CVE-2004-1689

published 2004-09-16

CVE-2004-1689: sudoedit (aka sudo -e) in sudo 1.6.8 opens a temporary file with root privileges, which allows local users to read arbitrary files via a symlink attack on the…

low 2.1 CVSS 3.1

AV L AC L Au N C P I N A N

EXPLOIT

sudoedit (aka sudo -e) in sudo 1.6.8 opens a temporary file with root privileges, which allows local users to read arbitrary files via a symlink attack on the temporary file before quitting sudoedit.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	sudo	< sudo 1.6.8p3-1 (bookworm)	sudo 1.6.8p3-1 (bookworm)
sudo_project	sudo	>= 0 < 1.6.8p3-1	1.6.8p3-1
sudo_project	sudo	>= 0 < 1.6.8p3-1	1.6.8p3-1
sudo_project	sudo	>= 0 < 1.6.8p3-1	1.6.8p3-1
sudo_project	sudo	>= 0 < 1.6.8p3-1	1.6.8p3-1
todd_miller	sudo	—	—

CVSS provenance

nvd 2.1 LOW AV:L/AC:L/Au:N/C:P/I:N/A:N

osv 2.1 LOW