Vulnerability in Todd Miller Sudo
CVE-2002-0043
sudo 1.6.0 through 1.6.3p7 does not properly clear the environment before calling the mail program, which could allow local users to gain root privileges by modifying environment variables and changing how the mail program is invoked.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 7.2 (High). Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.009 (59.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 59th percentile — 59.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: 0.000
Affected products
- Todd Miller Sudo — versions 1.6, 1.6.1, 1.6.2
Public proof-of-concept exploits
References
- www.redhat.com/support/errata/RHSA-2002-013.html (vendor-advisory, Patch, Vendor Advisory)
- exchange.xforce.ibmcloud.com/vulnerabilities/7891 (vdb-entry)
- www.securityfocus.com/advisories/3800 (vendor-advisory)
- www.securityfocus.com/bid/3871 (vdb-entry)
- www.securityfocus.com/archive/1/250168 (Vendor Advisory, mailing-list)
- marc.info/ (mailing-list)
- www.sudo.ws/sudo/alerts/postfix.html
- www.novell.com/linux/security/advisories/2002_002_sudo_txt.html (vendor-advisory)
- frontal2.mandriva.com/security/advisories (vendor-advisory)
- www.debian.org/security/2002/dsa-101 (vendor-advisory)
Frequently asked questions
- What is CVE-2002-0043?
- CVE-2002-0043 is a vulnerability in Todd Miller Sudo. Published 2002-01-31.
- Is CVE-2002-0043 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.