CVE-2014-0106 Privilege escalation in n/a

Medium 6.6 Published 11 Mar 2014 Updated 6 Aug 2024

Local users with sudo permissions can bypass command restrictions and escalate privileges if env_reset is disabled.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2014-0106?

CVE-2014-0106 is a medium-severity vulnerability in Apple Mac Os X, published on 11 Mar 2014. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.

Weakness: CWE-20

Which versions are affected by CVE-2014-0106?

It affects 2 products.

Linux distribution packages (4)

`sudo` Red Hat:enterprise_linux:5::client	All versions	`0:1.7.2p1-29.el5_10`
`sudo-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`0:1.7.2p1-29.el5_10`
`sudo` Red Hat:enterprise_linux:5::server	All versions	`0:1.7.2p1-29.el5_10`
`sudo-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:1.7.2p1-29.el5_10`

Products include Apple Mac Os X, Todd Miller Sudo.

How do I fix CVE-2014-0106?

Upgrade to a fixed version.

Is CVE-2014-0106 being exploited?

There is no known exploitation of CVE-2014-0106 in the wild and no public exploit code.

All Apple Mac Os X vulnerabilities

Sources

Also known as DEBIAN-CVE-2014-0106, GHSA-cxvm-3g7g-7vv7, RHSA-2014:0266.