• info
• discussion
• exploit
• solution
• references

Sudo Python Environment Variable Handling Security Bypass Vulnerability

Solution:
Please see the referenced vendor advisories for more information and fixes.


Todd Miller Sudo 1.5.6

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.5.7

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.5.8

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.5.9

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.1

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.2

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.3

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.3 p1

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.3 p5

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.3 p4

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.3 p7

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.3 p6

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.3 p2

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.3 p3

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.4 p2

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.4 p1

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.4

• Mandriva sudo-1.6.7-0.p5.2.5.M20mdk.i586.rpm
  Multi Network Firewall 2.0:
  http://wwwnew.mandriva.com/en/downloads


• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.5 p2

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.5 p1

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.5

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.6

• Slackware sudo-1.6.8p12-i386-1.tgz
  Slackware 8.1:
  ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/s udo-1.6.8p12-i386-1.tgz


• Slackware sudo-1.6.8p12-i386-1.tgz
  Slackware 9.0:ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/sudo-1.6.8p12-i386-1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/s udo-1.6.8p12-i386-1.tgz


• Slackware sudo-1.6.8p12-i386-1.tgz
  Slackware 9.0:
  ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/s udo-1.6.8p12-i386-1.tgz


• Slackware sudo-1.6.8p12-i486-1.tgz
  10.0:
  ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/ sudo-1.6.8p12-i486-1.tgz


• Slackware sudo-1.6.8p12-i486-1.tgz
  Slackware 9.1:Slackware 9.1:
  ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/s udo-1.6.8p12-i486-1.tgz


• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.7 p5

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.7

• Mandriva sudo-1.6.7-0.p5.2.5.C30mdk.i586.rpm
  Corporate 3.0:
  http://wwwnew.mandriva.com/en/downloads


• Mandriva sudo-1.6.7-0.p5.2.5.C30mdk.x86_64.rpm
  Corporate 3.0:
  http://wwwnew.mandriva.com/en/downloads


• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.8 p9

• Slackware sudo-1.6.8p12-i486-1.tgz
  Slackware 10.2:
  ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/ sudo-1.6.8p12-i486-1.tgz


• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html


• Trustix sudo-1.6.8p12-1tr.i586.rpm
  TSL 3.0
  ftp://ftp.trustix.org/pub/trustix/updates

Todd Miller Sudo 1.6.8 p5

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.8

• Slackware sudo-1.6.8p12-i486-1.tgz
  Slackware 10.1:
  ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/ sudo-1.6.8p12-i486-1.tgz


• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.8 p8

• Mandriva sudo-1.6.8p8-2.3.20060mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads


• Mandriva sudo-1.6.8p8-2.3.20060mdk.x86_64.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads


• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.8 p1

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.8 p2

• Trustix sudo-1.6.8p12-1tr.i586.rpm
  TSL 3.0
  ftp://ftp.trustix.org/pub/trustix/updates

Todd Miller Sudo 1.6.8 p7

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html