CVE-2019-19519

Sažetak

In OpenBSD 6.6, local users can use the su -L option to achieve any login class (often excluding root) because there is a logic error in the main function in su/su.c.

Reference

https://github.com/openbsd/src/blob/2dfc98f42e117c7605b52b5020b630d98601dc22/usr.bin/su/su.c#L210-L211
https://www.openbsd.org/errata66.html
https://www.openwall.com/lists/oss-security/2019/12/04/5
http://www.openwall.com/lists/oss-security/2019/12/04/5
https://seclists.org/bugtraq/2019/Dec/8
http://packetstormsecurity.com/files/155572/Qualys-Security-Advisory-OpenBSD-Authentication-Bypass-Privilege-Escalation.html
http://seclists.org/fulldisclosure/2019/Dec/14

CVSS

Base:	4.6
Impact:	6.4
Exploitability:	3.9

Pristup

Vektor	Složenost	Autentikacija
LOCAL	LOW	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
PARTIAL	PARTIAL	PARTIAL

CVSS vektor

AV:L/AC:L/Au:N/C:P/I:P/A:P

Zadnje važnije ažuriranje

21-07-2021 - 11:39

Objavljeno

05-12-2019 - 00:15