VulnerabilityModified
CVE-2002-0043
sudo 1.6.0 through 1.6.3p7 does not properly clear the environment before calling the mail program, which could allow local users to gain root privileges by modifying environment variables and changing how the mail program is invoked.
HIGH 7.2EPSS 0.93%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.93%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
sudo 1.6.0 through 1.6.3p7 does not properly clear the environment before calling the mail program, which could allow local users to gain root privileges by modifying environment variables and changing how the mail program is invoked.
- CVSS 2.0
- 7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 0.93% probability · 59th percentile
- CISA KEV
- Not listed
- Affected
- todd miller/sudo
- Source
- cve@mitre.org
References
- ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02%3A06.asc
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000451
- http://frontal2.mandriva.com/security/advisories?name=MDKSA-2002:003
- http://marc.info/?l=bugtraq&m=101120193627756&w=2
- http://www.debian.org/security/2002/dsa-101
- http://www.novell.com/linux/security/advisories/2002_002_sudo_txt.html
- http://www.redhat.com/support/errata/RHSA-2002-011.html
- http://www.redhat.com/support/errata/RHSA-2002-013.htmlPatch, Vendor Advisory
- http://www.securityfocus.com/advisories/3800
- http://www.securityfocus.com/archive/1/250168Vendor Advisory
- http://www.securityfocus.com/bid/3871
- http://www.sudo.ws/sudo/alerts/postfix.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/7891
- ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02%3A06.asc
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000451
- http://frontal2.mandriva.com/security/advisories?name=MDKSA-2002:003
- http://marc.info/?l=bugtraq&m=101120193627756&w=2
- http://www.debian.org/security/2002/dsa-101
- http://www.novell.com/linux/security/advisories/2002_002_sudo_txt.html
- http://www.redhat.com/support/errata/RHSA-2002-011.html
- http://www.redhat.com/support/errata/RHSA-2002-013.htmlPatch, Vendor Advisory
- http://www.securityfocus.com/advisories/3800
- http://www.securityfocus.com/archive/1/250168Vendor Advisory
- http://www.securityfocus.com/bid/3871
- http://www.sudo.ws/sudo/alerts/postfix.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/7891
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.