Unscored severity · published Jan 31, 2002
CVE-2002-0043
sudo 1.6.0 through 1.6.3p7 does not properly clear the environment before calling the mail program, which could allow local users to gain root privileges by modifying environment…
–
CVSS
0.9%
EPSS
No
On KEV
Description
sudo 1.6.0 through 1.6.3p7 does not properly clear the environment before calling the mail program, which could allow local users to gain root privileges by modifying environment variables and changing how the mail program is invoked.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SU
Sudo · Todd Miller
1.6; 1.6.1; 1.6.2; 1.6.3; 1.6.3_p1; 1.6.3_p2; +5 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-0043
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-0043
distro.conectiva.com.br
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000451
frontal2.mandriva.com
http://frontal2.mandriva.com/security/advisories?name=MDKSA-2002:003
marc.info
http://marc.info/?l=bugtraq&m=101120193627756&w=2
www.debian.org
http://www.debian.org/security/2002/dsa-101
www.novell.com
http://www.novell.com/linux/security/advisories/2002_002_sudo_txt.html
More from Sudo
8.4
CVE-2005-1831
Sudo 1.6.8p7 on SuSE Linux 9.3, and possibly other Linux distributions, allows local users to gain privileges by using sudo to call su, then entering a blank password and hitting…
7.0
CVE-2016-7032
sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that calls the (1) system or (2) popen…
–
CVE-2014-0106
Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions…
–
CVE-2013-2777
sudo before 1.7.10p5 and 1.8.x before 1.8.6p6, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with…
–
CVE-2013-2776
sudo 1.3.5 through 1.7.10p5 and 1.8.0 through 1.8.6p6, when running on systems without /proc or the sysctl function with the tty_tickets option enabled, does not properly validate…