Published: 05/12/2019 Updated: 24/08/2020

CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 409

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

xlock in OpenBSD 6.6 allows local users to gain the privileges of the auth group by providing a LIBGL_DRIVERS_PATH environment variable, because xenocara/lib/mesa/src/loader/loader.c mishandles dlopen.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openbsd openbsd 6.6

Qualys has discovered that OpenBSD suffers from multiple authentication bypass and local privilege escalation vulnerabilities ...

Full Disclosure mailing list archives   By Date By Thread </form>    Authentication vulnerabilities in OpenBSD   From: Qualys Security ...

oss-sec mailing list archives   By Date By Thread </form>    Authentication vulnerabilities in OpenBSD   From: Qualys Security Advisor ...

Script that automates the process of escalating privileges on openbsd system (CVE-2019-19520) by exploiting the xlock binary and againing it's sgid and escalating to the root user by (CVE-2019-19522) exploiting the privileges of auth group and adding keys to the Skey or Yubikey

Openbsd-Privilege-Escalation A Script that automates the process of escalating privileges on openbsd system (CVE-2019-19520) by exploiting the xlock binary and againing it's sgid and escalating to the root user by (CVE-2019-19522) exploiting the privileges of auth group and adding keys to the Skey or Yubikey The C code is pretty much a copy of the original poc from: https

CWE-863 https://www.openbsd.org/errata66.html https://www.openwall.com/lists/oss-security/2019/12/04/5 http://www.openwall.com/lists/oss-security/2019/12/04/6 http://www.openwall.com/lists/oss-security/2019/12/04/5 https://seclists.org/bugtraq/2019/Dec/8 http://packetstormsecurity.com/files/155572/Qualys-Security-Advisory-OpenBSD-Authentication-Bypass-Privilege-Escalation.html http://seclists.org/fulldisclosure/2019/Dec/14 https://nvd.nist.gov https://github.com/retrymp3/Openbsd-Privilege-Escalation http://seclists.org/fulldisclosure/2019/Dec/14

CVE-2019-19520

Vulnerability Summary

Vulnerability Trend

Exploits

Mailing Lists

Github Repositories

References

Vulmon Search

About

Products

Connect