Unrated
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfe...
CVE-2019-18634
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2019-18634 sudo Fixed in: 1.8.31-1
Original description The description as published by the source.
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.
References
- advisory packetstormsecurity.com
- advisory packetstormsecurity.com
- advisory seclists.org
- advisory openwall.com
- advisory openwall.com
- advisory openwall.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory lists.debian.org
- advisory seclists.org
- advisory seclists.org
- advisory seclists.org
- advisory security.gentoo.org
- advisory security.netapp.com
- advisory support.apple.com
- advisory debian.org
- advisory sudo.ws
- report openwall.com
- report sudo.ws
- web lists.opensuse.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web usn.ubuntu.com
- web usn.ubuntu.com