CVE-2019-20044
published 2020-02-24CVE-2019-20044: In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the…
PriorityP341high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.50%
39.2th percentile
In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid().
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ipados | < 13.5 | 13.5 |
| apple | iphone_os | < 13.5 | 13.5 |
| apple | mac_os_x | < 10.15.5 | 10.15.5 |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | >= 10.13.0 < 10.13.6 | 10.13.6 |
| apple | mac_os_x | >= 10.14.0 < 10.14.6 | 10.14.6 |
| apple | mac_os_x | >= 10.15 < 10.15.5 | 10.15.5 |
| apple | tvos | < 13.4.5 | 13.4.5 |
| apple | watchos | < 6.2.5 | 6.2.5 |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | zsh | < zsh 5.8-1 (bookworm) | zsh 5.8-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| zsh | zsh | < 5.8 | 5.8 |
| zsh | zsh | >= 0 < 5.8-1 | 5.8-1 |
| zsh | zsh | >= 0 < 5.8-1 | 5.8-1 |
| zsh | zsh | >= 0 < 5.8-1 | 5.8-1 |
| zsh | zsh | >= 0 < 5.8-1 | 5.8-1 |
| zsh | zsh | >= 0 < 5.4.2-3ubuntu3.2 | 5.4.2-3ubuntu3.2 |
| zsh | zsh | >= 0 < 5.8-3ubuntu1.1 | 5.8-3ubuntu1.1 |
| zsh | zsh | >= 0 < 5.1.1-1ubuntu2.3+esm1 | 5.1.1-1ubuntu2.3+esm1 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-gwf9-995r-26hx: In Zsh before 5
ghsa_unreviewed·2022-05-24
CVE-2019-20044 [HIGH] CWE-273 GHSA-gwf9-995r-26hx: In Zsh before 5
In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid().
OSV
zsh vulnerabilities
osv·2022-03-14·CVSS 7.8
CVE-2019-20044 [HIGH] zsh vulnerabilities
zsh vulnerabilities
Sam Foxman discovered that Zsh incorrectly handled certain inputs.
An attacker could possibly use this issue to regain dropped privileges.
(CVE-2019-20044)
It was discovered that Zsh incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2021-45444)
OSV
CVE-2019-20044: In Zsh before 5
osv·2020-02-24·CVSS 7.8
CVE-2019-20044 [HIGH] CVE-2019-20044: In Zsh before 5
In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid().
Ubuntu
Zsh vulnerabilities
vendor_ubuntu·2022-03-14·CVSS 7.8
CVE-2021-45444 [HIGH] Zsh vulnerabilities
Title: Zsh vulnerabilities
Summary: Several security issues were fixed in Zsh.
Sam Foxman discovered that Zsh incorrectly handled certain inputs.
An attacker could possibly use this issue to regain dropped privileges.
(CVE-2019-20044)
It was discovered that Zsh incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2021-45444)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
zsh: insecure dropping of privileges when unsetting PRIVILEGED option
vendor_redhat·2020-02-16·CVSS 7.8
CVE-2019-20044 [HIGH] CWE-271 zsh: insecure dropping of privileges when unsetting PRIVILEGED option
zsh: insecure dropping of privileges when unsetting PRIVILEGED option
In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid().
A flaw was found in zsh. When unsetting the PRIVILEGED option, the shell sets its effective user and group IDs to match their respective real IDs. When the RUID and EUID were both non-zero, it is possible to regain the shell's former privileges. Also, the setopt built-in did not correctly report errors when unsetting the option, which prevented users from handling them as the documentation recommended. The highest threat from this vulnerabili
Debian
CVE-2019-20044: zsh - In Zsh before 5.8, attackers able to execute commands can regain privileges drop...
vendor_debian·2019·CVSS 7.8
CVE-2019-20044 [HIGH] CVE-2019-20044: zsh - In Zsh before 5.8, attackers able to execute commands can regain privileges drop...
In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid().
Scope: local
bookworm: resolved (fixed in 5.8-1)
bullseye: resolved (fixed in 5.8-1)
forky: resolved (fixed in 5.8-1)
sid: resolved (fixed in 5.8-1)
trixie: resolved (fixed in 5.8-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-20044 zsh: insecure dropping of privileges when unsetting PRIVILEGED option
bugzilla·2020-02-19·CVSS 7.8
CVE-2019-20044 [HIGH] CVE-2019-20044 zsh: insecure dropping of privileges when unsetting PRIVILEGED option
CVE-2019-20044 zsh: insecure dropping of privileges when unsetting PRIVILEGED option
When unsetting the PRIVILEGED option, the shell sets its effective user and group IDs to match their respective real IDs. On some platforms (including Linux and macOS, but not FreeBSD), when the RUID and EUID were both non-zero, it was possible to regain the shell's former privileges by e.g. assigning to the EUID or EGID parameter. In the course of investigating this issue, it was also found that the setopt built-in did not correctly report errors when unsetting the option, which prevented users from handling them as the documentation recommended. setopt now returns non-zero if it is unable to safely drop privileges.
References:
http://zsh.sourceforge.net/releases.html
https://www.mail-archive.com/debian
Bugzilla
CVE-2019-20044 zsh: insecure dropping of privileges when unsetting PRIVILEGED option [fedora-all]
bugzilla·2020-02-19·CVSS 7.8
CVE-2019-20044 [HIGH] CVE-2019-20044 zsh: insecure dropping of privileges when unsetting PRIVILEGED option [fedora-all]
CVE-2019-20044 zsh: insecure dropping of privileges when unsetting PRIVILEGED option [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multipl
http://seclists.org/fulldisclosure/2020/May/49http://seclists.org/fulldisclosure/2020/May/53http://seclists.org/fulldisclosure/2020/May/55http://seclists.org/fulldisclosure/2020/May/59http://zsh.sourceforge.net/releases.htmlhttps://github.com/XMB5/zsh-privileged-upgradehttps://lists.debian.org/debian-lts-announce/2020/03/msg00004.htmlhttps://lists.debian.org/debian-lts-announce/2020/12/msg00000.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FP64FFIZI2CKQOEAOI5A72PVQULE7ZZC/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN5V7MPHRRP7QNHOEK56S7QGRU53WUN6/https://security.gentoo.org/glsa/202003-55https://support.apple.com/HT211168https://support.apple.com/HT211170https://support.apple.com/HT211171https://support.apple.com/HT211175https://support.apple.com/kb/HT211168https://support.apple.com/kb/HT211170https://support.apple.com/kb/HT211171https://support.apple.com/kb/HT211175https://www.zsh.org/mla/zsh-announce/141http://seclists.org/fulldisclosure/2020/May/49http://seclists.org/fulldisclosure/2020/May/53http://seclists.org/fulldisclosure/2020/May/55http://seclists.org/fulldisclosure/2020/May/59http://zsh.sourceforge.net/releases.htmlhttps://github.com/XMB5/zsh-privileged-upgradehttps://lists.debian.org/debian-lts-announce/2020/03/msg00004.htmlhttps://lists.debian.org/debian-lts-announce/2020/12/msg00000.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FP64FFIZI2CKQOEAOI5A72PVQULE7ZZC/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN5V7MPHRRP7QNHOEK56S7QGRU53WUN6/https://security.gentoo.org/glsa/202003-55https://support.apple.com/HT211168https://support.apple.com/HT211170https://support.apple.com/HT211171https://support.apple.com/HT211175https://support.apple.com/kb/HT211168https://support.apple.com/kb/HT211170https://support.apple.com/kb/HT211171https://support.apple.com/kb/HT211175https://www.zsh.org/mla/zsh-announce/141
2020-02-24
Published