182 matches found
sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword
A flaw was found in the way sudo implemented running commands with arbitrary user ID. If a sudoers entry is written to allow the attacker to run a command as any user except root, this flaw can be used by the attacker to bypass that restriction...
sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword
A flaw was found in the way sudo implemented running commands with arbitrary user ID. If a sudoers entry is written to allow the attacker to run a command as any user except root, this flaw can be used by the attacker to bypass that restriction...
sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword
A flaw was found in the way sudo implemented running commands with arbitrary user ID. If a sudoers entry is written to allow the attacker to run a command as any user except root, this flaw can be used by the attacker to bypass that restriction...
sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword
A flaw was found in the way sudo implemented running commands with arbitrary user ID. If a sudoers entry is written to allow the attacker to run a command as any user except root, this flaw can be used by the attacker to bypass that restriction...
sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword
A flaw was found in the way sudo implemented running commands with arbitrary user ID. If a sudoers entry is written to allow the attacker to run a command as any user except root, this flaw can be used by the attacker to bypass that restriction...
RHEL 7 : sudo (RHSA-2019:3278)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3278 advisory. The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged...
sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword
A flaw was found in the way sudo implemented running commands with arbitrary user ID. If a sudoers entry is written to allow the attacker to run a command as any user except root, this flaw can be used by the attacker to bypass that restriction...
sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword
A flaw was found in the way sudo implemented running commands with arbitrary user ID. If a sudoers entry is written to allow the attacker to run a command as any user except root, this flaw can be used by the attacker to bypass that restriction...
RHEL 7 : sudo (RHSA-2019:3219)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3219 advisory. The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged...
sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword
A flaw was found in the way sudo implemented running commands with arbitrary user ID. If a sudoers entry is written to allow the attacker to run a command as any user except root, this flaw can be used by the attacker to bypass that restriction...
sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword
A flaw was found in the way sudo implemented running commands with arbitrary user ID. If a sudoers entry is written to allow the attacker to run a command as any user except root, this flaw can be used by the attacker to bypass that restriction...
FreeBSD : sudo -- Potential bypass of Runas user restrictions (3a1474ba-f646-11e9-b0af-b888e347c638)
Todd C. Miller reports : When sudo is configured to allow a user to run commands as an arbitrary user via the ALL keyword in a Runas specification, it is possible to run commands as root by specifying the user ID -1 or 4294967295. This can be used by a user with sufficient sudo privileges to run...
Scientific Linux Security Update : sudo on SL7.x x86_64 (20191024)
Security Fixes : - sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword CVE-2019-14287 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include"compat.inc"; if description scriptid130252; scriptversion"1.6";...
sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword
A flaw was found in the way sudo implemented running commands with arbitrary user ID. If a sudoers entry is written to allow the attacker to run a command as any user except root, this flaw can be used by the attacker to bypass that restriction...
sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword
A flaw was found in the way sudo implemented running commands with arbitrary user ID. If a sudoers entry is written to allow the attacker to run a command as any user except root, this flaw can be used by the attacker to bypass that restriction...
Important: Red Hat Security Advisory: sudo security update
An update for sudo is now available for Red Hat Enterprise Linux 7.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...
sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword
A flaw was found in the way sudo implemented running commands with arbitrary user ID. If a sudoers entry is written to allow the attacker to run a command as any user except root, this flaw can be used by the attacker to bypass that restriction...
Exploit for Improper Handling of Exceptional Conditions in Sudo_Project Sudo
Sudo-Security-Bypass-CVE-2019-14287 ==========================...
CVE-2019-14287
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "su...
