BID:11540

SudoSH Undisclosed SHELL Environment Variable Vulnerability

Info

SudoSH Undisclosed SHELL Environment Variable Vulnerability

Bugtraq ID:	11540
Class:	Unknown
CVE:
Remote:	No
Local:	Yes
Published:	Oct 26 2004 12:00AM
Updated:	Oct 26 2004 12:00AM
Credit:	The vendor announced this vulnerability.
Vulnerable:	Doug Hanks sudosh 1.3.6 Doug Hanks sudosh 1.3.5 Doug Hanks sudosh 1.3.4 Doug Hanks sudosh 1.3.2 Doug Hanks sudosh 1.3 Doug Hanks sudosh 1.2.3 Doug Hanks sudosh 1.2.2 Doug Hanks sudosh 1.1 Doug Hanks sudosh 1.0

Not Vulnerable:	Doug Hanks sudosh 1.4

Discussion

SudoSH Undisclosed SHELL Environment Variable Vulnerability

sudosh is reported prone to an undisclosed vulnerability. The issue is reported to present itself when sudosh handles the SHELL environment variable.

This BID will be updated as soon as further information regarding this vulnerability becomes available.

Exploit / POC

SudoSH Undisclosed SHELL Environment Variable Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

SudoSH Undisclosed SHELL Environment Variable Vulnerability

Solution:
The vendor has released an update to address this vulnerability:

Doug Hanks sudosh 1.0