Back to feed
EUVD-2019-5514 · Published Oct 17, 2019
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.
Technologies
Redhat Enterprise Linux Server AusRedhat Enterprise Linux Server TusRedhat Enterprise Linux WorkstationRedhat Enterprise Linux ServerOpensuse LeapDebian Debian LinuxCanonical Ubuntu LinuxFedoraproject FedoraRedhat Openshift Container PlatformNetapp Element Software Management NodeRedhat VirtualizationRedhat Enterprise LinuxRedhat Enterprise Linux EusSudo_Project SudoRedhat Enterprise Linux Desktop
Weaknesses
CWE-755
CVSS scores
- v3.18.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - v2.09.0
AV:N/AC:L/Au:S/C:C/I:C/A:C
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
- http://packetstormsecurity.com/files/154853/Slackware-Security-Advisory-sudo-Updates.html
- http://www.openwall.com/lists/oss-security/2019/10/14/1
- https://www.sudo.ws/alerts/minus_1_uid.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00042.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00047.html
- http://www.openwall.com/lists/oss-security/2019/10/24/1
Potentially impacted assets
See if this affects your attack surface
