Test ID:	1.3.6.1.4.1.25623.1.0.50464
Category:	Ubuntu Local Security Checks
Title:	Ubuntu 4.10 USN-28-1 (sudo)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to sudo announced via advisory USN-28-1. Liam Helmer discovered an input validation flaw in sudo. When the standard shell 'bash' starts up, it searches the environment for variables with a value beginning with '()'. For each of these variables a function with the same name is created, with the function body filled in from the environment variable's value. A malicious user with sudo access to a shell script that uses bash can use this feature to substitute arbitrary commands for any non-fully-qualified programs called from the script. Therefore this flaw can lead to privilege escalation. The following packages are affected: sudo Solution: The problem can be corrected by upgrading the affected package to version 1.6.7p5-1ubuntu4.1. In general, a standard system upgrade is sufficient to effect the necessary changes. http://lists.ubuntu.com/archives/ubuntu-security-announce/2004-November/000030.html http://www.sudo.ws/sudo/alerts/bash_functions.html Risk factor : High
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.