Home

CVE-2019-18634

Description

In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.

Risk Information

Base Score
7.8
MODERATE
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
88.561

Associated Vulnerability

VulnerabilityOS Platform
Multiple vulnerabilities are fixed in MacOS Catalina 10.15.3Mac
Multiple vulnerabilities are fixed in MacOS Catalina 10.15.3 Combo UpdateMac
sudo security update(DSA-4614-1) sudo_1.8.19p1-2.1+deb9u2_i386.debLinux
sudo security update(DSA-4614-1) sudo_1.8.19p1-2.1+deb9u2_amd64.debLinux
Provide limited super user privileges to specific users (USN-4263-1) sudo_1.8.16-0ubuntu1.9_i386.debLinux
Provide limited super user privileges to specific users (USN-4263-1) sudo_1.8.16-0ubuntu1.9_amd64.debLinux
Provide limited super user privileges to specific users (USN-4263-1) sudo_1.8.27-1ubuntu4.1_i386.debLinux
Provide limited super user privileges to specific users (USN-4263-1) sudo_1.8.27-1ubuntu4.1_amd64.debLinux
Provide limited super user privileges to specific users (USN-4263-1) sudo_1.8.21p2-3ubuntu1.2_i386.debLinux
Provide limited super user privileges to specific users (USN-4263-1) sudo_1.8.21p2-3ubuntu1.2_amd64.debLinux
Provide limited super user privileges to specific users (USN-4263-1) sudo-ldap_1.8.16-0ubuntu1.9_i386.debLinux
Provide limited super user privileges to specific users (USN-4263-1) sudo-ldap_1.8.16-0ubuntu1.9_amd64.debLinux
Provide limited super user privileges to specific users (USN-4263-1) sudo-ldap_1.8.27-1ubuntu4.1_i386.debLinux
Provide limited super user privileges to specific users (USN-4263-1) sudo-ldap_1.8.27-1ubuntu4.1_amd64.debLinux
Provide limited super user privileges to specific users (USN-4263-1) sudo-ldap_1.8.21p2-3ubuntu1.2_i386.debLinux
Provide limited super user privileges to specific users (USN-4263-1) sudo-ldap_1.8.21p2-3ubuntu1.2_amd64.debLinux
(RHSA-2020:0540) sudo security update sudo-1.8.23-4.el7_7.2.x86_64.rpmLinux
(RHSA-2020:0540) sudo security update sudo-devel-1.8.23-4.el7_7.2.i686.rpmLinux
(RHSA-2020:0540) sudo security update sudo-devel-1.8.23-4.el7_7.2.x86_64.rpmLinux
SUSE-SU-2020:0406-1(SUSE Linux Enterprise Desktop 12-SP4 ) sudo-1.8.20p2-3.17.1.x86_64.rpmLinux
SUSE-SU-2020:0406-1(SUSE Linux Enterprise Desktop 12-SP4 ) sudo-debuginfo-1.8.20p2-3.17.1.x86_64.rpmLinux
SUSE-SU-2020:0406-1(SUSE Linux Enterprise Desktop 12-SP4 ) sudo-debugsource-1.8.20p2-3.17.1.x86_64.rpmLinux
(RHSA-2020:0726) sudo security update sudo-1.8.6p3-29.el6_10.3.i686.rpmLinux
(RHSA-2020:0726) sudo security update sudo-1.8.6p3-29.el6_10.3.x86_64.rpmLinux
(RHSA-2020:0726) sudo security update sudo-devel-1.8.6p3-29.el6_10.3.i686.rpmLinux
(RHSA-2020:0726) sudo security update sudo-devel-1.8.6p3-29.el6_10.3.x86_64.rpmLinux
(RHSA-2020:0540) sudo security update sudo-1.8.23-4.el7_7.2.x86_64.rpmLinux
(RHSA-2020:0540) sudo security update sudo-devel-1.8.23-4.el7_7.2.i686.rpmLinux
(RHSA-2020:0540) sudo security update sudo-devel-1.8.23-4.el7_7.2.x86_64.rpmLinux
Sudo update (ELSA-2020-0726) sudo-1.8.6p3-29.0.1.el6_10.3.x86_64.rpmLinux
Sudo-devel update (ELSA-2020-0726) sudo-devel-1.8.6p3-29.0.1.el6_10.3.x86_64.rpmLinux
Sudo update (ELSA-2020-0726) sudo-1.8.6p3-29.0.1.el6_10.3.i686.rpmLinux
Sudo-devel update (ELSA-2020-0726) sudo-devel-1.8.6p3-29.0.1.el6_10.3.i686.rpmLinux
(CESA-2020:0726) sudo security update sudo-1.8.6p3-29.el6_10.3.i686.rpmLinux
(CESA-2020:0726) sudo security update sudo-1.8.6p3-29.el6_10.3.x86_64.rpmLinux
(CESA-2020:0726) sudo security update sudo-devel-1.8.6p3-29.el6_10.3.i686.rpmLinux
(CESA-2020:0726) sudo security update sudo-devel-1.8.6p3-29.el6_10.3.x86_64.rpmLinux
Out-of-bounds Write Vulnerability (CVE-2019-18634)NCM

Patch Details

Click to see the patches provided by ManageEngine for this CVE
Patch IDPatch Description
PATCH-602673MacOS Catalina 10.15.7 - Auto Reboot
PATCH-602674macOS Catalina 10.15.7 Combo Update - Auto Reboot

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234