Vulnerability Details : CVE-2019-20044
In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid().
Products affected by CVE-2019-20044
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.14.6:-:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-001:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-002:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-006:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-007:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-001:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-002:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-004:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-005:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.13.6:-:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-002:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-003:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-001:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-002:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-003:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-004:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-005:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-006:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-007:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2020-001:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2020-002:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
- cpe:2.3:a:zsh:zsh:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-20044
0.08%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 25 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-20044
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST | |
|
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2019-20044
-
The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-20044
-
https://github.com/XMB5/zsh-privileged-upgrade
Page not found · GitHub · GitHubBroken Link
-
https://support.apple.com/HT211171
About the security content of tvOS 13.4.5 - Apple SupportThird Party Advisory
-
https://security.gentoo.org/glsa/202003-55
Zsh: Privilege escalation (GLSA 202003-55) — Gentoo securityThird Party Advisory
-
http://seclists.org/fulldisclosure/2020/May/59
Full Disclosure: APPLE-SA-2020-05-26-4 tvOS 13.4.5Mailing List;Third Party Advisory
-
https://support.apple.com/kb/HT211168
About the security content of iOS 13.5 and iPadOS 13.5 - Apple SupportThird Party Advisory
-
http://seclists.org/fulldisclosure/2020/May/55
Full Disclosure: APPLE-SA-2020-05-26-5 watchOS 6.2.5Mailing List;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FP64FFIZI2CKQOEAOI5A72PVQULE7ZZC/
[SECURITY] Fedora 31 Update: zsh-5.7.1-6.fc31 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://support.apple.com/HT211168
About the security content of iOS 13.5 and iPadOS 13.5 - Apple SupportThird Party Advisory
-
https://support.apple.com/kb/HT211170
About the security content of macOS Catalina 10.15.5, Security Update 2020-003 Mojave, Security Update 2020-003 High Sierra - Apple SupportThird Party Advisory
-
https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html
[SECURITY] [DLA 2470-1] zsh security updateMailing List;Third Party Advisory
-
https://support.apple.com/HT211170
About the security content of macOS Catalina 10.15.5, Security Update 2020-003 Mojave, Security Update 2020-003 High Sierra - Apple SupportThird Party Advisory
-
http://zsh.sourceforge.net/releases.html
ZSH - Release NotesRelease Notes;Third Party Advisory
-
https://www.zsh.org/mla/zsh-announce/141
Release Notes;Vendor Advisory
-
https://lists.debian.org/debian-lts-announce/2020/03/msg00004.html
[SECURITY] [DLA 2117-1] zsh security updateMailing List;Third Party Advisory
-
https://support.apple.com/kb/HT211175
About the security content of watchOS 6.2.5 - Apple SupportThird Party Advisory
-
http://seclists.org/fulldisclosure/2020/May/49
Full Disclosure: APPLE-SA-2020-05-26-1 iOS 13.5 and iPadOS 13.5Mailing List;Third Party Advisory
-
https://support.apple.com/kb/HT211171
About the security content of tvOS 13.4.5 - Apple SupportThird Party Advisory
-
https://support.apple.com/HT211175
About the security content of watchOS 6.2.5 - Apple SupportThird Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PN5V7MPHRRP7QNHOEK56S7QGRU53WUN6/
[SECURITY] Fedora 30 Update: zsh-5.7.1-6.fc30 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
http://seclists.org/fulldisclosure/2020/May/53
Full Disclosure: APPLE-SA-2020-05-26-3 macOS Catalina 10.15.5, Security Update 2020-003 Mojave, Security Update 2020-003 High SierraMailing List;Third Party Advisory
Jump to