CVE-2019-14287 Privilege escalation in n/a

High 8.8 Published 17 Oct 2019 Updated 5 Aug 2024

Attackers with Runas ALL access can bypass sudo policy restrictions and PAM modules by using a crafted user ID, leading to privilege escalation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-14287?

CVE-2019-14287 is a high-severity vulnerability in Canonical Ubuntu Linux, published on 17 Oct 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.

Weakness: CWE-755

Which versions are affected by CVE-2019-14287?

It affects 15 products.

Linux distribution packages (40)

`sudo` Red Hat:enterprise_linux:6::client	All versions	`0:1.8.6p3-29.el6_10.2`
`sudo-debuginfo` Red Hat:enterprise_linux:6::client	All versions	`0:1.8.6p3-29.el6_10.2`
`sudo-devel` Red Hat:enterprise_linux:6::client	All versions	`0:1.8.6p3-29.el6_10.2`
`sudo` Red Hat:enterprise_linux:6::computenode	All versions	`0:1.8.6p3-29.el6_10.2`
`sudo-debuginfo` Red Hat:enterprise_linux:6::computenode	All versions	`0:1.8.6p3-29.el6_10.2`
`sudo-devel` Red Hat:enterprise_linux:6::computenode	All versions	`0:1.8.6p3-29.el6_10.2`
`sudo` Red Hat:enterprise_linux:6::server	All versions	`0:1.8.6p3-29.el6_10.2`
`sudo-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`0:1.8.6p3-29.el6_10.2`
`sudo-devel` Red Hat:enterprise_linux:6::server	All versions	`0:1.8.6p3-29.el6_10.2`
`sudo` Red Hat:enterprise_linux:6::workstation	All versions	`0:1.8.6p3-29.el6_10.2`
`sudo-debuginfo` Red Hat:enterprise_linux:6::workstation	All versions	`0:1.8.6p3-29.el6_10.2`
`sudo-devel` Red Hat:enterprise_linux:6::workstation	All versions	`0:1.8.6p3-29.el6_10.2`
`sudo` Red Hat:enterprise_linux:7::client	All versions	`0:1.8.23-4.el7_7.1`
`sudo-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:1.8.23-4.el7_7.1`
`sudo-devel` Red Hat:enterprise_linux:7::client	All versions	`0:1.8.23-4.el7_7.1`
`sudo` Red Hat:enterprise_linux:7::computenode	All versions	`0:1.8.23-4.el7_7.1`
`sudo-debuginfo` Red Hat:enterprise_linux:7::computenode	All versions	`0:1.8.23-4.el7_7.1`
`sudo-devel` Red Hat:enterprise_linux:7::computenode	All versions	`0:1.8.23-4.el7_7.1`
`sudo` Red Hat:enterprise_linux:7::server	All versions	`0:1.8.23-4.el7_7.1`
`sudo-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:1.8.23-4.el7_7.1`
`sudo-devel` Red Hat:enterprise_linux:7::server	All versions	`0:1.8.23-4.el7_7.1`
`sudo` Red Hat:enterprise_linux:7::workstation	All versions	`0:1.8.23-4.el7_7.1`
`sudo-debuginfo` Red Hat:enterprise_linux:7::workstation	All versions	`0:1.8.23-4.el7_7.1`
`sudo-devel` Red Hat:enterprise_linux:7::workstation	All versions	`0:1.8.23-4.el7_7.1`
`sudo` Red Hat:enterprise_linux:8::baseos	All versions	`0:1.8.25p1-8.el8_1`
`sudo-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:1.8.25p1-8.el8_1`
`sudo-debugsource` Red Hat:enterprise_linux:8::baseos	All versions	`0:1.8.25p1-8.el8_1`
`sudo` Red Hat:rhel_aus:6.5::server	All versions	`0:1.8.6p3-12.el6_5.2`
`sudo-debuginfo` Red Hat:rhel_aus:6.5::server	All versions	`0:1.8.6p3-12.el6_5.2`
`sudo-devel` Red Hat:rhel_aus:6.5::server	All versions	`0:1.8.6p3-12.el6_5.2`
`sudo` Red Hat:rhel_aus:6.6::server	All versions	`0:1.8.6p3-15.el6_6.2`
`sudo-debuginfo` Red Hat:rhel_aus:6.6::server	All versions	`0:1.8.6p3-15.el6_6.2`
`sudo-devel` Red Hat:rhel_aus:6.6::server	All versions	`0:1.8.6p3-15.el6_6.2`
`sudo` Red Hat:rhel_aus:7.2::server	All versions	`0:1.8.6p7-17.el7_2.2`
`sudo-debuginfo` Red Hat:rhel_aus:7.2::server	All versions	`0:1.8.6p7-17.el7_2.2`
`sudo-devel` Red Hat:rhel_aus:7.2::server	All versions	`0:1.8.6p7-17.el7_2.2`
`sudo` Red Hat:rhel_aus:7.3::server	All versions	`0:1.8.6p7-23.el7_3.2`
`sudo-debuginfo` Red Hat:rhel_aus:7.3::server	All versions	`0:1.8.6p7-23.el7_3.2`
`sudo-devel` Red Hat:rhel_aus:7.3::server	All versions	`0:1.8.6p7-23.el7_3.2`
`sudo` Red Hat:rhel_aus:7.4::server	All versions	`0:1.8.19p2-12.el7_4.1`

Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Netapp Element Software Management Node, Opensuse Leap, Redhat Enterprise Linux and 9 more.

How do I fix CVE-2019-14287?

Upgrade to a fixed version.

Is CVE-2019-14287 being exploited?

There is no known exploitation of CVE-2019-14287 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry and 27 proofs of concept on GitHub.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2019-14287, DEBIAN-CVE-2019-14287, DLA-1964-1, DSA-4543-1, GHSA-33h3-qhjg-4qmf, MGASA-2019-0298 and 21 more.