CVE-2014-10070

What it actually does

zsh evaluates initial values of integer variables imported from the environment as executable expressions rather than literal numbers, enabling code execution when invoked in unsanitized elevated contexts.

Why it matters to the business

Local users could gain elevated privileges on systems that invoke zsh through sudo or similar mechanisms without environment sanitization, potentially leading to unauthorized access or system compromise.

How an attack unfolds

An attacker configures a malicious integer environment variable, then triggers zsh in a privilege-elevation context such as sudo with env_reset disabled, causing the variable to be evaluated and execute attacker-controlled code with higher privileges.

How to fix it

Upgrade zsh to version 5.0.7 or later. Ensure sudo configurations enable env_reset and avoid invoking zsh in elevated contexts without full environment sanitization.

How to confirm the fix worked

Verify installed zsh version is 5.0.7 or newer. Audit sudoers files for disabled env_reset and test environment variable handling in privileged zsh invocations.

Typical attack path

1. Set a crafted integer environment variable containing code
2. Invoke zsh via an unsanitized privilege-elevation path such as sudo
3. Trigger evaluation of the imported variable during shell initialization
4. Execute arbitrary code with elevated privileges

How to detect it

Review sudo and authentication logs for zsh invocations with non-standard environment variables. Examine shell initialization logs or process listings for unexpected variable evaluation artifacts.

What your security team should do

• Upgrade all zsh installations to 5.0.7 or later
• Review and enforce env_reset in sudo configurations
• Identify and restrict use of zsh in privilege-elevation workflows
• Monitor for legacy zsh versions in package inventories