National Cyber-Alert System

Vulnerability Summary for CVE-2006-0151

Overview

sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable, which allows limited local users to gain privileges via a Python script, a variant of CVE-2005-4158.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statments (disclaimer)

Official Statement from Red Hat (01/24/2008)

We do not consider this to be a security issue. http:bugzilla.redhat.combugzillashow_bug.cgi?id=139478#c1

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: SECUNIA

Name: 18363

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/18363

External Source: UBUNTU

Name: USN-235-2

Hyperlink:http://www.ubuntulinux.org/support/documentation/usn/usn-235-2

External Source: BID

Name: 16184

Hyperlink:http://www.securityfocus.com/bid/16184

External Source: SECUNIA

Name: 18358

Type: Advisory

Hyperlink:http://secunia.com/advisories/18358

External Source: TRUSTIX

Name: 2006-0010

Hyperlink:http://www.trustix.org/errata/2006/0010

External Source: SUSE

Name: SUSE-SR:2006:002

Hyperlink:http://www.novell.com/linux/security/advisories/2006_02_sr.html

External Source: MANDRIVA

Name: MDKSA-2006:159

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:159

External Source: DEBIAN

Name: DSA-946

Hyperlink:http://www.debian.org/security/2006/dsa-946

External Source: SLACKWARE

Name: SSA:2006-045-08

Hyperlink:http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.421822

External Source: SECUNIA

Name: 21692

Hyperlink:http://secunia.com/advisories/21692

External Source: SECUNIA

Name: 19016

Hyperlink:http://secunia.com/advisories/19016

External Source: SECUNIA

Name: 18906

Hyperlink:http://secunia.com/advisories/18906

External Source: SECUNIA

Name: 18558

Hyperlink:http://secunia.com/advisories/18558

External Source: SECUNIA

Name: 18549

Hyperlink:http://secunia.com/advisories/18549

External Source: MANDRIVA

Name: MDKSA-2006:159

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:159