CVE-2005-4158: Medium severity todd miller sudo vulnerability
Sudo before 1.6.8 p12, when the Perl taint flag is off, does not clear the (1) PERLLIB, (2) PERL5LIB, and (3) PERL5OPT environment variables, which allows limited local users to cause a Perl script to include and execute arbitrary library files that have the same name as library files that are included by the script.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2005-4158?
CVE-2005-4158 has a moderate severity level as it allows limited local users to execute arbitrary Perl library files.
How do I fix CVE-2005-4158?
To fix CVE-2005-4158, upgrade to Sudo version 1.6.8 or later where the vulnerability is addressed.
What versions of Sudo are affected by CVE-2005-4158?
CVE-2005-4158 affects Sudo versions prior to 1.6.8 including 1.5.8, 1.5.9, and several 1.6.x versions.
What are the implications of CVE-2005-4158 for system security?
The implications of CVE-2005-4158 include the potential for unauthorized code execution by local users, which could lead to further system compromise.
How was CVE-2005-4158 discovered?
CVE-2005-4158 was discovered through analysis of the Sudo environment variable handling, particularly the handling of the Perl taint flag.