Vulnerability Details : CVE-2019-19882
Potential exploit
shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).
Products affected by CVE-2019-19882
- cpe:2.3:a:shadow_project:shadow:4.8:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-19882
0.09%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 28 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-19882
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.9
|
MEDIUM | AV:L/AC:M/Au:N/C:C/I:C/A:C |
3.4
|
10.0
|
NIST | |
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2019-19882
-
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-19882
-
https://bugs.archlinux.org/task/64836
FS#64836 : [shadow] useradd, groupadd, etc. are now setuid-rootExploit;Third Party Advisory
-
https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75
Fix failing chmod calls on installation for suidubins · shadow-maint/shadow@edf7547 · GitHubPatch;Third Party Advisory
-
https://security.gentoo.org/glsa/202008-09
Shadow: Privilege escalation (GLSA 202008-09) — Gentoo security
-
https://bugs.gentoo.org/702252
702252 – (CVE-2019-19882) sys-apps/shadow-4.8-r1[pam] installs setuid binaries with permissive pam configuration allowing user/group management without authentication (CVE-2019-19882)Exploit;Third Party Advisory
-
https://github.com/shadow-maint/shadow/pull/199
Don't auto-enable ACCT_TOOLS_SETUID if PAM is detected by falconindy · Pull Request #199 · shadow-maint/shadow · GitHubPatch;Third Party Advisory
-
https://github.com/void-linux/void-packages/pull/17580
shadow: reduce the number of suid programs by Duncaen · Pull Request #17580 · void-linux/void-packages · GitHubPatch;Third Party Advisory
Jump to