CVE-2019-19232

Published: Dic 19, 2019 Last Modified: Nov 21, 2024
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: none
MEDIUM 5,0
Source: [email protected]
Access Vector: network
Access Complexity: low
Authentication: none
Confidentiality: none
Integrity: partial
Availability: none

Description

AI Translation Available

In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user. NOTE: The software maintainer believes that this is not a vulnerability because running a command via sudo as a user not present in the local password database is an intentional feature. Because this behavior surprised some users, sudo 1.8.30 introduced an option to enable/disable this behavior with the default being disabled. However, this does not change the fact that sudo was behaving as intended, and as documented, in earlier versions

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0281
Percentile
0,9th
Updated

EPSS Score Trend (Last 91 Days)

Application

Sudo by Sudo

Product Information
Vendor Sudo
Product Sudo
Version Range Affected
To 1.8.29 (inclusive)
cpe:2.3:a:sudo:sudo:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://access.redhat.com/security/cve/cve-2019-19232
https://access.redhat.com/security/cve/cve-2019-19232
http://seclists.org/fulldisclosure/2020/Mar/31
http://seclists.org/fulldisclosure/2020/Mar/31
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58…
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58103
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58…
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58812
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58…
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58979
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs76…
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs76870
https://security.netapp.com/advisory/ntap-20200103-0004/
https://security.netapp.com/advisory/ntap-20200103-0004/
https://support2.windriver.com/index.php?page=cve&on=view&i…
https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-19232
https://support2.windriver.com/index.php?page=defects&on=vi…
https://support2.windriver.com/index.php?page=defects&on=view&id=LIN1018-5506
https://support.apple.com/en-gb/HT211100
https://support.apple.com/en-gb/HT211100
https://support.apple.com/kb/HT211100
https://support.apple.com/kb/HT211100
https://www.bsi.bund.de/SharedDocs/Warnmeldungen/DE/CB/2019…
https://www.bsi.bund.de/SharedDocs/Warnmeldungen/DE/CB/2019/12/warnmeldung_cb-k…
https://www.oracle.com/security-alerts/bulletinapr2020.html
https://www.oracle.com/security-alerts/bulletinapr2020.html
https://www.sudo.ws/devel.html#1.8.30b2
Vendor Advisory
https://www.sudo.ws/devel.html#1.8.30b2
https://www.sudo.ws/stable.html
Vendor Advisory
https://www.sudo.ws/stable.html
https://www.tenable.com/plugins/nessus/133936
https://www.tenable.com/plugins/nessus/133936
https://access.redhat.com/security/cve/cve-2019-19232
https://access.redhat.com/security/cve/cve-2019-19232
http://seclists.org/fulldisclosure/2020/Mar/31
http://seclists.org/fulldisclosure/2020/Mar/31
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58…
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58103
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58…
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58812
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58…
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58979
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs76…
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs76870
https://security.netapp.com/advisory/ntap-20200103-0004/
https://security.netapp.com/advisory/ntap-20200103-0004/
https://support2.windriver.com/index.php?page=cve&on=view&i…
https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-19232
https://support2.windriver.com/index.php?page=defects&on=vi…
https://support2.windriver.com/index.php?page=defects&on=view&id=LIN1018-5506
https://support.apple.com/en-gb/HT211100
https://support.apple.com/en-gb/HT211100
https://support.apple.com/kb/HT211100
https://support.apple.com/kb/HT211100
https://www.bsi.bund.de/SharedDocs/Warnmeldungen/DE/CB/2019…
https://www.bsi.bund.de/SharedDocs/Warnmeldungen/DE/CB/2019/12/warnmeldung_cb-k…
https://www.oracle.com/security-alerts/bulletinapr2020.html
https://www.oracle.com/security-alerts/bulletinapr2020.html
https://www.sudo.ws/devel.html#1.8.30b2
Vendor Advisory
https://www.sudo.ws/devel.html#1.8.30b2
https://www.sudo.ws/stable.html
Vendor Advisory
https://www.sudo.ws/stable.html
https://www.tenable.com/plugins/nessus/133936
https://www.tenable.com/plugins/nessus/133936