Bug 18878

Summary:	Sudo doesn't clean LANG / LC_xxx environment -> possible to exploit locales.
Product:	[Retired] Red Hat Powertools	Reporter:	Jarno Huuskonen <jarno.huuskonen>
Component:	sudo	Assignee:	Bernhard Rosenkraenzer <bero>
Status:	CLOSED RAWHIDE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	6.2	CC:	dr
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2000-10-11 10:14:46 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jarno Huuskonen 2000-10-11 09:28:28 UTC

Hi,

Sudo doesn't clean LANG / LC_xxx environment. So users can use
something like LANG=../../../tmp and if they can run a program with
higher privileges --> possible to exploit. To fix this sudo should clean
LANG / LC_xxx if they contain '/' (like the new userhelper does).

-Jarno

PS. Users can exploit this only if they can run the programs with sudo and
the program has i18n support.

Comment 1 Bernhard Rosenkraenzer 2000-10-11 10:14:41 UTC

*** Bug 18825 has been marked as a duplicate of this bug. ***

Comment 2 Bernhard Rosenkraenzer 2000-10-11 10:15:16 UTC

Done in 1.6.3p5-2

Comment 3 Daniel Roesen 2000-10-13 15:22:26 UTC

Hm, am I wrong or would this justify a security errata update instead of just 
rawhide?

Changing severity to "security".