CVE-2019-19232
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
7.5 High
AI Score
Confidence
High
0.008 Low
EPSS
Percentile
81.2%
In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user. NOTE: The software maintainer believes that this is not a vulnerability because running a command via sudo as a user not present in the local password database is an intentional feature. Because this behavior surprised some users, sudo 1.8.30 introduced an option to enable/disable this behavior with the default being disabled. However, this does not change the fact that sudo was behaving as intended, and as documented, in earlier versions
Affected configurations
References
seclists.org/fulldisclosure/2020/Mar/31
access.redhat.com/security/cve/cve-2019-19232
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6TKF36KOQUVJNBHSVJFA7BU3CCEYD2F/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IY6DZ7WMDKU4ZDML6MJLDAPG42B5WVUC/
quickview.cloudapps.cisco.com/quickview/bug/CSCvs58103
quickview.cloudapps.cisco.com/quickview/bug/CSCvs58812
quickview.cloudapps.cisco.com/quickview/bug/CSCvs58979
quickview.cloudapps.cisco.com/quickview/bug/CSCvs76870
security.netapp.com/advisory/ntap-20200103-0004/
support.apple.com/en-gb/HT211100
support.apple.com/kb/HT211100
support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-19232
support2.windriver.com/index.php?page=defects&on=view&id=LIN1018-5506
www.bsi.bund.de/SharedDocs/Warnmeldungen/DE/CB/2019/12/warnmeldung_cb-k20-0001.html
www.oracle.com/security-alerts/bulletinapr2020.html
www.sudo.ws/devel.html#1.8.30b2
www.sudo.ws/stable.html
www.tenable.com/plugins/nessus/133936
Related
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
7.5 High
AI Score
Confidence
High
0.008 Low
EPSS
Percentile
81.2%