CVE-2005-2959

CWE-2647 documents7 sources

Severity

4.6MEDIUM

EPSS

0.1%

top 67.80%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Todd Miller Sudo

Timeline

PublishedOct 25

Latest updateMay 1

Description

Incomplete blacklist vulnerability in sudo 1.6.8 and earlier allows local users to gain privileges via the (1) SHELLOPTS and (2) PS4 environment variables before executing a bash script on behalf of another user, which are not cleared even though other variables are.

CVSS vector

AV:L/AC:L/C:P/I:P/A:PExploitability: 3.9 | Impact: 6.4

Affected Packages2 packages

▶Debiansudo< 1.6.8p9-3+3

▶NVDtodd_miller/sudo32 versions+31

Patches

Patch: secunia.com ↗Patch: www.debian.org ↗Patch: secunia.com ↗

🔴Vulnerability Details

GHSA

GHSA-xq6m-vcfr-h89q: Incomplete blacklist vulnerability in sudo 1↗2022-05-01

▶

OSV

CVE-2005-2959: Incomplete blacklist vulnerability in sudo 1↗2005-10-25

▶

CVEList

CVE-2005-2959: Incomplete blacklist vulnerability in sudo 1↗2005-10-25

▶

📋Vendor Advisories

Ubuntu

sudo vulnerability↗2005-10-28

▶

Debian

CVE-2005-2959: sudo - Incomplete blacklist vulnerability in sudo 1.6.8 and earlier allows local users ...↗2005

▶

Red Hat

CVE-2005-2959: Incomplete blacklist vulnerability in sudo 1↗

▶