An update of the sudo package has been released.

- Rebase to 1.8.28

  - Fixed CVE-2019-14287

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the sudo package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - In Sudo before 1.8.28, an attacker with access to a     Runas ALL sudoer account can bypass certain policy     blacklists and session PAM modules, and can cause     incorrect logging, by invoking sudo with a crafted user     ID. For example, this allows bypass of !root     configuration, and USER= logging, for a 'sudo -u     \#$((0xffffffff))' command.(CVE-2019-14287)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Todd C. Miller reports :

When sudo is configured to allow a user to run commands as an arbitrary user via the ALL keyword in a Runas specification, it is possible to run commands as root by specifying the user ID -1 or 4294967295.

This can be used by a user with sufficient sudo privileges to run commands as root even if the Runas specification explicitly disallows root access as long as the ALL keyword is listed first in the Runas specification.

Log entries for commands run this way will list the target user as 4294967295 instead of root. In addition, PAM session modules will not be run for the command.

The version of AOS installed on the remote host is prior to 5.11.3. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.11.3 advisory.

  - A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell     WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a     denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the     availability of the system. If code execution occurs, the code will run with the permissions of root. This     will affect both confidentiality and integrity of files on the system. (CVE-2019-14901)

  - OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated     the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
    (CVE-2019-5544)

  - In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy     blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user     ID. For example, this allows bypass of !root configuration, and USER= logging, for a sudo -u     \#$((0xffffffff)) command. (CVE-2019-14287)

  - Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly     sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox     < 68, and Thunderbird < 60.8. (CVE-2019-11729)

  - When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the     block size, a small out of bounds write could occur. This could have caused heap corruption and a     potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and     Firefox < 71. (CVE-2019-11745)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2019-4363:03 advisory.

    [Security Fix]
    - sudoALL  Runas     ID( 0xffffffff)     PAM     (CVE-2019-14287)     CVEJVNhttp://jvndb.jvn.jp/

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0113 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2019-14287:
    In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy     blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user     ID. For example, this allows bypass of !root configuration, and USER= logging, for a sudo -u     \#$((0xffffffff)) command.

    CVE-2019-18634:
    In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer     overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS;
    however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an     administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.

    CVE-2019-19232:
    ** DISPUTED ** In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can     impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user.
    NOTE: The software maintainer believes that this is not a vulnerability because running a command via sudo     as a user not present in the local password database is an intentional feature. Because this behavior     surprised some users, sudo 1.8.30 introduced an option to enable/disable this behavior with the default     being disabled. However, this does not change the fact that sudo was behaving as intended, and as     documented, in earlier versions.

    CVE-2021-23239:
    The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary     directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory     by a symlink to an arbitrary path.

    CVE-2021-23240:
    selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file     ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file     target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable.

    CVE-2021-3156:
    Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which     allows privilege escalation to root via sudoedit -s and a command-line argument that ends with a single     backslash character.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for sudo fixes the following issue :

  - CVE-2019-14287: Fixed an issue where a user with sudo     privileges that allowed them to run commands with an     arbitrary uid, could run commands as root, despite being     forbidden to do so in sudoers (bsc#1153674).

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:3694 advisory.

    The sudo packages contain the sudo utility which allows system administrators to provide certain users     with the permission to execute privileged commands, which are used for system management purposes, without     having to log in as root.

    Security Fix(es):

    * sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword (CVE-2019-14287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for sudo fixes the following issue :

CVE-2019-14287: Fixed an issue where a user with sudo privileges that allowed them to run commands with an arbitrary uid, could run commands as root, despite being forbidden to do so in sudoers (bsc#1153674).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has sudo packages installed that are affected by a vulnerability:

  - In Sudo before 1.8.28, an attacker with access to a     Runas ALL sudoer account can bypass certain policy     blacklists and session PAM modules, and can cause     incorrect logging, by invoking sudo with a crafted user     ID. For example, this allows bypass of !root     configuration, and USER= logging, for a sudo -u     \#$((0xffffffff)) command. (CVE-2019-14287)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2019:14193-1 advisory.

  - In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy     blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user     ID. For example, this allows bypass of !root configuration, and USER= logging, for a sudo -u     \#$((0xffffffff)) command. (CVE-2019-14287)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Joe Vennix discovered that sudo, a program designed to provide limited super user privileges to specific users, when configured to allow a user to run commands as an arbitrary user via the ALL keyword in a Runas specification, allows to run commands as root by specifying the user ID -1 or 4294967295. This could allow a user with sufficient sudo privileges to run commands as root even if the Runas specification explicitly disallows root access.

ID	Name	Product	Family	Published	Updated	Severity
130108	Photon OS 1.0: Sudo PHSA-2019-1.0-0254	Nessus	PhotonOS Local Security Checks	10/22/2019	1/20/2023	high
130075	Fedora 31 : sudo (2019-67998e9f7e)	Nessus	Fedora Local Security Checks	10/21/2019	1/23/2023	high
132840	EulerOS Virtualization for ARM 64 3.0.5.0 : sudo (EulerOS-SA-2020-1086)	Nessus	Huawei Local Security Checks	1/13/2020	1/19/2023	high
130239	FreeBSD : sudo -- Potential bypass of Runas user restrictions (3a1474ba-f646-11e9-b0af-b888e347c638)	Nessus	FreeBSD Local Security Checks	10/25/2019	1/23/2023	high
164602	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.11.3)	Nessus	Misc.	9/1/2022	2/21/2026	critical
289912	MiracleLinux 7 : sudo-1.8.23-4.el7.1 (AXSA:2019-4363:03)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	high
238810	TencentOS Server 3: sudo (TSSA-2022:0113)	Nessus	Tencent Local Security Checks	6/16/2025	11/23/2025	high
129877	openSUSE Security Update : sudo (openSUSE-2019-2316)	Nessus	SuSE Local Security Checks	10/15/2019	4/18/2024	high
130564	RHEL 8 : sudo (RHSA-2019:3694)	Nessus	Red Hat Local Security Checks	11/6/2019	11/6/2024	high
129880	SUSE SLED15 / SLES15 Security Update : sudo (SUSE-SU-2019:2656-1)	Nessus	SuSE Local Security Checks	10/15/2019	1/20/2023	high
133081	NewStart CGSL CORE 5.05 / MAIN 5.05 : sudo Vulnerability (NS-SA-2020-0004)	Nessus	NewStart CGSL Local Security Checks	1/20/2020	1/19/2023	high
150614	SUSE SLES11 Security Update : sudo (SUSE-SU-2019:14193-1)	Nessus	SuSE Local Security Checks	6/10/2021	1/17/2023	high
146312	Linux sudo Privilege Escalation Vulnerability (direct check)	Nessus	Misc.	2/9/2021	6/2/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

critical

high

high

high

high

high

high

high

high