PT-2021-9084 · Opendoas · Opendoas

Published 2021-01-28 · Updated 2022-04-26 · CVE-2019-25016

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenDoas versions 6.6 through 6.8

Description The issue arises from an incorrect inheritance of the user's PATH variable by authenticated executions in OpenDoas, specifically when the authenticating rule allows the user to execute any command. This does not affect rules that only permit the authenticated user to execute specific commands. There is an unsafe incomplete reset of the PATH variable when changing the user context.

Recommendations For OpenDoas versions 6.6 through 6.8, consider restricting the authenticating rules to only allow execution of specific commands until a fix is available. As a temporary workaround, review and adjust the PATH variable settings to minimize potential risks.

Exploit

Fix

Weakness Enumeration

CWE-909

CWE-459

Related Identifiers

CVE-2019-25016

Affected Products

Opendoas

References · 11

• 🔥 https://github.com/Duncaen/OpenDoas/issues/45 · Exploit
• https://github.com/Duncaen/OpenDoas/commit/d5acd52e2a15c36a8e06f9103d35622933aa422d · Patch
• https://github.com/Duncaen/OpenDoas/commit/01c658f8c45cb92a343be5f32aa6da70b2032168 · Patch
• https://osv.dev/vulnerability/ALPINE-CVE-2019-25016 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25016 · Security Note
• https://osv.dev/vulnerability/CVE-2019-25016 · Vendor Advisory
• https://security.gentoo.org/glsa/202107-11 · Vendor Advisory
• https://github.com/Duncaen/OpenDoas/releases/tag/v6.8.1 · Note
• https://t.me/cibsecurity/22803 · Telegram Post
• https://t.me/cvenotify/9133 · Telegram Post
• https://security.alpinelinux.org/vuln/CVE-2019-25016 · Note