CVE-2014-0106: Input Validation
Sudo 1.6.9 before 1.8.5, when envreset is disabled, does not properly check environment variables for the envdelete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sudoto a version that resolves this vulnerability.Fixed in 1.8.5 - Configuration
Enable env_reset to ensure sudo resets environment variables (mitigates the issue affecting sudo 1.6.9 before 1.8.5 when env_reset is disabled).
sudo env_reset = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0106?
CVE-2014-0106 is classified as a high severity vulnerability due to its ability to allow local users to bypass command restrictions.
How do I fix CVE-2014-0106?
To fix CVE-2014-0106, users should upgrade to sudo version 1.8.5 or later, which contains the necessary patches.
Who is affected by CVE-2014-0106?
CVE-2014-0106 affects local users with sudo permissions on versions of sudo prior to 1.8.5 when env_reset is disabled.
What does CVE-2014-0106 exploit?
CVE-2014-0106 exploits insufficient checks on environment variables, allowing unauthorized command access by manipulating the environment.
Is CVE-2014-0106 a local or remote vulnerability?
CVE-2014-0106 is a local vulnerability, as it requires local user access to exploit the flaw.