RSS   Vulnerabilities for 'SUDO'   RSS

2019-12-19
 
CVE-2019-19234

NVD-CWE-noinfo
 

 
In Sudo through 1.8.29, the fact that a user has been blocked (e.g., by using the ! character in the shadow file instead of a password hash) is not considered, allowing an attacker (who has access to a Runas ALL sudoer account) to impersonate any blocked user.

 
 
CVE-2019-19232

NVD-CWE-noinfo
 

 
In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user.

 


Copyright 2024, cxsecurity.com

 

Back to Top