CVE-2019-19519: High severity openbsd vulnerability

Published Dec 4, 2019

Updated

In OpenBSD 6.6, local users can use the su -L option to achieve any login class (often excluding root) because there is a logic error in the main function in su/su.c.

Affected Software

1 affected component

OpenBSD OpenBSD=6.6

Event History

Dec 4, 2019

CVE Published

via MITRE·11:34 PM

Data Sourced

via MITRE·11:34 PM

Description

Frequently Asked Questions

What is CVE-2019-19519?

CVE-2019-19519 is a vulnerability in OpenBSD 6.6 that allows local users to achieve any login class (often excluding root) through the su -L option due to a logic error in the main function in su/su.c.

How severe is CVE-2019-19519?

CVE-2019-19519 has a severity score of 7.8, which is considered high.

Which software versions are affected by CVE-2019-19519?

CVE-2019-19519 affects OpenBSD 6.6.

How can local users exploit CVE-2019-19519?

Local users can exploit CVE-2019-19519 by using the su -L option to achieve any login class, except root, due to a logic error in the main function in su/su.c.

Are there any references for CVE-2019-19519?

Yes, you can refer to the following links for more information: [1] http://packetstormsecurity.com/files/155572/Qualys-Security-Advisory-OpenBSD-Authentication-Bypass-Privilege-Escalation.html [2] http://seclists.org/fulldisclosure/2019/Dec/14 [3] http://www.openwall.com/lists/oss-security/2019/12/04/5