From Bugzilla Helper: User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0 Description of problem: A flaw in exists in sudo's environment sanitizing prior to sudo version 1.6.8p2 that could allow a malicious user with permission to run a shell script that utilized the bash shell to run arbitrary commands. The /bin/sh shell on most (if not all) Linux systems is bash. Version-Release number of selected component (if applicable): sudo-1.6.7p5-1 How reproducible: Always Steps to Reproduce: See URL: http://www.sudo.ws/sudo/alerts/bash_functions.html Actual Results: Local user gains root privs Additional info:
Please see bug 139478 for additional information regarding this issue.