Description
sudo before 1.6.8p2 allows local users to execute arbitrary commands by using "()" style environment variables to create functions that have the same name as any program within the bash script that is called without using the program's full pathname.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sudo | 1.6.8p3-1 | — |
| Debian 13 | sudo | 1.6.8p3-1 | — |
| Debian 12 | sudo | 1.6.8p3-1 | — |
| Debian 3.0 | sudo | 1.6.6-1.3 | DSA-596-2 |
Advisories 1
- DSA-596-2 sudo - missing input sanitising Debian Security (DSA / DLA) · Mar 9, 2026
References
- USN-28-1 vendor-advisory
- http://www.sudo.ws/sudo/alerts/bash_functions.html
- OpenPKG-SA-2005.002 vendor-advisory
- 20041112 Sudo version 1.6.8p2 now available (fwd) mailing-list
- MDKSA-2004:133 vendor-advisory
- APPLE-SA-2005-05-03 vendor-advisory
- 11668 vdb-entry
- DSA-596 vendor-advisory
- sudo-bash-command-execution(18055) vdb-entry
- 2004-0061 vendor-advisory