CVE-2019-19232

Description

In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user. NOTE: The software maintainer believes that this is not a vulnerability because running a command via sudo as a user not present in the local password database is an intentional feature. Because this behavior surprised some users, sudo 1.8.30 introduced an option to enable/disable this behavior with the default being disabled. However, this does not change the fact that sudo was behaving as intended, and as documented, in earlier versions

7.5

CVSS

Severity: High

CVSS 3.1 •

CVSS 2.0 •

EPSS 4.47% Top 15%

Vendor Advisory fedoraproject.org Vendor Advisory fedoraproject.org Vendor Advisory sudo.ws Vendor Advisory sudo.ws

Affected: n/a n/a

References

Link	Tags
https://www.sudo.ws/stable.html	vendor advisory
https://www.sudo.ws/devel.html#1.8.30b2	vendor advisory
https://security.netapp.com/advisory/ntap-20200103-0004/
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58812
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58979
https://www.bsi.bund.de/SharedDocs/Warnmeldungen/DE/CB/2019/12/warnmeldung_cb-k20-0001.html
https://support2.windriver.com/index.php?page=defects&on=view&id=LIN1018-5506
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58103
https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-19232
https://access.redhat.com/security/cve/cve-2019-19232
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs76870
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IY6DZ7WMDKU4ZDML6MJLDAPG42B5WVUC/	vendor advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6TKF36KOQUVJNBHSVJFA7BU3CCEYD2F/	vendor advisory
https://support.apple.com/kb/HT211100
http://seclists.org/fulldisclosure/2020/Mar/31	mailing list
https://support.apple.com/en-gb/HT211100
https://www.tenable.com/plugins/nessus/133936
https://www.oracle.com/security-alerts/bulletinapr2020.html

Frequently Asked Questions

What is the severity of CVE-2019-19232?: CVE-2019-19232 has been scored as a high severity vulnerability.
How to fix CVE-2019-19232?: To fix CVE-2019-19232, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2019-19232 being actively exploited in the wild?: It is possible that CVE-2019-19232 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~4% probability that this vulnerability will be exploited by malicious actors in the next 30 days.