CVE-2004-1051: High severity Todd Miller Sudo vulnerability
sudo before 1.6.8p2 allows local users to execute arbitrary commands by using "()" style environment variables to create functions that have the same name as any program within the bash script that is called without using the program's full pathname.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2004-1051?
CVE-2004-1051 is classified as a high severity vulnerability due to its potential for local users to execute arbitrary commands.
How do I fix CVE-2004-1051?
To fix CVE-2004-1051, upgrade to a version of sudo that is 1.6.8p2 or later.
What versions of sudo are affected by CVE-2004-1051?
CVE-2004-1051 affects sudo versions prior to 1.6.8p2, including 1.5.6, 1.5.7, 1.5.8, and several 1.6.x versions.
How does CVE-2004-1051 enable arbitrary command execution?
CVE-2004-1051 allows command execution through the misuse of "()" style environment variables to create functions that can override existing commands.
Who is impacted by CVE-2004-1051?
Local users on systems running vulnerable versions of sudo are impacted by CVE-2004-1051.