CVE-2004-1051

sudo before 1.6.8p2 allows local users to execute arbitrary commands by using () style environment variables to create functions that have the same name as any program within the bash script that is called without using the programs full pathname.

Affected Software

Name	Vendor	Start Version	End Version
Mandrake_multi_network_firewall	Mandrakesoft	8.2 (including)	8.2 (including)
Sudo	Todd_miller	1.5.6 (including)	1.5.6 (including)
Sudo	Todd_miller	1.5.7 (including)	1.5.7 (including)
Sudo	Todd_miller	1.5.8 (including)	1.5.8 (including)
Sudo	Todd_miller	1.5.9 (including)	1.5.9 (including)
Sudo	Todd_miller	1.6 (including)	1.6 (including)
Sudo	Todd_miller	1.6.1 (including)	1.6.1 (including)
Sudo	Todd_miller	1.6.2 (including)	1.6.2 (including)
Sudo	Todd_miller	1.6.3 (including)	1.6.3 (including)
Sudo	Todd_miller	1.6.3_p1 (including)	1.6.3_p1 (including)
Sudo	Todd_miller	1.6.3_p2 (including)	1.6.3_p2 (including)
Sudo	Todd_miller	1.6.3_p3 (including)	1.6.3_p3 (including)
Sudo	Todd_miller	1.6.3_p4 (including)	1.6.3_p4 (including)
Sudo	Todd_miller	1.6.3_p5 (including)	1.6.3_p5 (including)
Sudo	Todd_miller	1.6.3_p6 (including)	1.6.3_p6 (including)
Sudo	Todd_miller	1.6.3_p7 (including)	1.6.3_p7 (including)
Sudo	Todd_miller	1.6.4 (including)	1.6.4 (including)
Sudo	Todd_miller	1.6.4_p1 (including)	1.6.4_p1 (including)
Sudo	Todd_miller	1.6.4_p2 (including)	1.6.4_p2 (including)
Sudo	Todd_miller	1.6.5 (including)	1.6.5 (including)
Sudo	Todd_miller	1.6.5_p1 (including)	1.6.5_p1 (including)
Sudo	Todd_miller	1.6.5_p2 (including)	1.6.5_p2 (including)
Sudo	Todd_miller	1.6.6 (including)	1.6.6 (including)
Sudo	Todd_miller	1.6.7 (including)	1.6.7 (including)
Sudo	Todd_miller	1.6.8 (including)	1.6.8 (including)
Sudo	Todd_miller	1.6.8_p1 (including)	1.6.8_p1 (including)
Sudo	Ubuntu	dapper	*
Sudo	Ubuntu	devel	*
Sudo	Ubuntu	edgy	*
Sudo	Ubuntu	feisty	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2004-1051
CWE	https://cwe.mitre.org/data/definitions/NVD-Other.html

Affected Software

References