In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user. NOTE: The software maintainer believes that this is not a vulnerability because running a command via sudo as a user not present in the local password database is an intentional feature. Because this behavior surprised some users, sudo 1.8.30 introduced an option to enable/disable this behavior with the default being disabled. However, this does not change the fact that sudo was behaving as intended, and as documented, in earlier versions

An update of the sudo package has been released.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sudo: noexec bypass via wordexp() (CVE-2016-7076)

  - sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file,     which allows local users to open arbitrary files for read access (but not view file contents) by running a     program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log     messages, or repositioning tape drives. (CVE-2014-9680)

  - sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose     full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by /home/*/*/file.txt.
    (CVE-2015-5602)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sudo: Unauthorized privilege escalation in sudoedit (CVE-2015-5602)

  - sudo: by using ! character in the shadow file instead of a password hash can access to a run as all sudoer     account (CVE-2019-19234)

  - sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other     Linux implementations preserves the value of INPUTRC which could lead to information disclosure. A local     user with sudo access to a restricted program that uses readline could use this flaw to read content from     specially formatted files with elevated privileges provided by sudo. (CVE-2016-7091)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sudo: Unauthorized privilege escalation in sudoedit (CVE-2015-5602)

  - sudo: by using ! character in the shadow file instead of a password hash can access to a run as all sudoer     account (CVE-2019-19234)

  - The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write     permissions to parts of the called command to replace them before it is executed. (CVE-2015-8239)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-1804 advisory.

    - CVE-2019-18634     Resolves: rhbz#1798093
    - CVE-2019-19232     Resolves: rhbz#1786987     Resolves: rhbz#1796518
    - CVE-2019-14287 sudo

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has sudo packages installed that are affected by multiple vulnerabilities:

  - A certain Fedora patch for parse.c in sudo before 1.7.4p5-1.fc14 on Fedora 14 does not properly interpret     a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to     that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a     sudo command. NOTE: this vulnerability exists because of a CVE-2009-0034 regression. (CVE-2011-0008)

  - check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for     command execution that involves a gid change but no uid change, which allows local users to bypass an     intended authentication requirement via the -g option to a sudo command. (CVE-2011-0010)

  - Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to     execute arbitrary code via format string sequences in the program name for sudo. (CVE-2012-0809)

  - sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations     that use a netmask syntax, which allows local users to bypass intended command restrictions in     opportunistic circumstances by executing a command on a host that has an IPv4 address. (CVE-2012-2337)

  - sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate     attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting     the system clock and sudo user timestamp to the epoch. (CVE-2013-1775)

  - sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not     properly validate the controlling terminal device, which allows local users with sudo permissions to     hijack the authorization of another terminal via vectors related to connecting to the standard input,     output, and error file descriptors of another terminal. NOTE: this is one of three closely-related     vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different     affected versions. (CVE-2013-1776)

  - sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file,     which allows local users to open arbitrary files for read access (but not view file contents) by running a     program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log     messages, or repositioning tape drives. (CVE-2014-9680)

  - sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose     full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by /home/*/*/file.txt.
    (CVE-2015-5602)

  - sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run     via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to     run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary     commands with elevated privileges. (CVE-2016-7076)

  - Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in     the get_process_ttyname() function resulting in information disclosure and command execution.
    (CVE-2017-1000367)

  - ** DISPUTED ** In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can     impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user.
    NOTE: The software maintainer believes that this is not a vulnerability because running a command via sudo     as a user not present in the local password database is an intentional feature. Because this behavior     surprised some users, sudo 1.8.30 introduced an option to enable/disable this behavior with the default     being disabled. However, this does not change the fact that sudo was behaving as intended, and as     documented, in earlier versions. (CVE-2019-19232)

  - Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which     allows privilege escalation to root via sudoedit -s and a command-line argument that ends with a single     backslash character. (CVE-2021-3156)

  - A heap-based buffer overflow was found in the way sudo parses command line arguments. This flaw is     exploitable by any local user who can execute the sudo command without authentication. Successful     exploitation of this flaw could lead to privilege escalation.  (CVE-2021-3156)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:1804 advisory.

  - sudo: attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user     (CVE-2019-19232)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1804 advisory.

    The sudo packages contain the sudo utility which allows system administrators to provide certain users     with the permission to execute privileged commands, which are used for system management purposes, without     having to log in as root.

    The following packages have been upgraded to a later upstream version: sudo (1.8.29). (BZ#1733961)

    Security Fix(es):

    * sudo: attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user     (CVE-2019-19232)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the sudo package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In Sudo before 1.8.26, if pwfeedback is enabled in     /etc/sudoers, users can trigger a stack-based buffer     overflow in the privileged sudo process. (pwfeedback is     a default setting in Linux Mint and elementary OS     however, it is NOT the default for upstream and many     other packages, and would exist only if enabled by an     administrator.) The attacker needs to deliver a long     string to the stdin of getln() in     tgetpass.c.(CVE-2019-18634)

  - In Sudo through 1.8.29, an attacker with access to a     Runas ALL sudoer account can impersonate a nonexistent     user by invoking sudo with a numeric uid that is not     associated with any user.(CVE-2019-19232)

  - In Sudo through 1.8.29, the fact that a user has been     blocked (e.g., by using the ! character in the shadow     file instead of a password hash) is not considered,     allowing an attacker (who has access to a Runas ALL     sudoer account) to impersonate any blocked     user.(CVE-2019-19234)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the sudo package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - ** DISPUTED ** In Sudo through 1.8.29, the fact that a     user has been blocked (e.g., by using the ! character     in the shadow file instead of a password hash) is not     considered, allowing an attacker (who has access to a     Runas ALL sudoer account) to impersonate any blocked     user. NOTE: The software maintainer believes that this     CVE is not valid. Disabling local password     authentication for a user is not the same as disabling     all access to that user--the user may still be able to     login via other means (ssh key, kerberos, etc). Both     the Linux shadow(5) and passwd(1) manuals are clear on     this. Indeed it is a valid use case to have local     accounts that are _only_ accessible via sudo and that     cannot be logged into with a password. Sudo 1.8.30     added an optional setting to check the _shell_ of the     target user (not the encrypted password!) against the     contents of /etc/shells but that is not the same thing     as preventing access to users with an invalid password     hash.(CVE-2019-19234)

  - ** DISPUTED ** In Sudo through 1.8.29, an attacker with     access to a Runas ALL sudoer account can impersonate a     nonexistent user by invoking sudo with a numeric uid     that is not associated with any user. NOTE: The     software maintainer believes that this is not a     vulnerability because running a command via sudo as a     user not present in the local password database is an     intentional feature. Because this behavior surprised     some users, sudo 1.8.30 introduced an option to     enable/disable this behavior with the default being     disabled. However, this does not change the fact that     sudo was behaving as intended, and as documented, in     earlier versions.(CVE-2019-19232)

  - In Sudo before 1.8.26, if pwfeedback is enabled in     /etc/sudoers, users can trigger a stack-based buffer     overflow in the privileged sudo process. (pwfeedback is     a default setting in Linux Mint and elementary OS     however, it is NOT the default for upstream and many     other packages, and would exist only if enabled by an     administrator.) The attacker needs to deliver a long     string to the stdin of getln() in     tgetpass.c.(CVE-2019-18634)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - ** DISPUTED ** In Sudo through 1.8.29, an attacker with     access to a Runas ALL sudoer account can impersonate a     nonexistent user by invoking sudo with a numeric uid     that is not associated with any user. NOTE: The     software maintainer believes that this is not a     vulnerability because running a command via sudo as a     user not present in the local password database is an     intentional feature. Because this behavior surprised     some users, sudo 1.8.30 introduced an option to     enable/disable this behavior with the default being     disabled. However, this does not change the fact that     sudo was behaving as intended, and as documented, in     earlier versions.(CVE-2019-19232)

  - ** DISPUTED ** In Sudo through 1.8.29, the fact that a     user has been blocked (e.g., by using the ! character     in the shadow file instead of a password hash) is not     considered, allowing an attacker (who has access to a     Runas ALL sudoer account) to impersonate any blocked     user. NOTE: The software maintainer believes that this     CVE is not valid. Disabling local password     authentication for a user is not the same as disabling     all access to that user--the user may still be able to     login via other means (ssh key, kerberos, etc). Both     the Linux shadow(5) and passwd(1) manuals are clear on     this. Indeed it is a valid use case to have local     accounts that are _only_ accessible via sudo and that     cannot be logged into with a password. Sudo 1.8.30     added an optional setting to check the _shell_ of the     target user (not the encrypted password!) against the     contents of /etc/shells but that is not the same thing     as preventing access to users with an invalid password     hash.(CVE-2019-19234)

  - In Sudo before 1.8.26, if pwfeedback is enabled in     /etc/sudoers, users can trigger a stack-based buffer     overflow in the privileged sudo process. (pwfeedback is     a default setting in Linux Mint and elementary OS     however, it is NOT the default for upstream and many     other packages, and would exist only if enabled by an     administrator.) The attacker needs to deliver a long     string to the stdin of getln() in     tgetpass.c.(CVE-2019-18634)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the sudo package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In PHP before 5.6.28 and 7.x before 7.0.13, incorrect     handling of various URI components in the URL parser     could be used by attackers to bypass hostname-specific     URL checks, as demonstrated by     evil.example.com:80#@good.example.com/ and     evil.example.com:80?@good.example.com/ inputs to the     parse_url function (implemented in the php_url_parse_ex     function in ext/standard/url.c).(CVE-2019-19234)

  - In Sudo through 1.8.29, the fact that a user has been     blocked (e.g., by using the ! character in the shadow     file instead of a password hash) is not considered,     allowing an attacker (who has access to a Runas ALL     sudoer account) to impersonate any blocked     user.(CVE-2019-19232)

  - In Sudo before 1.8.26, if pwfeedback is enabled in     /etc/sudoers, users can trigger a stack-based buffer     overflow in the privileged sudo process. (pwfeedback is     a default setting in Linux Mint and elementary OS     however, it is NOT the default for upstream and many     other packages, and would exist only if enabled by an     administrator.) The attacker needs to deliver a long     string to the stdin of getln() in     tgetpass.c.(CVE-2019-18634)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Sudo through 1.8.29, an attacker with access to a     Runas ALL sudoer account can impersonate a nonexistent     user by invoking sudo with a numeric uid that is not     associated with any user. NOTE: The software maintainer     believes that this is not a vulnerability because     running a command via sudo as a user not present in the     local password database is an intentional feature.
    Because this behavior surprised some users, sudo 1.8.30     introduced an option to enable/disable this behavior     with the default being disabled. However, this does not     change the fact that sudo was behaving as intended, and     as documented, in earlier versions.(CVE-2019-19232)

  - In Sudo through 1.8.29, the fact that a user has been     blocked (e.g., by using the ! character in the shadow     file instead of a password hash) is not considered,     allowing an attacker (who has access to a Runas ALL     sudoer account) to impersonate any blocked user. NOTE:
    The software maintainer believes that this CVE is not     valid. Disabling local password authentication for a     user is not the same as disabling all access to that     user--the user may still be able to login via other     means (ssh key, kerberos, etc). Both the Linux     shadow(5) and passwd(1) manuals are clear on this.
    Indeed it is a valid use case to have local accounts     that are _only_ accessible via sudo and that cannot be     logged into with a password. Sudo 1.8.30 added an     optional setting to check the _shell_ of the target     user (not the encrypted password!) against the contents     of /etc/shells but that is not the same thing as     preventing access to users with an invalid password     hash.(CVE-2019-19234)

  - In Sudo before 1.8.26, if pwfeedback is enabled in     /etc/sudoers, users can trigger a stack-based buffer     overflow in the privileged sudo process. (pwfeedback is     a default setting in Linux Mint and elementary OS     however, it is NOT the default for upstream and many     other packages, and would exist only if enabled by an     administrator.) The attacker needs to deliver a long     string to the stdin of getln() in     tgetpass.c.(CVE-2019-18634)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the sudo package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - ** DISPUTED ** In Sudo through 1.8.29, the fact that a     user has been blocked (e.g., by using the ! character     in the shadow file instead of a password hash) is not     considered, allowing an attacker (who has access to a     Runas ALL sudoer account) to impersonate any blocked     user. NOTE: The software maintainer believes that this     CVE is not valid. Disabling local password     authentication for a user is not the same as disabling     all access to that user--the user may still be able to     login via other means (ssh key, kerberos, etc). Both     the Linux shadow(5) and passwd(1) manuals are clear on     this. Indeed it is a valid use case to have local     accounts that are _only_ accessible via sudo and that     cannot be logged into with a password. Sudo 1.8.30     added an optional setting to check the _shell_ of the     target user (not the encrypted password!) against the     contents of /etc/shells but that is not the same thing     as preventing access to users with an invalid password     hash.(CVE-2019-19234)

  - ** DISPUTED ** In Sudo through 1.8.29, an attacker with     access to a Runas ALL sudoer account can impersonate a     nonexistent user by invoking sudo with a numeric uid     that is not associated with any user. NOTE: The     software maintainer believes that this is not a     vulnerability because running a command via sudo as a     user not present in the local password database is an     intentional feature. Because this behavior surprised     some users, sudo 1.8.30 introduced an option to     enable/disable this behavior with the default being     disabled. However, this does not change the fact that     sudo was behaving as intended, and as documented, in     earlier versions.(CVE-2019-19232)

  - In Sudo before 1.8.26, if pwfeedback is enabled in     /etc/sudoers, users can trigger a stack-based buffer     overflow in the privileged sudo process. (pwfeedback is     a default setting in Linux Mint and elementary OS     however, it is NOT the default for upstream and many     other packages, and would exist only if enabled by an     administrator.) The attacker needs to deliver a long     string to the stdin of getln() in     tgetpass.c.(CVE-2019-18634)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of macOS / Mac OS X that is 10.13.x prior to 10.13.6 Security Update 2020-002, 10.14.x prior to 10.14.6 Security Update 2020-002, or 10.15.x prior to 10.15.4. It is, therefore, affected by multiple vulnerabilities :

  - Insufficient control flow in certain data structures for some Intel(R) Processors with Intel(R) Processor     Graphics may allow an unauthenticated user to potentially enable information disclosure via local access.
    (CVE-2019-14615)

  - ** DISPUTED ** In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can     impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user.
    NOTE: The software maintainer believes that this is not a vulnerability because running a command via sudo     as a user not present in the local password database is an intentional feature. Because this behavior     surprised some users, sudo 1.8.30 introduced an option to enable/disable this behavior with the default     being disabled. However, this does not change the fact that sudo was behaving as intended, and as     documented, in earlier versions. (CVE-2019-19232)

  - An out-of-bounds read error exists in Bluetooth due to improper input sanitization. An attacker can     exploit this to read restricted memory. (CVE-2019-8853)

  - Privilege escalation vulnerabilities exist in IOThunderboltFamily (due to a use-after-free flaw), and in     CUPS (due to a memory corruption issue). An attacker can exploit this to gain elevated access to the     system. (CVE-2020-3851, CVE-2020-3898)

  - An information disclosure vulnerability exists in FaceTime, Icons, and Call History. An unauthenticated,     local attacker can exploit this, via malicious applications, to disclose potentially sensitive     information. (CVE-2020-3881, CVE-2020-9773, CVE-2020-9776)

  - An information disclosure vulnerability exists in Sandbox. A local user can exploit this to view     sensitvie user information. (CVE-2020-3918)

  - An unspecified issue exists in AppleMobileFileIntegrity due to an unspecified reason. An attacker can     exploit this to use arbitrary entitlements. (CVE-2020-3883)

  - An arbitrary code execution vulnerability exists in Mail due to improper input validation. An     unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary     JavaScript code. (CVE-2020-3884)

  - An arbitrary file read vulnerability exists in Time Machine due to improper state management. An     unauthenticated, local attacker can exploit this to read arbitrary files and disclose sensitive     information. (CVE-2020-3889)

  - An arbitrary code execution vulnerability exists in AppleGraphicsControl, Bluetooth, IOHIDFamily, and the     kernel due to memory initialization and corruption issues. An attacker can exploit this to bypass     authentication and execute arbitrary commands with kernel privileges. (CVE-2020-3892, CVE-2020-3893,     CVE-2020-3904, CVE-2020-3905, CVE-2020-3919, CVE-2020-9785)

  - An arbitrary code execution vulnerability exists in Apple HSSPI Support due to a memory corruption issue.
    An attacker can exploit this to bypass authentication and execute arbitrary commands with system     privileges. (CVE-2020-3903)

  - A logic issue exists in TCC due to an unspecified reason. An attacker can exploit this, via a maliciously     crafted application, to cause bypass code signing. (CVE-2020-3906)

  - An out-of-bounds read error exists in Bluetooth due to improper input validation. An unauthenticated local     attacker can exploit this to cause a denial of service or read kernel memory. (CVE-2020-3907,     CVE-2020-3908, CVE-2020-3912)

  - A buffer overflow condition exists in libxml2 due to improper bounds checking and size validation. An     attacker can exploit this to cause a denial of service condition or the execution of arbitrary code.
    (CVE-2020-3909, CVE-2020-3910, CVE-2020-3911)

  - A privilege escalation vulnerability exists in due to improper permission validation. An unauthenticated,     remote attacker can exploit this, to gain elevated access to the system. (CVE-2020-3913)

  - An information disclosure vulnerability exists in the kernel due to improper memory handling. An attacker     can exploit this to read restricted memory. (CVE-2020-3914)

  - An arbitrary file overwrite vulnerability exists in Printing due improper path handlng. An attacker can     exploit this to overwrite arbitrary files. (CVE-2020-3915)

  - Multiple unspecified issues exist in the Vim installation on macOS. An attacker can exploit this to cause     an unknown impact. (CVE-2020-9769)

  - An unspecified vulnerability exists in sysdiagnose due to insufficient validation of user supplied input.     An attacker could exploit this issue with partial impact on the confidentiality, integrity & availability     of the application and/or system. (CVE-2020-9786)

  - An vulnerability exists in WebKit due to a logic flaw in restrictions. An attacker may exploit this flaw,     as part of a more elaborate attack, to gain unauthorized access to the MacOS camera. (CVE-2020-9787)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

- update to latest development version 1.9.0b1

  - added sudo_logsrvd and sudo_sendlog to files and their     appropriate man pages Resolves: rhbz#1787823

  - Stack based buffer overflow in when pwfeedback is     enabled Resolves: rhbz#1796945

  - fixes: CVE-2019-18634 

  - By using ! character in the shadow file instead of a     password hash can access to a run as all sudoer account     Resolves: rhbz#1786709

  - fixes CVE-2019-19234

  - attacker with access to a Runas ALL sudoer account can     impersonate a nonexistent user Resolves: rhbz#1786705

  - fixes CVE-2019-19232

  - setrlimit(RLIMIT_CORE): Operation not permitted warning     message fix Resolves: rhbz#1773148

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Sudo before 1.8.26, if pwfeedback is enabled in     /etc/sudoers, users can trigger a stack-based buffer     overflow in the privileged sudo process. (pwfeedback is     a default setting in Linux Mint and elementary OS     however, it is NOT the default for upstream and many     other packages, and would exist only if enabled by an     administrator.) The attacker needs to deliver a long     string to the stdin of getln() in     tgetpass.c.(CVE-2019-18634)

  - ** DISPUTED ** In Sudo through 1.8.29, an attacker with     access to a Runas ALL sudoer account can impersonate a     nonexistent user by invoking sudo with a numeric uid     that is not associated with any user. NOTE: The     software maintainer believes that this is not a     vulnerability because running a command via sudo as a     user not present in the local password database is an     intentional feature. Because this behavior surprised     some users, sudo 1.8.30 introduced an option to     enable/disable this behavior with the default being     disabled. However, this does not change the fact that     sudo was behaving as intended, and as documented, in     earlier versions.(CVE-2019-19232)

  - ** DISPUTED ** In Sudo through 1.8.29, the fact that a     user has been blocked (e.g., by using the ! character     in the shadow file instead of a password hash) is not     considered, allowing an attacker (who has access to a     Runas ALL sudoer account) to impersonate any blocked     user. NOTE: The software maintainer believes that this     CVE is not valid. Disabling local password     authentication for a user is not the same as disabling     all access to that user--the user may still be able to     login via other means (ssh key, kerberos, etc). Both     the Linux shadow(5) and passwd(1) manuals are clear on     this. Indeed it is a valid use case to have local     accounts that are _only_ accessible via sudo and that     cannot be logged into with a password. Sudo 1.8.30     added an optional setting to check the _shell_ of the     target user (not the encrypted password!) against the     contents of /etc/shells but that is not the same thing     as preventing access to users with an invalid password     hash.(CVE-2019-19234)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
203040	Photon OS 3.0: Sudo PHSA-2020-3.0-0051	Nessus	PhotonOS Local Security Checks	high
198848	RHEL 5 : sudo (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198797	RHEL 6 : sudo (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198754	RHEL 7 : sudo (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
181000	Oracle Linux 8 : sudo (ELSA-2020-1804)	Nessus	Oracle Linux Local Security Checks	high
154540	NewStart CGSL MAIN 6.02 : sudo Multiple Vulnerabilities (NS-SA-2021-0120)	Nessus	NewStart CGSL Local Security Checks	high
145885	CentOS 8 : sudo (CESA-2020:1804)	Nessus	CentOS Local Security Checks	high
143004	RHEL 8 : sudo (RHSA-2020:1804)	Nessus	Red Hat Local Security Checks	high
141722	EulerOS Virtualization 3.0.2.2 : sudo (EulerOS-SA-2020-2196)	Nessus	Huawei Local Security Checks	high
138004	EulerOS Virtualization 3.0.6.0 : sudo (EulerOS-SA-2020-1785)	Nessus	Huawei Local Security Checks	high
137504	EulerOS 2.0 SP2 : sudo (EulerOS-SA-2020-1662)	Nessus	Huawei Local Security Checks	high
136267	EulerOS Virtualization for ARM 64 3.0.2.0 : sudo (EulerOS-SA-2020-1564)	Nessus	Huawei Local Security Checks	high
135564	EulerOS 2.0 SP3 : sudo (EulerOS-SA-2020-1435)	Nessus	Huawei Local Security Checks	high
135136	EulerOS Virtualization for ARM 64 3.0.6.0 : sudo (EulerOS-SA-2020-1349)	Nessus	Huawei Local Security Checks	high
134954	macOS 10.15.x < 10.15.4 / 10.14.x < 10.14.6 Security Update 2020-002 / 10.13.x < 10.13.6 Security Update 2020-002	Nessus	MacOS X Local Security Checks	critical
134253	Fedora 31 : sudo (2020-8b563bc5f4)	Nessus	Fedora Local Security Checks	high
134015	EulerOS 2.0 SP8 : sudo (EulerOS-SA-2020-1181)	Nessus	Huawei Local Security Checks	high
133936	EulerOS 2.0 SP5 : sudo (EulerOS-SA-2020-1135)	Nessus	Huawei Local Security Checks	high
132985	Photon OS 1.0: Sudo PHSA-2020-1.0-0264	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2019-19232

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

high

high

high

high