Bug 139671

Summary:	CAN-2004-1051 Bash scripts run via Sudo can be subverted
Product:	Red Hat Enterprise Linux 3	Reporter:	Richard Leyton <richard.leyton>
Component:	sudo	Assignee:	Karel Zak <kzak>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	medium
Version:	3.0	CC:	bressers, redhat
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://www.sudo.ws/sudo/alerts/bash_functions.html
Whiteboard:	impact=low,public=20041111
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-05-10 13:42:33 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Richard Leyton 2004-11-17 12:20:07 UTC

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5)
Gecko/20041107 Firefox/1.0

Description of problem:
A flaw in exists in sudo's environment sanitizing prior to sudo
version 1.6.8p2 that could allow a malicious user with permission to
run a shell script that utilized the bash shell to run arbitrary
commands. The /bin/sh shell on most (if not all) Linux systems is bash.

Version-Release number of selected component (if applicable):
sudo-1.6.7p5-1

How reproducible:
Always

Steps to Reproduce:
See URL: http://www.sudo.ws/sudo/alerts/bash_functions.html

Actual Results:  Local user gains root privs

Additional info:

Comment 1 Josh Bressers 2004-11-18 10:58:58 UTC

Please see bug 139478 for additional information regarding this issue.