Уязвимость CVE-2019-14287: Информация

Описание

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.

Важность: HIGH (8,8) Вектор: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2019-14287

Опубликовано: 17 октября 2019 г.

Изменено: 7 ноября 2023 г.

Идентификатор типа ошибки: CWE-755

Исправленные пакеты

Имя пакета	Ветка	Исправлено в версии	Версия в репозитории	Errata ID	№ Задания	Состояние
sudo	sisyphus	1.8.28-alt1	1.9.15p5-alt1	ALT-PU-2019-2942-1	239312	Исправлено
sudo	p10	1.8.28-alt1	1.9.15p1-alt1	ALT-PU-2019-2942-1	239312	Исправлено
sudo	p9	1.8.28-alt1	1.9.13p2-alt1	ALT-PU-2019-2943-1	239331	Исправлено
sudo	p8	1.8.28-alt1	1.9.5p2-alt0.M80P.1	ALT-PU-2019-3064-1	240030	Исправлено
sudo	c10f1	1.8.28-alt1	1.9.15p1-alt1	ALT-PU-2019-2942-1	239312	Исправлено
sudo	c9f2	1.8.28-alt1	1.9.12p2-alt0.c9f2.1	ALT-PU-2019-2943-1	239331	Исправлено

Ссылки на рекомендации, решения и инструменты

Ссылка	Ресурс
http://packetstormsecurity.com/files/154853/Slackware-Security-Advisory-sudo-Updates.html	Third Party Advisory VDB Entry
20191015 [slackware-security] sudo (SSA:2019-287-01)	Issue Tracking Mailing List Third Party Advisory
[oss-security] 20191014 Sudo: CVE-2019-14287	Exploit Mailing List Third Party Advisory
USN-4154-1	Third Party Advisory
20191015 [SECURITY] [DSA 4543-1] sudo security update	Issue Tracking Mailing List Third Party Advisory
openSUSE-SU-2019:2333	Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20191017-0003/	Third Party Advisory
DSA-4543	Third Party Advisory
[oss-security] 20191015 Re: Sudo: CVE-2019-14287	Mailing List Patch Third Party Advisory
https://www.sudo.ws/alerts/minus_1_uid.html	Exploit Vendor Advisory
openSUSE-SU-2019:2316	Mailing List Third Party Advisory
[debian-lts-announce] 20191017 [SECURITY] [DLA 1964-1] sudo security update	Mailing List Third Party Advisory
[oss-security] 20191023 Membership application for linux-distros - VMware	Mailing List Third Party Advisory
RHSA-2019:3205	Third Party Advisory
RHSA-2019:3197	Third Party Advisory
RHSA-2019:3204	Third Party Advisory
RHSA-2019:3219	Third Party Advisory
RHSA-2019:3209	Third Party Advisory
[oss-security] 20191029 Re: Membership application for linux-distros - VMware	Mailing List Third Party Advisory
RHSA-2019:3278	Third Party Advisory
https://resources.whitesourcesoftware.com/blog-whitesource/new-vulnerability-in-sudo-cve-2019-14287	Third Party Advisory
RHSA-2019:3694	Third Party Advisory
RHSA-2019:3754	Third Party Advisory
RHSA-2019:3755	Third Party Advisory
RHSA-2019:3895	Third Party Advisory
RHSA-2019:3916	Third Party Advisory
RHBA-2019:3248	Third Party Advisory
RHSA-2019:3941	Third Party Advisory
RHSA-2019:4191	Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03976en_us	Third Party Advisory
RHSA-2020:0388	Third Party Advisory
GLSA-202003-12	Third Party Advisory
[oss-security] 20210914 Re: Oracle Solaris membership in the distros list	Mailing List Third Party Advisory
FEDORA-2019-9cb221f2be
FEDORA-2019-67998e9f7e
https://support.f5.com/csp/article/K53746212?utm_source=f5support&amp%3Butm_medium=RSS
FEDORA-2019-72755db9c7

Подверженные конфигурации:
1. Конфигурация 1
  cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  End excliding
  1.8.28
  
  Конфигурация 2
  cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
  cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
  cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
  
  Конфигурация 3
  cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
  cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
  
  Конфигурация 4
  cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
  cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
  
  Конфигурация 5
  cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
  cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
  cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
  cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
  cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
  
  Конфигурация 6
  cpe:2.3:a:netapp:element_software_management_node:-:*:*:*:*:*:*:*
  
  Конфигурация 7
  cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*
  cpe:2.3:a:redhat:virtualization:4.2:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*
  cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*

Версия: v24.4.2

Наверх

Уязвимость CVE-2019-14287: Информация

Описание

Исправленные пакеты

Ссылки на рекомендации, решения и инструменты

Конфигурация 1

Конфигурация 2

Конфигурация 3

Конфигурация 4

Конфигурация 5

Конфигурация 6

Конфигурация 7