[ASA-201910-9] sudo: privilege escalation

Arch Linux Security Advisory ASA-201910-9 ========================================= Severity: High Date : 2019-10-16 CVE-ID : CVE-2019-14287 Package : sudo Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1047 Summary ======= The package sudo before version 1.8.28...

sudo 1.8.27 - Security Bypass

Exploit Title : sudo 1.8.27 - Security Bypass Date : 2019-10-15 Original Author: Joe Vennix Exploit Author : Mohin Paramasivam Shad0wQu35t Version : Sudo priv" os.system"cat priv | grep 'ALL' | cut -d '' -f 2 binary" binaryfile = open"binary" binary= binaryfile.read e...

sudo 1.8.28 - Security Bypass Exploit

Exploit Title : sudo 1.8.28 - Security Bypass Original Author: Joe Vennix Exploit Author : Mohin Paramasivam Version : Sudo priv" os.system"cat priv | grep 'ALL' | cut -d '' -f 2 binary" binaryfile = open"binary" binary= binaryfile.read execute sudo exp...

CVE-2019-11526

An issue was discovered in Softing uaGate SI 1.60.01. A maintenance script, that is executable via sudo, is vulnerable to file path injection. This enables the Attacker to write files with superuser privileges in specific locations...

Malicious Package

Overview All versions of eact typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the...

Malicious Package

Overview All versions of momen typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the...

Malicious Package

Overview All versions of asnyc typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the...

sudo: Privilege escalation

Background sudo su “do” allows a system administrator to delegate authority to give certain users or groups of users the ability to run some or all commands as root or another user while providing an audit trail of the commands and their arguments. Description The fix present in...

BSA-2017-349

Security Advisory ID : BSA-2017-349 Component : SUDO Revision : 2.0: Interim A flaw was found in the waysudoparsedttyinformation from the process status file in the proc filesystem. A local user with privileges to execute commands viasudocould use this flaw to escalate their privileges to root...

sudo security update

CentOS Errata and Security Advisory CESA-2017:1382 An update for sudo is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, whi...

Solarwinds LEM 6.3.1 Sudo Privilege Escalation Vulnerability

Due to lax filesystem permissions, an attacker can take control of a hardcoded sudo path in order to execute commands as a privileged user on Solarwinds Log and Event Manager Virtual Appliance version 6.3.1. Solarwinds LEM Privilege Escalation via Controlled Sudo Path Title: Solarwinds LEM...

VMware ESX Multiple Vulnerabilities (VMSA-2009-0009) (remote check)

The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in sudo in file parse.c due to a failure to properly interpret a system group %group in the sudoers configuration file when handling authorization decisions for...

sudo privilege escalation

Elevated file access is possible...

RedStar 3.0 Desktop - Enable sudo Privilege Escalation

!/bin/bash -e Alternative steps: https://pbs.twimg.com/media/B68inqBIQAA5sK6.png Proof: https://github.com/HackerFantastic/Public/blob/master/exploits/redstar3.0-localroot.png cp /etc/udev/rules.d/85-hplj10xx.rules /tmp/udevhp.bak echo 'RUN+="/bin/bash /tmp/r00t.sh"'...

RedStar 3.0 Desktop - Enable sudo Privilege Escalation

RedStar 3.0 Desktop - Enable sudo Privilege Escalation !/bin/bash -e Alternative steps: https://pbs.twimg.com/media/B68inqBIQAA5sK6.png Proof: https://github.com/HackerFantastic/Public/blob/master/exploits/redstar3.0-localroot.png cp /etc/udev/rules.d/85-hplj10xx.rules /tmp/udevhp.bak echo...

Fonality Trixbox CE 2.8.0.4 Command Execution Vulnerability

Fonality Trixbox CE version 2.8.0.4 remote root command execution exploit. !/usr/bin/perl Title: Fonality trixbox CE remote root exploit Author: Simo Ben youssef Contact: SimoatMorxploitcom Discovered & Coded: 2 June 2014 Published: 17 October 2014 MorXploit Research http://www.MorXploit.com...

Pandora FMS Remote Code Execution

This module exploits a vulnerability found in Pandora FMS 5.0RC1 and lower. It will leverage an unauthenticated command injection in the Anyterm service on port 8023/TCP. Commands are executed as the user "pandora". In Pandora FMS 4.1 and 5.0RC1 the user "artica" is not assigned a password by...

CVE-2013-1052

pam-xdg-support, as used in Ubuntu 12.10, does not properly handle the PATH environment variable, which allows local users to gain privileges via unspecified vectors related to sudo...

Design/Logic Flaw

Sudo 1.7.0 through 1.7.4p3, when a Runas group is configured, does not properly handle use of the -u option in conjunction with the -g option, which allows local users to gain privileges via a command line containing a "-u root" sequence...

RedHat Update for sudo RHSA-2010:0675-01

Check for the Version of sudo OpenVAS Vulnerability Test RedHat Update for sudo RHSA-2010:0675-01 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms o...