what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 11 of 11 RSS Feed

CVE-2019-18634

Status Candidate

Overview

In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.

Related Files

Gentoo Linux Security Advisory 202003-12
Posted Mar 14, 2020
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 202003-12 - Multiple vulnerabilities have been found in sudo, the worst of which could result in privilege escalation. Versions less than 1.8.31 are affected.

tags | advisory, vulnerability
systems | linux, gentoo
advisories | CVE-2019-14287, CVE-2019-18634
SHA-256 | eed200ca7c0e04f4b80810b0a49f8e1c5b42b0faaffa918f75f0342ba3bcc7ae
Red Hat Security Advisory 2020-0726-01
Posted Mar 5, 2020
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2020-0726-01 - The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Issues addressed include a buffer overflow vulnerability.

tags | advisory, overflow, root
systems | linux, redhat
advisories | CVE-2019-18634
SHA-256 | fe69aca682e06981b424172235b6a5a59085d438109e2b11884873642b00c606
Red Hat Security Advisory 2020-0540-01
Posted Feb 18, 2020
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2020-0540-01 - The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Issues addressed include a buffer overflow vulnerability.

tags | advisory, overflow, root
systems | linux, redhat
advisories | CVE-2019-18634
SHA-256 | 093a6b0f2cb100fde3128d6893134efba26147263f605ec9272cf28fd502f62c
Red Hat Security Advisory 2020-0509-01
Posted Feb 14, 2020
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2020-0509-01 - The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Issues addressed include a buffer overflow vulnerability.

tags | advisory, overflow, root
systems | linux, redhat
advisories | CVE-2019-18634
SHA-256 | 46e026b8c73b2c8554ec737612a6983dcc2e937ad252d8277022593a99e1f078
Red Hat Security Advisory 2020-0487-01
Posted Feb 13, 2020
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2020-0487-01 - The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Issues addressed include a buffer overflow vulnerability.

tags | advisory, overflow, root
systems | linux, redhat
advisories | CVE-2019-18634
SHA-256 | d07d1892269b8f92df66a4d09cc3d2fd52cb020b25b56e79796b27001a2d25ef
Ubuntu Security Notice USN-4263-2
Posted Feb 5, 2020
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 4263-2 - USN-4263-1 fixed a vulnerability in Sudo. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Joe Vennix discovered that Sudo incorrectly handled memory operations when the pwfeedback option is enabled. A local attacker could possibly use this issue to obtain unintended access to the administrator account. Various other issues were also addressed.

tags | advisory, local
systems | linux, ubuntu
advisories | CVE-2019-18634
SHA-256 | 2e8986e72ddfa93d5be915aa5cdadfaa3bba5b67d5c5ef98260cdf49fce35fdc
Sudo 1.8.25p Buffer Overflow
Posted Feb 4, 2020
Authored by Joe Vennix

Sudo version 1.8.25p suffers from a buffer overflow vulnerability.

tags | exploit, overflow
advisories | CVE-2019-18634
SHA-256 | 13793f27ea49c2e00cf68927042c89a45205495be48da25ef5de1bffae73c805
Ubuntu Security Notice USN-4263-1
Posted Feb 3, 2020
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 4263-1 - Joe Vennix discovered that Sudo incorrectly handled memory operations when the pwfeedback option is enabled. A local attacker could possibly use this issue to obtain unintended access to the administrator account.

tags | advisory, local
systems | linux, ubuntu
advisories | CVE-2019-18634
SHA-256 | 8485d93ec2d952d049e78d5994a67c5e7e91ee758df6d12aeb7c8e6ea99106e3
Debian Security Advisory 4614-1
Posted Feb 3, 2020
Authored by Debian | Site debian.org

Debian Linux Security Advisory 4614-1 - Joe Vennix discovered a stack-based buffer overflow vulnerability in sudo, a program designed to provide limited super user privileges to specific users, triggerable when configured with the "pwfeedback" option enabled. An unprivileged user can take advantage of this flaw to obtain full root privileges.

tags | advisory, overflow, root
systems | linux, debian
advisories | CVE-2019-18634
SHA-256 | 2957f727438c3e2bd92e2e038adc6d4f2ddfaacd4b035ca5555aec139dae983f
Slackware Security Advisory - sudo Updates
Posted Feb 2, 2020
Authored by Slackware Security Team | Site slackware.com

Slackware Security Advisory - New sudo packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue.

tags | advisory
systems | linux, slackware
advisories | CVE-2019-18634
SHA-256 | f43f2ad60a1fdece56758291a92ae0fafcbab9d46cd016f4ad1cf717b4fd9689
Apple Security Advisory 2020-1-28-2
Posted Jan 29, 2020
Authored by Apple | Site apple.com

Apple Security Advisory 2020-1-28-2 - macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra are now available and address buffer overflow, bypass, and code execution vulnerabilities.

tags | advisory, overflow, vulnerability, code execution
systems | apple
advisories | CVE-2019-11043, CVE-2019-18634, CVE-2020-3826, CVE-2020-3827, CVE-2020-3829, CVE-2020-3830, CVE-2020-3835, CVE-2020-3836, CVE-2020-3837, CVE-2020-3838, CVE-2020-3839, CVE-2020-3840, CVE-2020-3842, CVE-2020-3843, CVE-2020-3845, CVE-2020-3846, CVE-2020-3847, CVE-2020-3848, CVE-2020-3849, CVE-2020-3850, CVE-2020-3853, CVE-2020-3854, CVE-2020-3855, CVE-2020-3856, CVE-2020-3857, CVE-2020-3866, CVE-2020-3870, CVE-2020-3871
SHA-256 | 6dc59a831c4eeb00f22a91e88c410f4413de1117cf660dac3d76799ab2d9c97d
Page 1 of 1
Back1Next

File Archive:

November 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    30 Files
  • 2
    Nov 2nd
    0 Files
  • 3
    Nov 3rd
    0 Files
  • 4
    Nov 4th
    12 Files
  • 5
    Nov 5th
    44 Files
  • 6
    Nov 6th
    18 Files
  • 7
    Nov 7th
    9 Files
  • 8
    Nov 8th
    8 Files
  • 9
    Nov 9th
    3 Files
  • 10
    Nov 10th
    0 Files
  • 11
    Nov 11th
    14 Files
  • 12
    Nov 12th
    20 Files
  • 13
    Nov 13th
    63 Files
  • 14
    Nov 14th
    18 Files
  • 15
    Nov 15th
    8 Files
  • 16
    Nov 16th
    0 Files
  • 17
    Nov 17th
    0 Files
  • 18
    Nov 18th
    18 Files
  • 19
    Nov 19th
    7 Files
  • 20
    Nov 20th
    13 Files
  • 21
    Nov 21st
    6 Files
  • 22
    Nov 22nd
    48 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    60 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    44 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close