Description
Incomplete blacklist vulnerability in sudo 1.6.8 and earlier allows local users to gain privileges via the (1) SHELLOPTS and (2) PS4 environment variables before executing a bash script on behalf of another user, which are not cleared even though other variables are.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 1
- DSA-870-1 sudo - missing input sanitising Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.sudo.ws/bugs/show_bug.cgi?id=182
- 17666 third-party-advisory
- 18549 third-party-advisory
- TA07-072A third-party-advisory
- MDKSA-2005:201 vendor-advisory
- APPLE-SA-2007-03-13 vendor-advisory
- http://docs.info.apple.com/article.html?artnum=305214
- DSA-870 vendor-advisory
- 17322 third-party-advisory
- 17390 third-party-advisory
- SUSE-SR:2006:002 vendor-advisory
- 15191 vdb-entry
- 17345 third-party-advisory
- ADV-2007-0930 vdb-entry
- 17318 third-party-advisory
- USN-213-1 vendor-advisory
- SUSE-SR:2005:025 vendor-advisory
- OpenPKG-SA-2006.002 vendor-advisory
- 24479 third-party-advisory