An update of the sudo package has been released.

Todd C. Miller reports :

When sudo is configured to allow a user to run commands as an arbitrary user via the ALL keyword in a Runas specification, it is possible to run commands as root by specifying the user ID -1 or 4294967295.

This can be used by a user with sufficient sudo privileges to run commands as root even if the Runas specification explicitly disallows root access as long as the ALL keyword is listed first in the Runas specification.

Log entries for commands run this way will list the target user as 4294967295 instead of root. In addition, PAM session modules will not be run for the command.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3204 advisory.

  - sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword (CVE-2019-14287)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

- Rebase to 1.8.28

  - Fixed CVE-2019-14287

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In Sudo before 1.8.28, an attacker with access to a     Runas ALL sudoer account can bypass certain policy     blacklists and session PAM modules, and can cause     incorrect logging, by invoking sudo with a crafted user     ID. For example, this allows bypass of !root     configuration, and USER= logging, for a 'sudo -u     \#$((0xffffffff))' command.(CVE-2019-14287)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3755 advisory.

  - sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword (CVE-2019-14287)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.11.2.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.11.2.1 advisory.

  - In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy     blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user     ID. For example, this allows bypass of !root configuration, and USER= logging, for a sudo -u     \#$((0xffffffff)) command. (CVE-2019-14287)

  - A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to     4.20. An attacker, who is able to mount an exported NFS filesystem, is able to trigger a null pointer     dereference by using an invalid NFS sequence. This can panic the machine and deny access to the NFS     server. Any outstanding disk writes to the NFS server will be lost. (CVE-2018-16871)

  - A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network     namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-     free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system     panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. (CVE-2018-16884)

  - Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics for Linux before version 5.0     may allow an authenticated user to potentially enable escalation of privilege via local access.
    (CVE-2019-11085)

  - An issue was discovered in the Linux kernel before 5.0.4. There is a use-after-free upon attempted read     access to /proc/ioports after the ipmi_si module is removed, related to drivers/char/ipmi/ipmi_si_intf.c,     drivers/char/ipmi/ipmi_si_mem_io.c, and drivers/char/ipmi/ipmi_si_port_io.c. (CVE-2019-11811)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking).
    Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a     person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to     Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2019-2945)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Kerberos). Supported     versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java     SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly     impact additional products. Successful attacks of this vulnerability can result in unauthorized access to     critical data or complete access to all Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2019-2949)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported     versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2019-2962)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency).
    Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component     without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web     service. (CVE-2019-2964)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported     versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2019-2973, CVE-2019-2981)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported     versions that are affected are Java SE: 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data and unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2019-2975)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking).
    Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2019-2978)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2019-2983)

  - Vulnerability in the Java SE product of Oracle Java SE (component: 2D). Supported versions that are     affected are Java SE: 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability     can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note:
    This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2019-2987)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported     versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to     Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2019-2988, CVE-2019-2992)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking).
    Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE     Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability     can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java     SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This     vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service     which supplies data to the APIs. (CVE-2019-2989)

  - Vulnerability in the Java SE product of Oracle Java SE (component: Javadoc). Supported versions that are     affected are Java SE: 7u231, 8u221, 11.0.4 and 13. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful     attacks require human interaction from a person other than the attacker and while the vulnerability is in     Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability     can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as     unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the     Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers,     that load and run only trusted code (e.g., code installed by an administrator). (CVE-2019-2999)

  - A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a     specially crafted message to the imptcp socket, which would cause rsyslog to crash. Versions before 8.27.0     are vulnerable. (CVE-2018-16881)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
130107	Photon OS 2.0: Sudo PHSA-2019-2.0-0183	Nessus	PhotonOS Local Security Checks	10/22/2019	1/20/2023	high
130108	Photon OS 1.0: Sudo PHSA-2019-1.0-0254	Nessus	PhotonOS Local Security Checks	10/22/2019	1/20/2023	high
130239	FreeBSD : sudo -- Potential bypass of Runas user restrictions (3a1474ba-f646-11e9-b0af-b888e347c638)	Nessus	FreeBSD Local Security Checks	10/25/2019	1/23/2023	high
130250	RHEL 7 : sudo (RHSA-2019:3204)	Nessus	Red Hat Local Security Checks	10/25/2019	4/28/2024	high
130412	Fedora 29 : sudo (2019-72755db9c7)	Nessus	Fedora Local Security Checks	10/31/2019	4/16/2024	high
130653	EulerOS 2.0 SP5 : sudo (EulerOS-SA-2019-2191)	Nessus	Huawei Local Security Checks	11/8/2019	1/19/2023	high
130741	RHEL 6 : sudo (RHSA-2019:3755)	Nessus	Red Hat Local Security Checks	11/8/2019	4/27/2024	high
131370	EulerOS 2.0 SP8 : sudo (EulerOS-SA-2019-2304)	Nessus	Huawei Local Security Checks	11/27/2019	1/19/2023	high
164598	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.11.2.1)	Nessus	Misc.	9/1/2022	2/5/2024	high
164602	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.11.3)	Nessus	Misc.	9/1/2022	2/5/2024	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

critical