Unscored severity · published Mar 1, 2005
CVE-2004-1051
sudo before 1.6.8p2 allows local users to execute arbitrary commands by using "()" style environment variables to create functions that have the same name as any program within…
–
CVSS
1.4%
EPSS
No
On KEV
Description
sudo before 1.6.8p2 allows local users to execute arbitrary commands by using "()" style environment variables to create functions that have the same name as any program within the bash script that is called without using the program's full pathname.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DL
Debian Linux · Debian
3.0; 3.0; 3.0; 3.0; 3.0; 3.0; +5 more · source: NVD
ML
Mandrake Linux · Mandrakesoft
9.2; 9.2; 10.0; 10.0; 10.1; 10.1 · source: NVD
ML
Mandrake Linux Corporate Server · Mandrakesoft
2.1; 2.1 · source: NVD
MM
Mandrake Multi Network Firewall · Mandrakesoft
8.2 · source: NVD
SL
Secure Linux · Trustix
1.5; 2.0; 2.1; 2.2 · source: NVD
SU
Sudo · Todd Miller
1.5.6; 1.5.7; 1.5.8; 1.5.9; 1.6; 1.6.1; +19 more · source: NVD
UL
Ubuntu Linux · Ubuntu
4.1; 4.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-1051
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-1051
lists.apple.com
http://lists.apple.com/archives/security-announce/2005/May/msg00001.html
marc.info
http://marc.info/?l=bugtraq&m=110028877431192&w=2
marc.info
http://marc.info/?l=bugtraq&m=110598298225675&w=2
www.debian.org
http://www.debian.org/security/2004/dsa-596
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDKSA-2004:133
Patch
http://www.securityfocus.com/bid/11668
More from Debian Linux
10.0
CVE-2025-32433
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
10.0
CVE-2025-24201
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
10.0
CVE-2015-3306
ProFTPD Improper Access Control Vulnerability
9.8
CVE-2026-24061
GNU InetUtils Argument Injection Vulnerability