Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2014-0106 | First vendor Publication | 2014-03-11 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:M/Au:S/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 6.6 | Attack Range | Local |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 2.7 | Authentication | Requires single instance |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0106 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-20 | Improper Input Validation |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:24237 | |||
| Oval ID: | oval:org.mitre.oval:def:24237 | ||
| Title: | RHSA-2014:0266: sudo security update (Moderate) | ||
| Description: | The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root. A flaw was found in the way sudo handled its blacklist of environment variables. When the "env_reset" option was disabled, a user permitted to run certain commands via sudo could use this flaw to run such a command with one of the blacklisted environment variables set, allowing them to run an arbitrary command with the target user's privileges. (CVE-2014-0106) Note: This issue does not affect the default configuration of the sudo package as shipped with Red Hat Enterprise Linux 5. Red Hat would like to thank Todd C. Miller for reporting this issue. Upstream acknowledges Sebastien Macke as the original reporter. All sudo users are advised to upgrade to this updated package, which contains a backported patch to correct this issue. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2014:0266-00 CESA-2014:0266 CVE-2014-0106 | Version: | 8 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | sudo |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:24244 | |||
| Oval ID: | oval:org.mitre.oval:def:24244 | ||
| Title: | ELSA-2014:0266: sudo security update (Moderate) | ||
| Description: | Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2014:0266-00 CVE-2014-0106 | Version: | 6 |
| Platform(s): | Oracle Linux 5 | Product(s): | sudo |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:24334 | |||
| Oval ID: | oval:org.mitre.oval:def:24334 | ||
| Title: | USN-2146-1 -- sudo vulnerabilities | ||
| Description: | Several security issues were fixed in Sudo. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-2146-1 CVE-2014-0106 | Version: | 5 |
| Platform(s): | Ubuntu 13.10 Ubuntu 12.10 Ubuntu 12.04 Ubuntu 10.04 | Product(s): | sudo |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:25446 | |||
| Oval ID: | oval:org.mitre.oval:def:25446 | ||
| Title: | SUSE-SU-2014:0475-1 -- Security update for sudo | ||
| Description: | This collective update for sudo provides fixes for the following issues: * Security policy bypass when env_reset is disabled. (CVE-2014-0106, bnc#866503) * Regression in the previous update that causes a segmentation fault when running "sudo -s". (bnc#868444) * Command "who -m" prints no output when using log_input/log_output sudo options. (bnc#863025) Security Issues references: * CVE-2014-0106 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0106 > | ||
| Family: | unix | Class: | patch |
| Reference(s): | SUSE-SU-2014:0475-1 CVE-2014-0106 | Version: | 3 |
| Platform(s): | SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Desktop 11 | Product(s): | sudo |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:27307 | |||
| Oval ID: | oval:org.mitre.oval:def:27307 | ||
| Title: | DEPRECATED: ELSA-2014-0266 -- sudo security update (moderate) | ||
| Description: | [1.7.2p1-29] - added patch for CVE-2014-0106: certain environment variables not sanitized when env_reset is disabled Resolves: rhbz#1072210 | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2014-0266 CVE-2014-0106 | Version: | 4 |
| Platform(s): | Oracle Linux 5 | Product(s): | sudo |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2015-08-20 | IAVM : 2015-A-0199 - Multiple Vulnerabilities in Apple Mac OS X Severity : Category I - VMSKEY : V0061337 |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2016-06-22 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2016-0079.nasl - Type : ACT_GATHER_INFO |
| 2015-08-17 | Name : The remote host is missing a Mac OS X update that fixes multiple security vul... File : macosx_10_10_5.nasl - Type : ACT_GATHER_INFO |
| 2015-03-26 | Name : The remote Debian host is missing a security update. File : debian_DLA-160.nasl - Type : ACT_GATHER_INFO |
| 2014-06-28 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201406-30.nasl - Type : ACT_GATHER_INFO |
| 2014-04-04 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_sudo-140320.nasl - Type : ACT_GATHER_INFO |
| 2014-03-14 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-2146-1.nasl - Type : ACT_GATHER_INFO |
| 2014-03-11 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2014-0266.nasl - Type : ACT_GATHER_INFO |
| 2014-03-11 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2014-0266.nasl - Type : ACT_GATHER_INFO |
| 2014-03-11 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-0266.nasl - Type : ACT_GATHER_INFO |
| 2014-03-11 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20140310_sudo_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2014-03-06 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2014-064-01.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 12:38:24 |
|
| 2021-05-04 12:29:24 |
|
| 2021-04-22 01:35:38 |
|
| 2020-05-23 01:50:41 |
|
| 2020-05-23 00:39:19 |
|
| 2017-12-16 09:21:40 |
|
| 2016-11-29 00:24:51 |
|
| 2016-09-09 09:23:16 |
|
| 2016-09-01 01:02:04 |
|
| 2016-06-29 00:32:36 |
|
| 2016-06-28 22:29:58 |
|
| 2016-06-23 13:29:27 |
|
| 2016-03-31 05:24:19 |
|
| 2015-10-18 17:22:24 |
|
| 2015-08-18 13:34:49 |
|
| 2015-08-18 09:19:22 |
|
| 2015-03-27 13:28:01 |
|
| 2014-06-29 13:26:49 |
|
| 2014-04-05 13:22:02 |
|
| 2014-03-26 13:23:02 |
|
| 2014-03-18 13:23:35 |
|
| 2014-03-15 13:21:32 |
|
| 2014-03-12 21:22:53 |
|
| 2014-03-12 13:21:29 |
|
| 2014-03-11 21:26:22 |
|
