PT-2019-4664 · Todd Miller+4 · Sudo+4

Published 2019-12-19 · Updated 2024-08-05 · CVE-2019-19232

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Sudo versions 1.8.29 and earlier

Description The issue is related to the sudoer account with Runas ALL privileges, allowing an attacker to impersonate a nonexistent user by invoking sudo with a numeric uid not associated with any user. This behavior was considered an intentional feature by the software maintainer, but it surprised some users. As a result, sudo 1.8.30 introduced an option to enable or disable this behavior, with the default being disabled.

Recommendations For Sudo versions 1.8.29 and earlier, consider updating to version 1.8.30 or later, which introduces an option to enable or disable the behavior of running commands via sudo as a user not present in the local password database. As a temporary workaround, restrict access to the Runas ALL sudoer account to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2020-2707

ALT-PU-2020-2731

ALT-PU-2021-1164

ALT-PU-2021-1174

ALT-PU-2021-1184

BDU:2020-00857

CESA-2020_1804

CVE-2019-19232

MGASA-2020-0246

RHSA-2020:1804

RHSA-2020_1804

Affected Products

Alt Linux

Astra Linux

Centos

Red Hat

Sudo

References · 39

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IY6DZ7WMDKU4ZDML6MJLDAPG42B5WVUC · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0246.html · Security Note
• https://osv.dev/vulnerability/MGASA-2020-0246 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-19232 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00857 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-19232 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-19232 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-19232 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-19232 · Vendor Advisory
• https://sudo.ws/devel.html#1.8.30b2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6TKF36KOQUVJNBHSVJFA7BU3CCEYD2F · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19232 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-19232 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0426SE17 · Vendor Advisory
• https://sudo.ws/stable.html · Vendor Advisory