medium
6.2
CWE
264
Advisory Published
CVE Published
Updated

CVE-2010-1646

First published: Mon May 31 2010(Updated: )

Anders Kaseorg and Evan Broder reported a flaw in the way sudo handled duplicated environment variables. When sudo set certain environment variables (such as PATH set to secure_path value, or special sudo environment variables SUDO_*), the value overwrote first value from user's environment (if it had been preserved and had not removed previously due to env_reset / env_keep / env_delete settings), but left following environment variables with the same name unchanged. This problem can be used to override secure_path setting from /etc/sudoers file for shell scripts executed using sudo, as bash uses last PATH environment variable value. In configurations where secure_path is used to enforce sane PATH setting for shell scripts, this can allow users with the privileges to run some script using sudo to run arbitrary command with the privileges of the target user. Upstream fixes to handle duplicated environment variables: <a href="http://www.sudo.ws/repos/sudo/rev/3057fde43cf0">http://www.sudo.ws/repos/sudo/rev/3057fde43cf0</a> <a href="http://www.sudo.ws/repos/sudo/rev/a09c6812eaec">http://www.sudo.ws/repos/sudo/rev/a09c6812eaec</a> This issue affects sudo packages shipped in Red Hat Enterprise Linux 5, however not the default configuration. In default configuration, no secure_path is set. env_reset is used by default, and PATH is not preserved during the environment reset (unlike the upstream sudo default). The sudo packages in Red Hat Enterprise Linux 3 and 4 do not allow setting secure_path in the /etc/sudoers, there is no compile-time default for the secure_path either. Whether the user PATH setting is preserved depends on env_reset / env_delete configuration. Current Fedora configuration specifies secure_path, but also removes PATH from the environment by default.

Credit: secalert@redhat.com

Affected SoftwareAffected VersionHow to fix
Sudo=1.6.3p1
Sudo=1.6.9p1
Sudo=1.6.8p1
Sudo=1.6.3p3
Sudo=1.3.1
Sudo=1.7.2p4
Sudo=1.6.6
Sudo=1.6.3p2
Sudo=1.6.9p14
Sudo=1.6.9p17
Sudo=1.7.0
Sudo=1.6.8p5
Sudo=1.6.7p3
Sudo=1.6.8p8
Sudo=1.6.3
Sudo=1.6.8p2
Sudo=1.6.1
Sudo=1.6.9p15
Sudo=1.6.7p1
Sudo=1.6.9p20
Sudo=1.7.1
Sudo=1.7.2p2
Sudo=1.7.2p7
Sudo=1.7.2
Sudo=1.6.8p6
Sudo=1.6.2
Sudo=1.6.9p22
Sudo=1.6.9p6
Sudo=1.6.8
Sudo=1.6.9p7
Sudo=1.6.9p9
Sudo=1.6.9p8
Sudo=1.6.8p10
Sudo=1.6.4p1
Sudo=1.6.8p3
Sudo=1.6.5p2
Sudo=1.6.2p1
Sudo=1.6.9p10
Sudo=1.6.5
Sudo=1.7.2p1
Sudo=1.6.2p2
Sudo=1.6.9
Sudo=1.7.2p3
Sudo=1.6.9p4
Sudo=1.6.7p2
Sudo=1.6.9p19
Sudo=1.6.3p4
Sudo=1.6.3p6
Sudo=1.6.3p7
Sudo=1.6.9p18
Sudo=1.6.9p12
Sudo=1.6.7p4
Sudo=1.6.7p5
Sudo=1.6.9p13
Sudo=1.6
Sudo=1.6.4
Sudo=1.6.8p7
Sudo=1.6.8p11
Sudo=1.6.9p3
Sudo=1.6.9p21
Sudo=1.6.7
Sudo=1.6.8p9
Sudo=1.6.3p5
Sudo=1.6.9p5
Sudo=1.6.9p2
Sudo=1.7.2p5
Sudo=1.6.8p12
Sudo=1.6.4p2
Sudo=1.6.5p1
Sudo=1.6.9p16
Sudo=1.6.8p4
Sudo=1.7.2p6
Sudo=1.6.9p11
Sudo=1.6.2p3

Remedy

http://www.sudo.ws/repos/sudo/rev/3057fde43cf0

Remedy

http://www.sudo.ws/repos/sudo/rev/a09c6812eaec

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2010-1646?

    CVE-2010-1646 has a moderate severity rating, as it can lead to unintended command behavior due to the mishandling of environment variables.

  • How do I fix CVE-2010-1646?

    To fix CVE-2010-1646, upgrade to a patched version of sudo that addresses the issue, such as versions later than 1.6.9p22.

  • What software is affected by CVE-2010-1646?

    CVE-2010-1646 affects various versions of sudo, including 1.3.1 through multiple 1.6.x versions.

  • What kind of vulnerability is CVE-2010-1646?

    CVE-2010-1646 is an environment variable handling flaw that potentially allows overwriting of important environment variables.

  • Can CVE-2010-1646 be exploited remotely?

    CVE-2010-1646 is not a remote vulnerability and requires local access to exploit.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203