CVE:CVE-2004-1051
CNNVD:CNNVD-200503-006
本地用户可以借助sudo 1.6.8p2之前版本，利用"()"样式环境变量创建与BASH脚本中任何程序同名的函数(即未使用程序的完整路径名)，来执行任意命令。
solution:Upgrade mandrakesoft mandrake_multi_network_firewall to a higher version than 8.2,and avoid the version 8.2; Upgrade todd_miller sudo to a higher version than 1.5.6,1.5.7,1.5.8,1.5.9,1.6,1.6.1,1.6.2,1.6.3,1.6.3_p1,1.6.3_p2,1.6.3_p3,1.6.3_p4,1.6.3_p5,1.6.3_p6,1.6.3_p7,1.6.4,1.6.4_p1,1.6.4_p2,1.6.5,1.6.5_p1,1.6.5_p2,1.6.6,1.6.7,1.6.8,1.6.8_p1,and avoid the version 1.5.6,1.5.7,1.5.8,1.5.9,1.6,1.6.1,1.6.2,1.6.3,1.6.3_p1,1.6.3_p2,1.6.3_p3,1.6.3_p4,1.6.3_p5,1.6.3_p6,1.6.3_p7,1.6.4,1.6.4_p1,1.6.4_p2,1.6.5,1.6.5_p1,1.6.5_p2,1.6.6,1.6.7,1.6.8,1.6.8_p1; Upgrade debian debian_linux to a higher version than 3.0,and avoid the version 3.0; Upgrade mandrakesoft mandrake_linux to a higher version than 9.2,10.0,10.1,and avoid the version 9.2,10.0,10.1; Upgrade mandrakesoft mandrake_linux_corporate_server to a higher version than 2.1,and avoid the version 2.1; Upgrade trustix secure_linux to a higher version than 1.5,2.0,2.1,2.2,and avoid the version 1.5,2.0,2.1,2.2; Upgrade ubuntu ubuntu_linux to a higher version than 4.1,and avoid the version 4.1