CVE-2014-0106
Fixed in a distro release EPSS <1%
Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.
Products: apple mac_os_x, todd_miller sudo
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | sudo | 1.8.5p2-1 |
| Debian 13 | sudo | 1.8.5p2-1 |
| Debian 14 | sudo | 1.8.5p2-1 |
| Debian 6.0 | sudo | 1.7.4p4-2.squeeze.5 |
| Red Hat Enterprise Linux 5 | sudo | 0:1.7.2p1-29.el5_10 |
| Red Hat Enterprise Linux 5 | sudo-debuginfo | 0:1.7.2p1-29.el5_10 |