CVE-2019-19191 Privilege escalation in n/a

High 7.8 Published 21 Nov 2019 Updated 5 Aug 2024

A local attacker with shibd account access can escalate to root by exploiting insecure file ownership changes during installation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2019-19191?

CVE-2019-19191 is a high-severity vulnerability in n/a, published on 21 Nov 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow.

Weakness: CWE-59

Which versions are affected by CVE-2019-19191?

It affects 1 product.

Linux distribution packages (22)

`shibboleth-sp` SUSE:Enterprise Storage 5	All versions	`2.5.5-6.6.1`
`shibboleth-sp` SUSE:HPE Helion OpenStack 8	All versions	`2.5.5-6.6.1`
`shibboleth-sp` SUSE:Linux Enterprise Module for Server Applications 15	All versions	`2.6.1-3.3.1`
`shibboleth-sp` SUSE:Linux Enterprise Module for Server Applications 15 SP1	All versions	`2.6.1-3.3.1`
`shibboleth-sp` SUSE:Linux Enterprise Server 12 SP1-LTSS	All versions	`2.5.5-6.6.1`
`shibboleth-sp` SUSE:Linux Enterprise Server 12 SP2-BCL	All versions	`2.5.5-6.6.1`
`shibboleth-sp` SUSE:Linux Enterprise Server 12 SP2-LTSS	All versions	`2.5.5-6.6.1`
`shibboleth-sp` SUSE:Linux Enterprise Server 12 SP3-BCL	All versions	`2.5.5-6.6.1`
`shibboleth-sp` SUSE:Linux Enterprise Server 12 SP3-LTSS	All versions	`2.5.5-6.6.1`
`shibboleth-sp` SUSE:Linux Enterprise Server 12 SP4	All versions	`2.5.5-6.6.1`
`shibboleth-sp` SUSE:Linux Enterprise Server 12 SP5	All versions	`2.5.5-6.6.1`
`shibboleth-sp` SUSE:Linux Enterprise Server for SAP Applications 12 SP1	All versions	`2.5.5-6.6.1`
`shibboleth-sp` SUSE:Linux Enterprise Server for SAP Applications 12 SP2	All versions	`2.5.5-6.6.1`
`shibboleth-sp` SUSE:Linux Enterprise Server for SAP Applications 12 SP3	All versions	`2.5.5-6.6.1`
`shibboleth-sp` SUSE:Linux Enterprise Server for SAP Applications 12 SP4	All versions	`2.5.5-6.6.1`
`shibboleth-sp` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`2.5.5-6.6.1`
`shibboleth-sp` SUSE:Linux Enterprise Software Development Kit 12 SP4	All versions	`2.5.5-6.6.1`
`shibboleth-sp` SUSE:Linux Enterprise Software Development Kit 12 SP5	All versions	`2.5.5-6.6.1`
`shibboleth-sp` SUSE:OpenStack Cloud 7	All versions	`2.5.5-6.6.1`
`shibboleth-sp` SUSE:OpenStack Cloud 8	All versions	`2.5.5-6.6.1`
`shibboleth-sp` SUSE:OpenStack Cloud Crowbar 8	All versions	`2.5.5-6.6.1`
`shibboleth-sp` openSUSE:Leap 15.1	All versions	`2.6.1-lp151.3.3.1`

Products include Shibboleth Service Provider.

How do I fix CVE-2019-19191?

Upgrade to a fixed version.

Is CVE-2019-19191 being exploited?

There is no known exploitation of CVE-2019-19191 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2019-19191, GHSA-gcm7-32c7-5wrq, SUSE-SU-2019:3386-1, SUSE-SU-2020:0115-1, openSUSE-SU-2020:0020-1.