CVE-2019-18634

Katalog CVE

CVSS 7.8 · High EPSS 19,3%

Kerentanan Out-of-bounds Write pada sudo project sudo, debian linux. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.

Rincian

Terbit di NVD

29 Januari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-787: Out-of-bounds Write

EPSS (30 hari)

19,3% peluang dieksploitasi; lebih tinggi dari 97,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.sudo.ws/alerts/pwfeedback.html exploit · advisory vendor
• https://www.sudo.ws/security.html advisory vendor
• http://packetstormsecurity.com/files/156174/Slackware-Security-Advisory-sudo-Updates.html advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/156189/Sudo-1.8.25p-Buffer-Overflow.html advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2020/Jan/40 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2020/01/30/6 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2020/01/31/1 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2020/02/05/2 advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2020/02/05/5 exploit · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/02/msg00002.html mailing list · advisory pihak ketiga
• https://seclists.org/bugtraq/2020/Feb/2 mailing list · advisory pihak ketiga
• https://seclists.org/bugtraq/2020/Feb/3 mailing list · advisory pihak ketiga
• https://seclists.org/bugtraq/2020/Jan/44 mailing list · advisory pihak ketiga
• https://support.apple.com/kb/HT210919 advisory pihak ketiga
• https://www.debian.org/security/2020/dsa-4614 advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00029.html
• https://access.redhat.com/errata/RHSA-2020:0487
• https://access.redhat.com/errata/RHSA-2020:0509
• https://access.redhat.com/errata/RHSA-2020:0540
• https://access.redhat.com/errata/RHSA-2020:0726
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6TKF36KOQUVJ...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IY6DZ7WMDKU4Z...
• https://security.gentoo.org/glsa/202003-12
• https://security.netapp.com/advisory/ntap-20200210-0001/
• https://usn.ubuntu.com/4263-1/