CVE-2010-1646: todd_miller sudo

CVSS: 6.2v2.0MediumModified

AliasesRHSA-2010:0475DEBIAN-CVE-2010-1646DSA-2062-1

Published 07-06-2010Last modified 07-08-2024

Vulnerability summary

CVE-2010-1646 is a medium (CVSS 6.2) vulnerability in todd_miller sudo. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.3% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

35/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.2/10

010

Medium · v2.0 (NVD)

EPSS score

0.46%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2reference

Advisory lineage

Upstream 0 · Downstream 1 · Related 1

OPENSUSE-SU-2024:10551-1

Timeline

07-06-2010
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an environment that contains multiple PATH variables, which might allow local users to gain privileges via a crafted value of the last PATH variable.

CVSS metrics

1 score · 1 source · 1 version

v2.06.2

EPSS trend

Probability

0.46%

Chance of exploitation in the next 30 days

Percentile

38%

Versus all other CVEs

30-day change

0.00 pp

From 0.46% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.46%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (sudo.ws)
Maturity: unknown
referenceUnverified
Exploit Reference (sudo.ws)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Affected systems

Redhat2 products

sudo< 0:1.7.2p1-7.el5_5
sudo-debuginfo< 0:1.7.2p1-7.el5_5

Debian1 product

sudo< 1.7.2p7-1 | < 1.6.9p17-3

Todd_miller1 product

sudo1.3.1 | 1.6 | 1.6.1 | 1.6.2 | 1.6.2p1 | 1.6.2p2 | 1.6.2p3 | 1.6.3 | 1.6.3p1 | 1.6.3p2 | 1.6.3p3 | 1.6.3p4 | 1.6.3p5 | 1.6.3p6 | 1.6.3p7 | 1.6.4 | 1.6.4p1 | 1.6.4p2 | 1.6.5 | 1.6.5p1 | 1.6.5p2 | 1.6.6 | 1.6.7 | 1.6.7p1 | 1.6.7p2 | 1.6.7p3 | 1.6.7p4 | 1.6.7p5 | 1.6.8 | 1.6.8p1 | 1.6.8p2 | 1.6.8p3 | 1.6.8p4 | 1.6.8p5 | 1.6.8p6 | 1.6.8p7 | 1.6.8p8 | 1.6.8p9 | 1.6.8p10 | 1.6.8p11 | 1.6.8p12 | 1.6.9 | 1.6.9p1 | 1.6.9p2 | 1.6.9p3 | 1.6.9p4 | 1.6.9p5 | 1.6.9p6 | 1.6.9p7 | 1.6.9p8 | 1.6.9p9 | 1.6.9p10 | 1.6.9p11 | 1.6.9p12 | 1.6.9p13 | 1.6.9p14 | 1.6.9p15 | 1.6.9p16 | 1.6.9p17 | 1.6.9p18 | 1.6.9p19 | 1.6.9p20 | 1.6.9p21 | 1.6.9p22 | 1.7.0 | 1.7.1 | 1.7.2 | 1.7.2p1 | 1.7.2p2 | 1.7.2p3 | 1.7.2p4 | 1.7.2p5 | 1.7.2p6 | 1.7.2p7

3 vendors · 4 products