Sudo Vulnerability: Bypass of Policy Blacklists and Incorrect Logging
Summary
UBUNTU-CVE-2019-14287: In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. Affects sudo versions < 1.8.9p5-1ubuntu1.5+esm2. Fixed in 1.8.9p5-1ubuntu1.5+esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Sudo is a widely used program in Unix-like operating systems that allows users to run commands with the security privileges of another user, typically the superuser. It is a critical component for system administration and security management. The specific vulnerability in question affects versions of Sudo prior to 1.8.28, where an attacker with access to a Runas ALL sudoer account can exploit certain policy blacklists and session PAM modules, leading to incorrect logging and privilege escalation.
Vulnerability Detail
The vulnerability, identified as CVE-2019-14287, allows an attacker to bypass security restrictions by invoking Sudo with a crafted user ID. This can result in the bypassing of configurations that prevent access to the root user, as well as incorrect logging of user actions. The flaw arises from improper handling of user IDs, which can be manipulated to circumvent security policies. The potential ramifications include unauthorized access to sensitive system functions and the ability to execute commands with elevated privileges, posing a significant risk to system integrity.
How To Fix
Minimum fixed version
1.8.9p5-1ubuntu1.5+esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade sudoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, system administrators can restrict access to the Sudo command for affected users until the package is updated. This can be done by modifying the sudoers file using the command:
sudo visudo
Then, remove or comment out the lines that grant the affected users access to Sudo.
Conclusion
The Sudo vulnerability CVE-2019-14287 poses a significant risk by allowing attackers to bypass security policies and gain unauthorized access. It is crucial to update to the patched versions of Sudo to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for sudo →
FAQ
CVE-2019-14287 is a vulnerability in the Sudo program that allows attackers to bypass certain security policies and gain unauthorized access to system functions.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground.
The consequences include unauthorized access to root privileges and incorrect logging of user actions, which can compromise system security.
Yes, patched versions of Sudo are available for various Ubuntu distributions. It is recommended to update to the latest version.
If immediate updating is not possible, restrict access to the Sudo command for affected users as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for sudo.
