The question is: How big a problem is this? Looks pretty big to me.
With the shellshock bug it is possible to bypass the whitelist of known-harmless environment variables in sudo, as well as other routes to execution of code as high-privileged users. For example variables
DISPLAY are by default propagated by sudo in many configurations (last time I checked - I don't think the latest Debian does).
In the presence of Shellshock, if an unprivileged user, partially privileged user, or malware with unprivileged code-execution can supply any propagated environment variable whatsoever to a shell running as root, he can execute arbitrary code as root.
- User with limited
sudorights is malicious
- User sets environment variable such as
- Any call to
sudo'd command by such a user will now result in arbitrary code execution as root.
- result is that any sudo rights at all become root access to the system - it does not matter how restricted his access was
- User gains access to unattended terminal of user with some sudo rights, or
- Malware gains code execution as an unprivileged user who has some sudo rights
- Malware/User sets propagated environment variable such as
- Any call to
sudo'd command by such a user will now result in code execution as root.
- Does not require knowledge of password - password can be entered later by the victim user after access has ceased.