According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - ** DISPUTED ** In Sudo through 1.8.29, an attacker with     access to a Runas ALL sudoer account can impersonate a     nonexistent user by invoking sudo with a numeric uid     that is not associated with any user. NOTE: The     software maintainer believes that this is not a     vulnerability because running a command via sudo as a     user not present in the local password database is an     intentional feature. Because this behavior surprised     some users, sudo 1.8.30 introduced an option to     enable/disable this behavior with the default being     disabled. However, this does not change the fact that     sudo was behaving as intended, and as documented, in     earlier versions.(CVE-2019-19232)

  - ** DISPUTED ** In Sudo through 1.8.29, the fact that a     user has been blocked (e.g., by using the ! character     in the shadow file instead of a password hash) is not     considered, allowing an attacker (who has access to a     Runas ALL sudoer account) to impersonate any blocked     user. NOTE: The software maintainer believes that this     CVE is not valid. Disabling local password     authentication for a user is not the same as disabling     all access to that user--the user may still be able to     login via other means (ssh key, kerberos, etc). Both     the Linux shadow(5) and passwd(1) manuals are clear on     this. Indeed it is a valid use case to have local     accounts that are _only_ accessible via sudo and that     cannot be logged into with a password. Sudo 1.8.30     added an optional setting to check the _shell_ of the     target user (not the encrypted password!) against the     contents of /etc/shells but that is not the same thing     as preventing access to users with an invalid password     hash.(CVE-2019-19234)

  - In Sudo before 1.8.26, if pwfeedback is enabled in     /etc/sudoers, users can trigger a stack-based buffer     overflow in the privileged sudo process. (pwfeedback is     a default setting in Linux Mint and elementary OS     however, it is NOT the default for upstream and many     other packages, and would exist only if enabled by an     administrator.) The attacker needs to deliver a long     string to the stdin of getln() in     tgetpass.c.(CVE-2019-18634)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the sudo package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In Sudo before 1.8.26, if pwfeedback is enabled in     /etc/sudoers, users can trigger a stack-based buffer     overflow in the privileged sudo process. (pwfeedback is     a default setting in Linux Mint and elementary OS     however, it is NOT the default for upstream and many     other packages, and would exist only if enabled by an     administrator.) The attacker needs to deliver a long     string to the stdin of getln() in     tgetpass.c.(CVE-2019-18634)

  - In Sudo through 1.8.29, an attacker with access to a     Runas ALL sudoer account can impersonate a nonexistent     user by invoking sudo with a numeric uid that is not     associated with any user.(CVE-2019-19232)

  - In Sudo through 1.8.29, the fact that a user has been     blocked (e.g., by using the ! character in the shadow     file instead of a password hash) is not considered,     allowing an attacker (who has access to a Runas ALL     sudoer account) to impersonate any blocked     user.(CVE-2019-19234)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has sudo packages installed that are affected by a vulnerability:

  - In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer     overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS;
    however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an     administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.
    (CVE-2019-18634)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:0487 advisory.

  - sudo: Stack based buffer overflow when pwfeedback is enabled (CVE-2019-18634)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2020-4491:02 advisory.

    * sudo: Stack based buffer overflow when pwfeedback is enabled (CVE-2019-18634)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A stack-based buffer overflow vulnerability in sudo, a program designed to provide limited super user privileges to specific users, triggerable when configured with the pwfeedback option enabled. An unprivileged user can take advantage of this flaw to obtain full root privileges.

For Debian 8 'Jessie', this problem has been fixed in version 1.8.10p3-1+deb8u7.

We recommend that you upgrade your sudo packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Todd C. Miller reports :

Sudo's pwfeedback option can be used to provide visual feedback when the user is inputting their password. For each key press, an asterisk is printed. This option was added in response to user confusion over how the standard Password: prompt disables the echoing of key presses.
While pwfeedback is not enabled by default in the upstream version of sudo, some systems, such as Linux Mint and Elementary OS, do enable it in their default sudoers files.

Due to a bug, when the pwfeedback option is enabled in the sudoers file, a user may be able to trigger a stack-based buffer overflow.
This bug can be triggered even by users not listed in the sudoers file. There is no impact unless pwfeedback has been enabled.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:0487 advisory.

    The sudo packages contain the sudo utility which allows system administrators to provide certain users     with the permission to execute privileged commands, which are used for system management purposes, without     having to log in as root.

    Security Fix(es):

    * sudo: Stack based buffer overflow when pwfeedback is enabled (CVE-2019-18634)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for sudo fixes the following issue :

Security issue fixed :

CVE-2019-18634: Fixed a buffer overflow in the passphrase prompt that could occur when pwfeedback was enabled in /etc/sudoers (bsc#1162202).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sudo fixes the following issues :

Security issue fixed :

CVE-2019-18634: Fixed a buffer overflow in the passphrase prompt that could occur when pwfeedback was enabled in /etc/sudoers (bsc#1162202).

Non-security issue fixed: Fixed an issue where sudo -l would ask for a password even though `listpw` was set to `never` (bsc#1162675).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - sudo: Stack based buffer overflow when pwfeedback is     enabled (CVE-2019-18634)

The version of AOS installed on the remote host is prior to 5.16.1.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.16.1.1 advisory.

  - In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a     long SSID IE, leading to a Buffer Overflow. (CVE-2019-17133)

  - A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell     WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a     denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the     availability of the system. If code execution occurs, the code will run with the permissions of root. This     will affect both confidentiality and integrity of files on the system. (CVE-2019-14901)

  - The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to     prevent vma layout or vma flags changes while it runs, which allows local users to obtain sensitive     information, cause a denial of service, or possibly have unspecified other impact by triggering a race     condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c,     fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c. (CVE-2019-11599)

  - There is heap-based buffer overflow in kernel, all versions up to, excluding 5.3, in the marvell wifi chip     driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly     execute arbitrary code. (CVE-2019-14816)

  - A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.x.x and 4.x.x before     4.18.0, in Marvell WiFi chip driver. The flaw could occur when the station attempts a connection     negotiation during the handling of the remote devices country settings. This could allow the remote device     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-14895)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
137504	EulerOS 2.0 SP2 : sudo (EulerOS-SA-2020-1662)	Nessus	Huawei Local Security Checks	6/17/2020	5/13/2022	high
141722	EulerOS Virtualization 3.0.2.2 : sudo (EulerOS-SA-2020-2196)	Nessus	Huawei Local Security Checks	10/21/2020	5/11/2022	high
143914	NewStart CGSL CORE 5.05 / MAIN 5.05 : sudo Vulnerability (NS-SA-2020-0096)	Nessus	NewStart CGSL Local Security Checks	12/9/2020	12/10/2020	high
145976	CentOS 8 : sudo (CESA-2020:0487)	Nessus	CentOS Local Security Checks	2/1/2021	3/23/2021	high
294011	MiracleLinux 4 : sudo-1.8.6p3-29.AXS4.3 (AXSA:2020-4491:02)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	high
133414	Debian DLA-2094-1 : sudo security update	Nessus	Debian Local Security Checks	2/3/2020	3/28/2024	high
133433	FreeBSD : sudo -- Potential bypass of Runas user restrictions (b4e5f782-442d-11ea-9ba9-206a8a720317)	Nessus	FreeBSD Local Security Checks	2/3/2020	3/28/2024	high
133712	RHEL 8 : sudo (RHSA-2020:0487)	Nessus	Red Hat Local Security Checks	2/14/2020	11/7/2024	high
133831	SUSE SLES12 Security Update : sudo (SUSE-SU-2020:0407-1)	Nessus	SuSE Local Security Checks	2/20/2020	3/26/2024	high
133833	SUSE SLES12 Security Update : sudo (SUSE-SU-2020:0409-1)	Nessus	SuSE Local Security Checks	2/20/2020	3/26/2024	high
134346	Scientific Linux Security Update : sudo on SL6.x i386/x86_64 (20200305)	Nessus	Scientific Linux Local Security Checks	3/9/2020	3/25/2024	high
164606	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.16.1.1)	Nessus	Misc.	9/1/2022	2/17/2025	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high

critical