Ubuntu CVE-2019-14287 Patch Manager

Ubuntu CVE-2019-14287 Patch Manager is a GUI-based lab tool for checking, mitigating, and verifying protection against CVE-2019-14287, a sudo privilege-escalation vulnerability.

This project was developed for an Ubuntu 19.04 amd64 lab environment.

Project Purpose

CVE-2019-14287 affects older sudo versions. The vulnerability allows a user with a sudoers rule that excludes root to bypass the restriction using a crafted numeric user ID such as -1 or 4294967295.

Example risky sudoers rule:

someuser ALL=(ALL, !root) /usr/bin/vim

In vulnerable sudo versions, this could be abused with:

sudo -u#-1 id -u
sudo -u#4294967295 id -u

If the output is 0, the command executed as root.

What This Application Does

The application provides two layers of protection:

Real sudo package patch
The tool can run the official package upgrade command to update sudo.
Sudoers configuration mitigation
The tool scans sudoers files and disables risky rules containing !root or !#0.

Main Features

Check Ubuntu version
Check system architecture
Check installed sudo version
Apply real sudo package patch
Scan /etc/sudoers
Scan /etc/sudoers.d/*
Detect active sudoers lines containing:
- !root
- ! root
- !#0
- ! #0
Show risky lines in the GUI
Disable selected risky lines
Create backups before modification
Validate changes using visudo -cf
Verify protection against crafted Runas UID values

Project Structure

ubuntu-cve-2019-14287-patch-manager/
├── app.py
├── scripts/
│   ├── check_system.sh
│   ├── apply_real_sudo_patch.sh
│   └── verify_patch.sh
├── assets/
├── README.md
├── .gitignore
├── logs/       generated at runtime
├── backups/    generated at runtime
├── package/    generated during .deb build
└── dist/       generated .deb output

Requirements

Install dependencies:

sudo apt update
sudo apt install -y python3 python3-tk sudo

Run From Source

Go to the project folder:

cd ~/projects/ubuntu-cve-2019-14287-patch-manager

Run the application:

sudo python3 app.py

The application must run as root because it needs access to:

/etc/sudoers
/etc/sudoers.d/*

Build the Debian Package

From the project root:

mkdir -p package/DEBIAN
mkdir -p package/usr/share/ubuntu-cve-2019-14287-patch-manager
mkdir -p package/usr/local/bin
mkdir -p dist

Copy application files:

cp app.py package/usr/share/ubuntu-cve-2019-14287-patch-manager/
cp -r scripts package/usr/share/ubuntu-cve-2019-14287-patch-manager/
cp -r assets package/usr/share/ubuntu-cve-2019-14287-patch-manager/

Create runtime folders:

mkdir -p package/usr/share/ubuntu-cve-2019-14287-patch-manager/logs
mkdir -p package/usr/share/ubuntu-cve-2019-14287-patch-manager/backups

Create launcher:

cat > package/usr/local/bin/ubuntu-cve-2019-14287-patch-manager <<'LAUNCHER'
#!/bin/bash
cd /usr/share/ubuntu-cve-2019-14287-patch-manager
exec python3 app.py
LAUNCHER

chmod +x package/usr/local/bin/ubuntu-cve-2019-14287-patch-manager

Create Debian control file:

cat > package/DEBIAN/control <<'CONTROL'
Package: ubuntu-cve-2019-14287-patch-manager
Version: 1.0.0
Section: utils
Priority: optional
Architecture: all
Depends: python3, python3-tk, sudo
Maintainer: Hivin Manju Sri <[email protected]>
Description: GUI patch manager for CVE-2019-14287 sudo vulnerability
 A lab GUI tool for checking sudo version, applying the sudo package patch,
 scanning sudoers files for risky !root or !#0 rules, disabling selected risky
 rules safely, and verifying CVE-2019-14287 protection.
CONTROL

Build:

chmod 755 package/DEBIAN
chmod 644 package/DEBIAN/control
dpkg-deb --build package dist/ubuntu-cve-2019-14287-patch-manager_1.0.0_all.deb

Install:

sudo dpkg -i dist/ubuntu-cve-2019-14287-patch-manager_1.0.0_all.deb
sudo apt --fix-broken install -y

Run after install:

sudo ubuntu-cve-2019-14287-patch-manager

Application Workflow

Click Check System
Click Apply Real Sudo Patch
Click Scan Sudoers Rules
Review risky sudoers lines
Click Disable Selected Risky Rules
Click Verify Protection

Risky Rule Detection

The application detects any active sudoers line containing:

!root
! root
!#0
! #0

It does not depend on a fixed username or command path.

Example risky rules:

testone ALL=(ALL, !root) /usr/bin/vim
john ALL=(ALL,!root) /bin/bash
admin ALL=(ALL, !#0) /usr/bin/python3
%developers ALL=(ALL,!#0) /any/path

When disabled, a risky rule becomes:

# DISABLED by Ubuntu CVE-2019-14287 Patch Manager: john ALL=(ALL,!#0) /bin/bash

Verification

The application verifies protection using:

sudo -u#-1 id -u
sudo -u#4294967295 id -u

Protected result:

The commands fail or do not return UID 0.

Vulnerable result:

Security Notes

This tool is intended for lab and educational use.

For production systems:

Use a supported Ubuntu release.
Install the official sudo security update.
Avoid broad sudoers rules using (ALL, !root).
Use explicit allow-lists instead.
Always validate sudoers files using visudo.

cd ~/projects/ubuntu-cve-2019-14287-patch-manager

cat >> README.md <<'EOF'

Fixing Dependency Issues on Ubuntu 19.04

Ubuntu 19.04 is end-of-life, so its default package repositories may no longer provide required dependencies such as python3-tk. If the installer fails with an error similar to:

Depends: python3-tk but it is not installable
Unable to correct problems, you have held broken packages

use the recovery steps below.

1. Clean any broken package state

sudo dpkg --remove ubuntu-cve-2019-14287-patch-manager 2>/dev/null || true
sudo apt --fix-broken install -y
sudo dpkg --configure -a

2. Back up the current APT sources list

sudo cp /etc/apt/sources.list /etc/apt/sources.list.backup.$(date +%F_%H-%M-%S)

3. Point Ubuntu 19.04 repositories to old-releases

sudo sed -i -E 's|http://([a-z]{2}\.)?archive.ubuntu.com/ubuntu|http://old-releases.ubuntu.com/ubuntu|g' /etc/apt/sources.list
sudo sed -i -E 's|http://security.ubuntu.com/ubuntu|http://old-releases.ubuntu.com/ubuntu|g' /etc/apt/sources.list

4. Update package indexes

sudo apt update

5. Install the required GUI dependency

sudo apt install -y python3-tk

6. Re-run the application installer

wget -O ubuntu-cve-2019-14287-patch-manager_1.0.0_all.deb "https://github.com/HivinManjuSri/ubuntu-cve-2019-14287-patch-manager/releases/latest/download/ubuntu-cve-2019-14287-patch-manager_1.0.0_all.deb" && sudo apt install -y ./ubuntu-cve-2019-14287-patch-manager_1.0.0_all.deb

If apt install does not accept the local .deb file on Ubuntu 19.04, use:

wget -O ubuntu-cve-2019-14287-patch-manager_1.0.0_all.deb "https://github.com/HivinManjuSri/ubuntu-cve-2019-14287-patch-manager/releases/latest/download/ubuntu-cve-2019-14287-patch-manager_1.0.0_all.deb" && sudo dpkg -i ./ubuntu-cve-2019-14287-patch-manager_1.0.0_all.deb && sudo apt --fix-broken install -y

7. Run the application

sudo ubuntu-cve-2019-14287-patch-manager

Note

This repository change is mainly required for old Ubuntu 19.04 lab machines. For production systems, use a currently supported Ubuntu release instead of relying on end-of-life repositories.

One-Command GitHub Release Installer

After uploading the .deb file to the GitHub latest release, users can install the application with this command:

wget -O ubuntu-cve-2019-14287-patch-manager_1.0.0_all.deb "https://github.com/HivinManjuSri/ubuntu-cve-2019-14287-patch-manager/releases/latest/download/ubuntu-cve-2019-14287-patch-manager_1.0.0_all.deb" && sudo apt install -y ./ubuntu-cve-2019-14287-patch-manager_1.0.0_all.deb

Author

Hivin Manju Sri

Most Popular

ubuntu-cve-2019-14287-patch-manager