CVE-2019-20044

In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid().

The zsh shell is a command interpreter usable as an interactive login shell and as a shell script command processor. Zsh resembles the ksh shell (the Korn shell), but includes many enhancements. Zsh supports command-line editing, built-in spelling correction, programmable command completion, shell functions (with autoloading), a history mechanism, and more.

Security Fix(es):

• zsh: insecure dropping of privileges when unsetting PRIVILEGED option (CVE-2019-20044)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid().

The zsh shell is a command interpreter usable as an interactive login shell and as a shell script command processor. Zsh resembles the ksh shell (the Korn shell), but includes many enhancements. Zsh supports command-line editing, built-in spelling correction, programmable command completion, shell functions (with autoloading), a history mechanism, and more.

Security Fix(es):

• zsh: insecure dropping of privileges when unsetting PRIVILEGED option (CVE-2019-20044)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• SECURITY UPDATE: Regain dropped privileges
  • debian/patches/CVE-2019-20044-pre.patch: change the order of the calls to setgid (this should go first) and setuid in Src/options.c.
  • debian/patches/CVE-2019-20044-1.patch: add extra checks to drop privileges securely in Src/options.c.
  • debian/patches/CVE-2019-20044-2.patch: add Src/openssh_bsd_setres_id.c and its object file to Src/zsh.mdd, fix some of the checks from the previous patch in Src/options.c, update compatibility wrappers in Src/zsh_system.h, update the uid/gid methods in AC_CHECK_FUNCS in configure.ac and add a test in Test/E01options.ztst.
  • debian/patches/CVE-2019-20044-3.patch: improve Src/options.c changes from above two patches.
  • debian/patches/CVE-2019-20044-4.patch: clean up white spaces in Src/options.c.
  • debian/patches/CVE-2019-20044-5.patch: add privileged tests to Test/P01privileged.ztst, remove the notes on privileged test in Test/E01options.ztst and add the prilived tests to the Test/README.
  • CVE-2019-20044
• SECURITY UPDATE: Arbitrary code execution
  • debian/patches/CVE-2021-45444.patch: save PROMPTSUBST option before the call to promptexpand() in b/Src/prompt.c and restore after it is executed.
  • CVE-2021-45444

• SECURITY UPDATE: insecure privilege dropping vulnerability
  • debian/patches/CVE-2019-20044-*.patch: improve error handling in setopt command, add OpenSSH-based setresuid/setresgid wrappers, simplify and secure privilege dropping logic, add comprehensive tests for PRIVILEGED option
  • CVE-2019-20044

Updated zsh packages fix security vulnerability:

A privilege escalation vulnerability was discovered in zsh, whereby a user could regain a formerly elevated privelege level even when such an action should not be permitted (CVE-2019-20044).

This update for zsh fixes the following issues:

• CVE-2021-45444: Fixed a vulnerability where arbitrary shell commands could be executed related to prompt expansion (bsc#1196435).
• CVE-2019-20044: Fixed a vulnerability where shell privileges would not be properly dropped when unsetting the PRIVILEGED option (bsc#1163882).

These are all security issues fixed in the zsh-5.8-7.7 package on the GA media of openSUSE Tumbleweed.

This update for zsh fixes the following issues:

• CVE-2021-45444: Fixed a vulnerability where arbitrary shell commands could be executed related to prompt expansion (bsc#1196435).
• CVE-2019-20044: Fixed a vulnerability where shell privileges would not be properly dropped when unsetting the PRIVILEGED option (bsc#1163882).

This update for zsh fixes the following issues:

• CVE-2021-45444: Fixed a vulnerability where arbitrary shell commands could be executed related to prompt expansion (bsc#1196435).
• CVE-2019-20044: Fixed a vulnerability where shell privileges would not be properly dropped when unsetting the PRIVILEGED option (bsc#1163882).
• CVE-2018-1100: Fixed a potential code execution via a stack-based buffer overflow in utils.c:checkmailpath() (bsc#1089030).

This update for zsh fixes the following issues:

• CVE-2021-45444: Fixed a vulnerability where arbitrary shell commands could be executed related to prompt expansion (bsc#1196435).
• CVE-2019-20044: Fixed a vulnerability where shell privileges would not be properly dropped when unsetting the PRIVILEGED option (bsc#1163882).

This update for zsh fixes the following issues:

• CVE-2019-20044: Fixed an insecure dropping of privileges when unsetting the PRIVILEGED option (bsc#1163882).
• CVE-2018-13259: Fixed an unexpected truncation of long shebang lines (bsc#1107294).
• CVE-2018-7549: Fixed a crash when an empty hash table (bsc#1082991).
• CVE-2018-1083: Fixed a stack-based buffer overflow when using tab completion on directories with long names (bsc#1087026).
• CVE-2018-1071: Fixed a stack-based buffer overflow when executing certain commands (bsc#1084656).
• CVE-2018-0502: Fixed a mishandling of shebang lines (bsc#1107296).
• CVE-2017-18206: Fixed a buffer overflow related to symlink processing (bsc#1083002).
• CVE-2017-18205: Fixed an application crash when using cd with no arguments (bsc#1082998).
• CVE-2016-10714: Fixed a potential application crash when handling maximum length paths (bsc#1083250).
• CVE-2014-10072: Fixed a buffer overflow when scanning very long directory paths for symbolic links (bsc#1082975).
• CVE-2014-10071: Fixed a buffer overflow when redirecting output to a long file descriptor (bsc#1082977).
• CVE-2014-10070: Fixed a privilege escalation vulnerability via environment variables (bsc#1082885).

Sam Foxman discovered that Zsh incorrectly handled certain inputs. An attacker could possibly use this issue to regain dropped privileges. (CVE-2019-20044)

It was discovered that Zsh incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. (CVE-2021-45444)