Patch, Vendor Advisory () http://www.debian.org/security/2005/dsa-870 - Patch, Vendor Advisory
References () http://www.mandriva.com/security/advisories?name=MDKSA-2005:201 - () http://www.mandriva.com/security/advisories?name=MDKSA-2005:201 -
References () http://www.novell.com/linux/security/advisories/2006_02_sr.html - () http://www.novell.com/linux/security/advisories/2006_02_sr.html -
References () http://www.openpkg.org/security/OpenPKG-SA-2006.002-sudo.html - () http://www.openpkg.org/security/OpenPKG-SA-2006.002-sudo.html -
References () http://www.securityfocus.com/advisories/9643 - Vendor Advisory () http://www.securityfocus.com/advisories/9643 - Vendor Advisory
References () http://www.securityfocus.com/bid/15191 - Exploit () http://www.securityfocus.com/bid/15191 - Exploit
References () http://www.sudo.ws/bugs/show_bug.cgi?id=182 - () http://www.sudo.ws/bugs/show_bug.cgi?id=182 -
References () http://www.us-cert.gov/cas/techalerts/TA07-072A.html - US Government Resource () http://www.us-cert.gov/cas/techalerts/TA07-072A.html - US Government Resource
References () http://www.vupen.com/english/advisories/2007/0930 - Vendor Advisory () http://www.vupen.com/english/advisories/2007/0930 - Vendor Advisory
References () https://usn.ubuntu.com/213-1/ - () https://usn.ubuntu.com/213-1/ -
Information

Published : 2005-10-25 16:02

Updated : 2024-11-21 00:00

NVD link : CVE-2005-2959

Mitre link : CVE-2005-2959

CVE.ORG link : CVE-2005-2959

JSON object : View

Products Affected

todd_miller

  • sudo
CWE
CWE-264

Permissions, Privileges, and Access Controls