sudo before 1.6.8p2 allows local users to execute arbitrary commands by using "()" style environment variables to create functions that have the same name as any program within the bash script that is called without using the program's full pathname.

The remote host is missing Security Update 2005-005. This security
update contains security fixes for the following application :

- Apache
- AppKit
- AppleScript
- Bluetooth
- Directory Services
- Finder
- Foundation
- HelpViewer
- LDAP
- libXpm
- lukemftpd
- NetInfo
- ServerAdmin
- sudo
- Terminal
- VPN 

The remote host is missing Security Update 2005-005. This security update contains fixes for the following applications :

  - Apache
  - AppKit
  - AppleScript
  - Bluetooth
  - Directory Services
  - Finder
  - Foundation
  - HelpViewer
  - LDAP
  - libXpm
  - lukemftpd
  - NetInfo
  - ServerAdmin
  - sudo
  - Terminal
  - VPN

These programs have multiple vulnerabilities that could allow a remote attacker to execute arbitrary code.

Liam Helmer noticed that sudo, a program that provides limited super user privileges to specific users, does not clean the environment sufficiently. Bash functions and the CDPATH variable are still passed through to the program running as privileged user, leaving possibilities to overload system routines. These vulnerabilities can only be exploited by users who have been granted limited super user privileges.

Liam Helmer discovered a flow in sudo's environment sanitizing. This flaw could allow a malicious users with permission to run a shell script that uses the bash shell to run arbitrary commands.

The problem is fixed in sudo 1.6.8p2; the provided packages have been patched to correct the issue.

ID	Name	Product	Family	Type	Severity
2878	Mac OS X Multiple Vulnerabilities (Security Update 2005-005)	Nessus Network Monitor	Web Clients		high
18189	Mac OS X Multiple Vulnerabilities (Security Update 2005-005)	Nessus	MacOS X Local Security Checks	Local	high
15825	Debian DSA-596-2 : sudo - missing input sanitising	Nessus	Debian Local Security Checks	Local	high
15738	Mandrake Linux Security Advisory : sudo (MDKSA-2004:133)	Nessus	Mandriva Local Security Checks	Local	high

Detections

Analytics

CVE-2004-1051

high

Tenable Plugins

high

high

high

high