Unscored severity · published Dec 11, 2005
CVE-2005-4158
Sudo before 1.6.8 p12, when the Perl taint flag is off, does not clear the (1) PERLLIB, (2) PERL5LIB, and (3) PERL5OPT environment variables, which allows limited local users to…
–
CVSS
1.1%
EPSS
No
On KEV
Description
Sudo before 1.6.8 p12, when the Perl taint flag is off, does not clear the (1) PERLLIB, (2) PERL5LIB, and (3) PERL5OPT environment variables, which allows limited local users to cause a Perl script to include and execute arbitrary library files that have the same name as library files that are included by the script.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SU
Sudo · Todd Miller
1.5.6; 1.5.7; 1.5.8; 1.5.9; 1.6; 1.6.1; +24 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-4158
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-4158
Patch
http://secunia.com/advisories/17534/
secunia.com
http://secunia.com/advisories/18102
secunia.com
http://secunia.com/advisories/18156
secunia.com
http://secunia.com/advisories/18308
secunia.com
http://secunia.com/advisories/18463
secunia.com
http://secunia.com/advisories/18549
More from Sudo
8.4
CVE-2005-1831
Sudo 1.6.8p7 on SuSE Linux 9.3, and possibly other Linux distributions, allows local users to gain privileges by using sudo to call su, then entering a blank password and hitting…
7.0
CVE-2016-7032
sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that calls the (1) system or (2) popen…
–
CVE-2014-0106
Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions…
–
CVE-2013-2777
sudo before 1.7.10p5 and 1.8.x before 1.8.6p6, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with…
–
CVE-2013-2776
sudo 1.3.5 through 1.7.10p5 and 1.8.0 through 1.8.6p6, when running on systems without /proc or the sysctl function with the tty_tickets option enabled, does not properly validate…