Vulnerability Details : CVE-2006-0151
Potential exploit
sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable, which allows limited local users to gain privileges via a Python script, a variant of CVE-2005-4158.
Products affected by CVE-2006-0151
- cpe:2.3:o:ubuntu:ubuntu_linux:4.1:*:ppc:*:*:*:*:*
- cpe:2.3:o:ubuntu:ubuntu_linux:4.1:*:ia64:*:*:*:*:*
- cpe:2.3:o:ubuntu:ubuntu_linux:5.04:*:amd64:*:*:*:*:*
- cpe:2.3:o:ubuntu:ubuntu_linux:5.04:*:i386:*:*:*:*:*
- cpe:2.3:o:ubuntu:ubuntu_linux:5.04:*:powerpc:*:*:*:*:*
- cpe:2.3:o:ubuntu:ubuntu_linux:5.10:*:amd64:*:*:*:*:*
- cpe:2.3:o:ubuntu:ubuntu_linux:5.10:*:i386:*:*:*:*:*
- cpe:2.3:o:ubuntu:ubuntu_linux:5.10:*:powerpc:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.3_p4:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.3_p5:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.3_p6:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.3_p7:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.3_p2:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.3_p3:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.3_p1:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.5.8:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.5.9:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.5_p1:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.5_p2:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.5.6:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.5.7:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.4_p2:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.5:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.4:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.4_p1:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.8:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.8_p1:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.6:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.7:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.7_p5:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.8_p8:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.8_p7:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.8_p5:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.8_p9:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.8_p2:*:*:*:*:*:*:*
- cpe:2.3:a:todd_miller:sudo:1.6.8_p12:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2006-0151
0.05%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 18 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2006-0151
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST |
Vendor statements for CVE-2006-0151
-
Red Hat 2008-01-24We do not consider this to be a security issue. http:bugzilla.redhat.combugzillashow_bug.cgi?id=139478#c1
References for CVE-2006-0151
-
http://www.novell.com/linux/security/advisories/2006_02_sr.html
404 Page Not Found | SUSE
-
https://usn.ubuntu.com/235-2/
404: Page not found | Ubuntu
-
http://www.trustix.org/errata/2006/0010
Trustix | Empowering Trust and Security in the Digital Age
-
http://www.securityfocus.com/bid/16184
Exploit
-
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.421822
The Slackware Linux Project: Slackware Security Advisories
-
http://www.mandriva.com/security/advisories?name=MDKSA-2006:159
Mandriva
-
http://www.debian.org/security/2006/dsa-946
Debian -- The Universal Operating System
Jump to