SecPod

Learn Search

Search across all Learn content

← Back to Expressions & POVs
ALERT: Superusers could run into Super trouble

ALERT: Superusers could run into Super trouble

Linux users, beware! One of the most powerful and well known command line utility, sudo, could aid users to gain superuser privileges in spite of the existing restrictions. With sudo being installed in almost all flavors of UNIX-like operating systems, a major number of users could possibly be affec...

Oct 14, 2019By Nitish B2 min read
credits: www.securityaffairs.co
credits: www.securityaffairs.co

Linux users, beware! One of the most powerful and well known command line utility, sudo, could aid users to gain superuser privileges in spite of the existing restrictions. With sudo being installed in almost all flavors of UNIX-like operating systems, a major number of users could possibly be affected. Who said security was easy? So, a vulnerability management solution is critical in such cases.

Right, let’s get down to business. sudo vulnerability assigned with CVE-2019-14287 and termed as Security Policy Bypass, the vulnerability lies in the Runas specification of sudo’s /etc/sudoers file. Any unprivileged user or a malicious application could make use of this security loophole and run root commands despite the fact that Runas specification disables root access. Auto patching can patch this sudo vulnerability.

Origin of Sudo:

The origin and meaning of the word ‘sudo’ is a bit archaic and stands for ‘superuser do’. sudo lets you run commands with privileges of other users and by default, superuser. The User Id (UID) of a superuser is 0.

Majority of the Linux systems with default configurations have ‘ALL‘ in the Runas specification. These machines remain unaffected. However, if sudo is configured to allow execution of commands as an arbitrary user. The user can still run commands as root.

Here’s how it works. Consider this configuration where the user secpod has the privileges to run ‘cat’ command as any other user except root.

plaintext
secpod = (ALL, !root) /usr/bin/cat

This disables execution of commands with superuser privileges for secpod. However, this bypassed by using the User ID “-1“. Or its unsigned equivalent “4294967295“.

plaintext
sudo -u#-1 cat /etc/saner/status.ini

Also, ss shown, the user secpod is able to gain root privileges. Whoops!

In a bid to fix the flaw. However, the vendor has released patches on all Linux platforms and strongly recommends updating to 1.8.28.

Also, please refer to this KB Article to apply the patches using SanerNow.

Featured Posts

Open The Most Effective Vulnerability Assessment Framework What Makes One Effective
The Most Effective Vulnerability Assessment Framework What Makes One Effective

Point of View

The Most Effective Vulnerability Assessment Framework What Makes One Effective

No single named standard makes a vulnerability assessment framework effective. This piece covers NIST, ISO, and CIS Controls, then breaks down what actually separates a working framework from a checklist, coverage, risk based prioritization, cadence, ownership, and a feedback loop.

Sep 11, 2026

Open Threat and Vulnerability Assessment How Risk Actually Gets Calculated
Threat and Vulnerability Assessment How Risk Actually Gets Calculated

Point of View

Threat and Vulnerability Assessment How Risk Actually Gets Calculated

A vulnerability alone doesn't tell the whole risk story. This piece breaks down how a threat and vulnerability assessment pairs technical weaknesses with real attacker context, walks through the six step process, and covers frameworks like NIST 800-30 and ISO 27005.

Sep 11, 2026

Open Vulnerability Assessment Services: What to Look For
Vulnerability Assessment Services: What to Look For

Point of View

Vulnerability Assessment Services: What to Look For

Choosing a vulnerability assessment provider means asking about actual coverage, scan frequency, and whether findings come with real prioritization or just a CVSS dump. This piece breaks down what strong vulnerability assessment services include, red flags to avoid, and questions to ask before signing.

Sep 11, 2026

Open Agentic AI Vulnerability Assessment What Changes and What Does Not
Agentic AI Vulnerability Assessment What Changes and What Does Not

Point of View

Agentic AI Vulnerability Assessment What Changes and What Does Not

Agentic AI is expanding what a vulnerability assessment needs to cover, autonomous agents bring their own credentials, tool access, and memory, adding a genuinely new asset class alongside servers and endpoints. It's also compressing attacker timelines and introducing risk categories like goal hijacking and tool misuse that don't map to a traditional CVE. But the core discipline hasn't changed: the same lifecycle of scoping, scanning, prioritizing, and remediating still applies, human judgment still drives prioritization, and accountability still sits with the people who deployed the agent, not the agent itself.

Sep 9, 2026