CVE-2004-1051 | Vulnerability Database | Aqua Security

sudo before 1.6.8p2 allows local users to execute arbitrary commands by using () style environment variables to create functions that have the same name as any program within the bash script that is called without using the programs full pathname.

Affected Software

Name	Vendor	Start Version	End Version
Sudo	Todd_miller	1.5.8	1.5.8
Sudo	Todd_miller	1.6.3_p6	1.6.3_p6
Sudo	Todd_miller	1.5.9	1.5.9
Sudo	Todd_miller	1.6.6	1.6.6
Sudo	Todd_miller	1.6.3	1.6.3
Sudo	Todd_miller	1.6.4_p2	1.6.4_p2
Sudo	Todd_miller	1.6.1	1.6.1
Sudo	Todd_miller	1.6.3_p5	1.6.3_p5
Sudo	Todd_miller	1.5.7	1.5.7
Sudo	Todd_miller	1.6.2	1.6.2
Sudo	Todd_miller	1.6.8	1.6.8
Sudo	Todd_miller	1.6.4_p1	1.6.4_p1
Sudo	Todd_miller	1.6.3_p2	1.6.3_p2
Sudo	Todd_miller	1.6.3_p4	1.6.3_p4
Sudo	Todd_miller	1.6.5_p2	1.6.5_p2
Sudo	Todd_miller	1.6.5	1.6.5
Sudo	Todd_miller	1.6.3_p3	1.6.3_p3
Sudo	Todd_miller	1.6.8_p1	1.6.8_p1
Sudo	Todd_miller	1.6.5_p1	1.6.5_p1
Sudo	Todd_miller	1.6.3_p7	1.6.3_p7
Sudo	Todd_miller	1.6	1.6
Sudo	Todd_miller	1.6.4	1.6.4
Mandrake_multi_network_firewall	Mandrakesoft	8.2	8.2
Sudo	Todd_miller	1.6.7	1.6.7
Sudo	Todd_miller	1.6.3_p1	1.6.3_p1
Sudo	Todd_miller	1.5.6	1.5.6
Sudo	Ubuntu	dapper	*
Sudo	Ubuntu	devel	*
Sudo	Ubuntu	edgy	*
Sudo	Ubuntu	feisty	*

References

http://www.securityfocus.com/bid/11668
http://www.sudo.ws/sudo/alerts/bash_functions.html
http://www.debian.org/security/2004/dsa-596
http://www.trustix.org/errata/2004/0061/
http://lists.apple.com/archives/security-announce/2005/May/msg00001.html
http://www.mandriva.com/security/advisories?name=MDKSA-2004:133
http://marc.info/?l=bugtraq\u0026m=110598298225675\u0026w=2
http://marc.info/?l=bugtraq\u0026m=110028877431192\u0026w=2
https://www.ubuntu.com/usn/usn-28-1/
https://exchange.xforce.ibmcloud.com/vulnerabilities/18055

NVD	https://nvd.nist.gov/vuln/detail/CVE-2004-1051
CWE	https://cwe.mitre.org/data/definitions/NVD-Other.html