CVE-2019-19232
- State
- Published
- Severity
- Not scored
- Published
- Dec 19, 2019
- Updated
- Aug 5, 2024
- Reserved
- Nov 22, 2019
Description
In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user. NOTE: The software maintainer believes that this is not a vulnerability because running a command via sudo as a user not present in the local password database is an intentional feature. Because this behavior surprised some users, sudo 1.8.30 introduced an option to enable/disable this behavior with the default being disabled. However, this does not change the fact that sudo was behaving as intended, and as documented, in earlier versions
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://www.sudo.ws/stable.html
- https://www.sudo.ws/devel.html#1.8.30b2
- https://security.netapp.com/advisory/ntap-20200103-0004/
- https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58812
- https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58979
- https://www.bsi.bund.de/SharedDocs/Warnmeldungen/DE/CB/2019/12/warnmeldung_cb-k20-0001.html
- https://support2.windriver.com/index.php?page=defects&on=view&id=LIN1018-5506
- https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58103
- https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-19232
- https://access.redhat.com/security/cve/cve-2019-19232
- https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs76870
- FEDORA-2020-8b563bc5f4vendor-advisory
- FEDORA-2020-7c1b270959vendor-advisory
- https://support.apple.com/kb/HT211100
- 20200324 APPLE-SA-2020-03-24-2 macOS Catalina 10.15.4, Security Update 2020-002 Mojave, Security Update 2020-002 High Sierramailing-list
- https://support.apple.com/en-gb/HT211100
- https://www.tenable.com/plugins/nessus/133936
- https://www.oracle.com/security-alerts/bulletinapr2020.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.