Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Incomplete blacklist vulnerability in sudo 1.6.8 and earlier allows local users to gain privileges via the (1) SHELLOPTS and (2) PS4 environment variables before executing a bash script on behalf of another user, which are not cleared even though other variables are.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Todd Miller Sudo本地权限提升漏洞
Vulnerability Description
Sudo是软件开发者Todd C. Miller所研发的一套用于类Unix操作系统下并允许用户通过安全的方式使用特殊的权限执行命令的程序。 Sudo中存在本地权限提升漏洞，有一定权限的本地用户可能利用此漏洞以高权限执行任意系统命令。Sudo不能充分的过滤环境变量。SHELLOPTS和PS4变量都是危险的变量，但仍传递给了以特权用户运行的程序。这可能导致在执行bash脚本时以特权用户的权限执行任意命令。请注意仅有获得了受限超级用户权限的攻击者才可以利用这些漏洞。
CVSS Information
N/A
Vulnerability Type
N/A