CVE-2006-0151: High severity Todd Miller Sudo vulnerability
Published Jan 9, 2006
·Updated
sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable, which allows limited local users to gain privileges via a Python script, a variant of CVE-2005-4158.
Affected Software
40 affected components
Todd Miller Sudo=1.5.6
Todd Miller Sudo=1.5.7
Todd Miller Sudo=1.5.8
Todd Miller Sudo=1.5.9
Todd Miller Sudo=1.6
Todd Miller Sudo=1.6.1
Todd Miller Sudo=1.6.2
Todd Miller Sudo=1.6.3
Todd Miller Sudo=1.6.3_p1
Todd Miller Sudo=1.6.3_p2
Todd Miller Sudo=1.6.3_p3
Todd Miller Sudo=1.6.3_p4
Todd Miller Sudo=1.6.3_p5
Todd Miller Sudo=1.6.3_p6
Todd Miller Sudo=1.6.3_p7
Todd Miller Sudo=1.6.4
Todd Miller Sudo=1.6.4_p1
Todd Miller Sudo=1.6.4_p2
Todd Miller Sudo=1.6.5
Todd Miller Sudo=1.6.5_p1
Todd Miller Sudo=1.6.5_p2
Todd Miller Sudo=1.6.6
Todd Miller Sudo=1.6.7
Todd Miller Sudo=1.6.7_p5
Todd Miller Sudo=1.6.8
Todd Miller Sudo=1.6.8_p1
Todd Miller Sudo=1.6.8_p2
Todd Miller Sudo=1.6.8_p5
Todd Miller Sudo=1.6.8_p7
Todd Miller Sudo=1.6.8_p8
Todd Miller Sudo=1.6.8_p9
Todd Miller Sudo=1.6.8_p12
Ubuntu Ubuntu Linux=4.1
Ubuntu Ubuntu Linux=4.1
Ubuntu Ubuntu Linux=5.04
Ubuntu Ubuntu Linux=5.04
Ubuntu Ubuntu Linux=5.04
Ubuntu Ubuntu Linux=5.10
Ubuntu Ubuntu Linux=5.10
Ubuntu Ubuntu Linux=5.10
Remediation
Patch Available
Event History
Jan 9, 2006
CVE Published
11:03 PM
Jan 10, 2006
CVE Published
via MITRE·04:00 AM
Data Sourced
via MITRE·04:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-0151?
CVE-2006-0151 is considered a medium severity vulnerability.
2
How do I fix CVE-2006-0151?
To mitigate CVE-2006-0151, ensure that the PYTHONINSPECT environment variable is cleared before executing Python scripts with sudo.
3
Which versions of sudo are affected by CVE-2006-0151?
CVE-2006-0151 affects sudo versions 1.6.8 and earlier, including 1.5.6 to 1.6.8.
4
What type of attack does CVE-2006-0151 enable?
CVE-2006-0151 allows local users to escalate privileges through improper handling of the PYTHONINSPECT environment variable.
5
Who reported CVE-2006-0151?
CVE-2006-0151 was initially reported in 2006, highlighting a security flaw in sudo versions prior to a specific patch.