PT-2019-15986 · Linux · Shadow

Michael Weiser · Published 2019-12-18 · Updated 2020-08-25 · CVE-2019-19882

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions shadow version 4.8

Description The issue allows local users to obtain root access due to misconfigured setuid programs. This specifically affects shadow 4.8 when compiled with --with-libpam but without --disable-account-tools-setuid and without a suitable PAM configuration for setuid account management tools. As a result, account management tools such as groupadd, groupdel, groupmod, useradd, userdel, and usermod can be used by unprivileged local users to escalate privileges to root in multiple ways.

Recommendations For shadow version 4.8, consider recompiling with --disable-account-tools-setuid or ensure a suitable PAM configuration is in place for use with setuid account management tools to prevent privilege escalation. As a temporary workaround, consider restricting access to the account management tools until a properly configured version is available.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2019-19882

Affected Products

Shadow

References · 13

• 🔥 https://bugs.gentoo.org/702252 · Exploit
• 🔥 https://bugs.archlinux.org/task/64836 · Exploit
• https://github.com/void-linux/void-packages/pull/17580 · Patch
• https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75 · Patch
• https://github.com/shadow-maint/shadow/pull/199 · Patch
• https://cve.org/CVERecord?id=CVE-2019-19882 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-19882 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19882 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-19882 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-19882 · Vendor Advisory
• https://security.gentoo.org/glsa/202008-09 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19882 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-19882 · Vendor Advisory