Buffer Overflow Vulnerability in Sudo Package: CVE-2019-18634
Summary
ALPINE-CVE-2019-18634: In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. Affects sudo versions < 1.8.27-r2. Fixed in 1.8.27-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Sudo package is a widely used utility in Unix-like operating systems that allows users to execute commands with elevated privileges. It is essential for system administration and security management. However, certain configurations, such as enabling pwfeedback in /etc/sudoers, can expose the system to vulnerabilities, including buffer overflow attacks.
Vulnerability Detail
In Sudo versions prior to 1.8.26, if the pwfeedback option is enabled, it allows users to trigger a stack-based buffer overflow in the privileged sudo process. This vulnerability arises from the way user input is handled in the getln() function within tgetpass.c. An attacker can exploit this by delivering a long string to stdin, potentially leading to arbitrary code execution, system compromise, or privilege escalation.
How To Fix
Minimum fixed version
1.8.27-r2
This is the first release that contains the fix.
sudo apk add --upgrade sudoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating is not immediately possible, consider disabling the pwfeedback option in /etc/sudoers to mitigate the risk. This can be done by commenting out or removing the line that includes 'Defaults pwfeedback'.
Conclusion
CVE-2019-18634 represents a significant security risk for systems using the Sudo package with the pwfeedback option enabled. It is crucial to update to the latest patched versions or disable the vulnerable option to protect against potential exploits.
See every vulnerability recorded for sudo →
FAQ
CVE-2019-18634 is a vulnerability in the Sudo package that can lead to a stack-based buffer overflow if the pwfeedback option is enabled.
If exploited, this vulnerability can allow an attacker to execute arbitrary code, potentially compromising the system or escalating privileges.
Sudo versions prior to 1.8.26 are affected, with specific patched versions available for various Alpine Linux releases.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score for CVE-2019-18634 is 7.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for sudo.
