CVE-2005-4158
sudo < 1.6.8p12 - Local Perl Library Path Injection via Uncleared Environment Variables
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2005-4158. PoCs published by Breno Silva Pinto, Charles Morris.
AI-analyzed exploit summary This exploit leverages a Python environment variable manipulation vulnerability in Sudo to escalate privileges to root. By hijacking the `socket.py` module and modifying the `close()` function, an attacker can execute arbitrary commands with elevated privileges.
Description
Sudo before 1.6.8 p12, when the Perl taint flag is off, does not clear the (1) PERLLIB, (2) PERL5LIB, and (3) PERL5OPT environment variables, which allows limited local users to cause a Perl script to include and execute arbitrary library files that have the same name as library files that are included by the script.
Exploits (3)
This exploit leverages a Python environment variable manipulation vulnerability in Sudo to escalate privileges to root. By hijacking the `socket.py` module and modifying the `close()` function, an attacker can execute arbitrary commands with elevated privileges.
This exploit leverages a security-bypass vulnerability in Sudo (versions < 1.6.8p12) by manipulating environment variables (PERLLIB and PERL5OPT) to execute arbitrary code with elevated privileges. The attacker creates a malicious Perl module (FTP.pm) that spawns a root shell when loaded by a Perl script executed via Sudo.
This exploit leverages a security-bypass vulnerability in Sudo (versions < 1.6.8p12) by manipulating the 'PERLLIB', 'PERL5LIB', and 'PERL5OPT' environment variables to execute arbitrary code with root privileges. The attacker creates a malicious Perl module (FTP.pm) that spawns a shell when loaded, then executes a Perl script via Sudo to trigger the payload.