PT-2019-14463 · Slicer69 · Slicer69 Doas

Published 2019-10-18 · Updated 2024-02-16 · CVE-2019-15900

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions slicer69 doas versions prior to 6.2

Description An issue was discovered in slicer69 doas where sscanf was used without checking for error cases on platforms without strtonum(3). The uninitialized variable errstr was checked, and in some cases, it returned success even if sscanf failed. This resulted in executing commands as root instead of reporting that the supplied username or group name did not exist.

Recommendations For versions prior to 6.2, update to version 6.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the affected command execution functionality until a patch is available.

Fix

Unchecked Return Value

Incorrect Authorization

Use of Uninitialized Resource

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-252

CWE-863

CWE-908

CWE-754

Related Identifiers

CVE-2019-15900

Affected Products

Slicer69 Doas

References · 5

• https://github.com/slicer69/doas/commit/2f83222829448e5bc4c9391d607ec265a1e06531 · Patch
• https://osv.dev/vulnerability/CVE-2019-15900 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15900 · Security Note
• https://github.com/slicer69/doas/compare/6.1p1...6.2 · Note
• https://t.me/cvenotify/71729 · Telegram Post