Permissions, Privileges, and Access Controls in Sudo - CVE-2019-14287

Vulnerability identifier: #VU21782

CSH Severity: Low

CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-14287

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: Public exploit is available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists in the implementation of the "sudo" application when processing commands that are configured to run with ALL keyword. A local user with privileges to use sudo for specific applications on the system can escalate privileges and run the application as root (even if precisely restricted), if user id "-1" or "4294967295" is used.

Example:

The following entry instructs sudo to allow user bob to run "/usr/bin/id" command as any user on the system but root:

myhost bob = (ALL, !root) /usr/bin/id

The following command will allow bob execute the  "/usr/bin/id" command as root:

sudo -u#-1 id -u

Sudo
Red Hat OpenShift Container Platform
Gentoo Linux
Arch Linux
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for x86_64
Slackware Linux
Opensuse
Fedora
sudo (Alpine package)
sudo (Debian package)
sudo (Ubuntu package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
sudo (Red Hat package)
sudo
Data Computing Appliance (DCA)
Red Hat Virtualization Host
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)

Install updates from vendor's website.

Sudo - update to 1.8.28
sudo (Alpine package) - update to 1.8.28-r0
sudo (Debian package) - addressed in versions 1.8.19p1-2.1+deb9u1, 1.8.27-1+deb10u1
sudo (Ubuntu package) - addressed in versions 1.8.16-0ubuntu1.8, 1.8.21p2-3ubuntu1.1, 1.8.27-1ubuntu1.1
Data Computing Appliance (DCA) - update to 3.5.5.0
Red Hat OpenShift Container Platform - addressed in versions 4.1.24, 4.2.5
sudo (Red Hat package) - update to 1.8.6p3-15.el6_6.2
sudo - addressed in versions 1.8.28-1.fc29, 1.8.28-1.fc30, 1.8.28-1.fc31
Dell EMC Unity Operating Environment (OE) - update to 5.0.3.0.5.014
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.3.0.5.014

• Exploit #9569 - exploitables (This is repo of CVE explanations alongside their respecitve explanations.) (February 27, 2024)
• Exploit #2659 - vulnerability-exploitation (Local Root vulnerability- CVE-2019-13272 / Security Bypass Vulnerability – CVE-2019-14287/Google Android - 'Stagefright' Remote Code Execution - CVE-2015-1538) (May 12, 2020)
• Exploit #2647 - Exploit-CVE-2019-14287 (Documentation for Sudo Security Bypass - CVE 2019-14287) (May 12, 2020)
• Exploit #2648 - Exploiting-a-Linux-kernel-vulnerability (Local Root vulnerability- CVE-2019-13272 / Security Bypass Vulnerability – CVE-2019-14287) (May 12, 2020)
• Exploit #2643 - Sudo-Security-Bypass-Vulnerability-CVE-2019-14287- (This is the exploitation of sudo security bypass vulnerability) (May 12, 2020)
• Exploit #2644 - Sudo-Security-Bypass-Vulnerability (This is a brief exploitation of CVE-2019-14287 Sudo Security Bypass Vulnerability. ) (May 12, 2020)
• Exploit #2235 - SUDO_KILLER (A tool designed to exploit a privilege escalation vulnerability in the sudo program on Unix-like systems. It takes advantage of a specific misconfiguration or flaw in sudo to gain elevated privileges on the system, essentially allowing a regu (March 26, 2020)
• Exploit #2038 - CVE-2019-14287 (Sudo exploit) (March 18, 2020)

• https://www.sudo.ws/alerts/minus_1_uid.html

• Privilege escalation in sudo
• Amazon Linux AMI update for sudo
• Slackware Linux update for sudo
• Debian update for sudo
• OpenSUSE Linux update for sudo
• Ubuntu update for Sudo
• Arch Linux update for sudo
• OpenSUSE Linux update for sudo
• Red Hat update for sudo
• Red Hat update for sudo
• Red Hat update for sudo
• Red Hat update for sudo
• Red Hat update for sudo
• Red Hat update for sudo
• Red Hat update for sudo
• Red Hat update for sudo
• Red Hat Enterprise Linux 6.5 update for sudo
• Multiple vulnerabilities in Red Hat OpenShift Container Platform
• Multiple vulnerabilities in Red Hat Virtualization Hosts (RHVH)
• Multiple vulnerabilities in Red Hat OpenShift Container Platform (machine-os-content-container)
• Red Hat Enterprise Linux Server 5 update for sudo
• Red Hat update for sudo
• Gentoo update for sudo
• Permissions, Privileges, and Access Controls in sudo (Alpine package)
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Red Hat Enterprise Linux 6.6 Advanced Update Support update for sudo
• Fedora 31 update for sudo
• Fedora 30 update for sudo
• Fedora 29 update for sudo
• Dell EMC Unity update for third-party components