Tavis Ormandy discovered that sudo does not perform sufficient environment cleaning; in particular the SHELLOPTS and PS4 variables are still passed to the program running as an alternate user which can result in the execution of arbitrary commands as the alternate user when a bash script is executed.

The updated packages have been patched to correct this problem.

Tavis Ormandy noticed that sudo, a program that provides limited super user privileges to specific users, does not clean the environment sufficiently. The SHELLOPTS and PS4 variables are dangerous and are still passed through to the program running as privileged user. This can result in the execution of arbitrary commands as privileged user when a bash script is executed. These vulnerabilities can only be exploited by users who have been granted limited super user privileges.

Tavis Ormandy reports :

The bash shell uses the value of the PS4 environment variable (after expansion) as a prefix for commands run in execution trace mode.
Execution trace mode (xtrace) is normally set via bash's -x command line option or interactively by running 'set -o xtrace'. However, it may also be enabled by placing the string 'xtrace' in the SHELLOPTS environment variable before bash is started.

A malicious user with sudo access to a shell script that uses bash can use this feature to run arbitrary commands for each line of the script.

Tavis Ormandy discovered a privilege escalation vulnerability in sudo.
On executing shell scripts with sudo, the 'P4' and 'SHELLOPTS' environment variables were not cleaned properly. If sudo is set up to grant limited sudo privileges to normal users this could be exploited to run arbitrary commands as the target user.

Updated packags for Ubuntu 4.10 :.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.4 which is older than version 10.4.9 or a version of Mac OS X 10.3 which does not have Security Update 2007-003 applied.

This update contains several security fixes for the following programs :

 - ColorSync
 - CoreGraphics
 - Crash Reporter
 - CUPS
 - Disk Images
 - DS Plugins
 - Flash Player
 - GNU Tar
 - HFS
 - HID Family
 - ImageIO
 - Kernel
 - MySQL server
 - Networking
 - OpenSSH
 - Printing
 - QuickDraw Manager
 - servermgrd
 - SMB File Server
 - Software Update
 - sudo 
 - WebLog

The remote host is running a version of Mac OS X 10.4 that is older than version 10.4.9 or a version of Mac OS X 10.3 that does not have Security Update 2007-003 applied. This update contains several security fixes for the following programs :

 - ColorSync
 - CoreGraphics
 - Crash Reporter
 - CUPS
 - Disk Images
 - DS Plugins
 - Flash Player
 - GNU Tar
 - HFS
 - HID Family
 - ImageIO
 - Kernel
 - MySQL server
 - Networking
 - OpenSSH
 - Printing
 - QuickDraw Manager
 - servermgrd
 - SMB File Server
 - Software Update
 - sudo 
 - WebLog

ID	Name	Product	Family	Published	Updated	Severity
20127	Mandrake Linux Security Advisory : sudo (MDKSA-2005:201)	Nessus	Mandriva Local Security Checks	11/2/2005	1/6/2021	medium
22736	Debian DSA-870-1 : sudo - missing input sanitising	Nessus	Debian Local Security Checks	10/14/2006	1/4/2021	medium
21392	FreeBSD : sudo -- arbitrary command execution (1b725079-9ef6-11da-b410-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	5/13/2006	1/6/2021	medium
20631	Ubuntu 4.10 / 5.04 / 5.10 : sudo vulnerability (USN-213-1)	Nessus	Ubuntu Local Security Checks	1/15/2006	1/19/2021	medium
24811	Mac OS X < 10.4.9 Multiple Vulnerabilities (Security Update 2007-003)	Nessus	MacOS X Local Security Checks	3/13/2007	5/28/2024	critical
3947	Mac OS X < 10.4.9 Multiple Vulnerabilities (Security Update 2007-003)	Nessus Network Monitor	Web Clients	3/13/2007	3/6/2019	high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

critical

high