リモートのOracleVMシステムには、重大なセキュリティ更新に対処するために必要なパッチがありません：- 修正（CVE-2017-1000367）解決：rhbz#1455399 - noexec syscallブラックリストを更新 - 修正（CVE-2016-7032、CVE-2016-7076）解決：rhbz#1391938 - RHEL-6.9 erratum - /var/log/sudo-ioディレクトリ作成時の競合状態を修正 解決：rhbz#1365156

リモートのOracleVMシステムには、重大なセキュリティ更新に対処するために必要なパッチがありません：- noexec syscallブラックリストを更新 - 修正（CVE-2016-7032、CVE-2016-7076）解決：rhbz#1391937 - RHEL-6.8 erratum - 非rootユーザーが他のユーザーの権限をリスト表示できる原因となるバグを修正 解決：rhbz#1312481 - RHEL-6.8 erratum - closefrom_overrideのデフォルトオプションの処理を修正 解決：rhbz#1309976 - RHEL-6.8 erratum - getcwdが失敗しNullポインター例外を引き起こす可能性を修正：rhbz#1284886 - RHEL-6.8 erratum - ゼロルールのユーザーのsssd検出を修正 解決：rhbz#1220480 - RHEL-6.8 erratum - LDAPからルールをフェッチする場合、ユーザーIDでも検索 解決：rhbz#1135531 - RHEL-6.8 erratum - LDAPとSSSDのsudoOption値を修正し、引用を削除 - LDAPとSSSDのsudoOptionの空白の解析問題を修正 解決：rhbz#1144422 解決：rhbz#1279447 - RHEL-6.8 erratum - /etc/sudoersからのデフォルトオプションのrequirettyを削除 - pam_serviceとpam_login_serviceのデフォルトオプションをバックポート - netgroup処理セマンティックの変更の新規デフォルトオプションを実装 - visudoのCLIを抑制するオプションを修正 解決：rhbz#1248695 解決：rhbz#1247231 解決：rhbz#1241896 解決：rhbz#1197885 解決：rhbz#1233205 - 以前のグループの処理動作を再導入するパッチを追加 解決：rhbz#1075836

bindの更新プログラムが、Red Hat Enterprise Linux 6とRed Hat Enterprise Linux 7で利用可能になりました。Red Hat製品セキュリティは、この更新がセキュリティに及ぼす影響を重要度中と評価しています。詳細な重要度評価を示すCVSS（共通脆弱性評価システム）ベーススコアは、「参照」セクションのCVEリンクから脆弱性ごとに入手できます。sudoパッケージには、sudoユーティリティが含まれており、システム管理者はこのユーティリティで、特定のユーザーに対して、rootとしてログインすることなく、システムの管理目的で使用され、権限が必要なコマンドの実行のアクセス許可を与えることができます。セキュリティ修正プログラム：* ユーザーが与えた引数でsystem()、popen()、wordexp()のCライブラリの関数を実行したsudoを介してアプリケーションを実行した場合、sudo noexecの制限がバイパスされる可能性があることがわかりました。noexecの制限付きでsudo経由でそのようなアプリケーションを実行することを許可されたローカルのユーザーが、こうした欠陥を利用して昇格した権限で任意のコマンドを実行する可能性があります。（CVE-2016-7032、CVE-2016-7076）これらの問題は、Florian Weimer氏（Red Hat）によって発見されました。

- 1.8.18p1への更新

  - CVE-2016-7076を修正します

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

このsudo用の更新プログラムでは、次の問題が修正されます：

  - ユーザーがsudoのNOEXEC機能をバイパスできるようになる2件のセキュリティ脆弱性を修正します：

  - system()およびpopen()を介したnoexecのバイパス[CVE-2016-7032、 bsc#1007766

  wordexp()[CVE-2016-7076をbsc#1007501介したnoexecのバイパス

  - SSSDプラグインがsudoを「内部エラー」でクラッシュさせることがあります。この問題は修正されました。
    [bsc#948973]

  - SSSDプラグインは、@netgroupではなく、LDAPの@netgroupsルールを全ユーザーに適用することがあります。
    この問題は修正されました。[bsc#966755]

  - SSSDプラグインが使用され、ローカルユーザーがsudoを実行すると、SSSD ではローカルユーザーに対してsudoをサポートしていないため、電子メールが管理者に送信されました。このメッセージはエラーを示すものではありません。これはノイズにすぎませんでした。
    [bsc#1008043]

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

このsudoの更新では、次のセキュリティ問題が修正されます：

  - ユーザーがsudoのNOEXEC機能をバイパスできるようになる2件のセキュリティ脆弱性を修正します：

  - system()およびpopen()を介したnoexecのバイパス[CVE-2016-7032、 bsc#1007766

  wordexp()[CVE-2016-7076をbsc#1007501介したnoexecのバイパス

  - TZ環境変数の安全でない処理を修正します。
    [CVE-2014-9680、bsc#917806]さらに、この更新には以下のセキュリティ関連以外の修正も含まれています：

  - !tty_ticketsの起動後に常に示される「将来のタイムスタンプを無視する」メッセージを修正します。[bsc#899252]☆

  - SASLベースの認証のサポートを有効にします。
    [bsc#979531]

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

ユーザー指定の引数で、sudoが実行するsystem()とpopen()のCライブラリ関数によりアプリケーションを実行した場合、sudo noexecの制限がバイパスされる可能性があることがわかりました。noexecの制限付きでsudoによりそのようなアプリケーションを実行することを許可されたローカルのユーザーが、この欠陥を利用し、昇格した権限で任意のコマンドを実行する可能性があります。（CVE-2016-7032）ユーザー指定の引数で、sudoが実行するwordexp()のCライブラリ関数によりアプリケーションを実行した場合、sudo noexecの制限がバイパスされる可能性があることがわかりました。noexecの制限付きでsudoによりそのようなアプリケーションを実行することを許可されたローカルのユーザーが、この欠陥を利用し、昇格した権限で任意のコマンドを実行する可能性があります。（CVE-2016-7076）

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fixes (CVE-2017-1000367) Resolves: rhbz#1455399

  - Update noexec syscall blacklist

  - Fixes (CVE-2016-7032, CVE-2016-7076) Resolves:
    rhbz#1391938

  - RHEL-6.9 erratum

  - Fix race condition when creating /var/log/sudo-io     direcotry Resolves: rhbz#1365156

It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed system() or popen() C library functions with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could use this flaw to execute arbitrary commands with elevated privileges. (CVE-2016-7032)

It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges.
(CVE-2016-7076)

According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that the sudo noexec restriction     could have been bypassed if application run via sudo     executed system(), popen(), or wordexp() C library     functions with a user-supplied argument. A local user     permitted to run such application via sudo with noexec     restriction could use these flaws to execute arbitrary     commands with elevated privileges. (CVE-2016-7032,     CVE-2016-7076)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Update noexec syscall blacklist

  - Fixes (CVE-2016-7032, CVE-2016-7076) Resolves:
    rhbz#1391937

  - RHEL-6.8 erratum

  - fixed a bug causing that non-root users can list     privileges of other users Resolves: rhbz#1312481

  - RHEL-6.8 erratum

  - fixed handling of closefrom_override defaults option     Resolves: rhbz#1309976

  - RHEL-6.8 erratum

  - fixed potential getcwd failure, resulting in Null     pointer exception Resolves: rhbz#1284886

  - RHEL-6.8 erratum

  - fixed sssd's detection of user with zero rules Resolves:
    rhbz#1220480

  - RHEL-6.8 erratum

  - search also by user id when fetching rules from LDAP     Resolves: rhbz#1135531

  - RHEL-6.8 erratum

  - fixed ldap's and sssd's sudoOption value and remove     quotes

  - fixed ldap's and sssd's sudoOption whitespaces parse     problem Resolves: rhbz#1144422 Resolves: rhbz#1279447

  - RHEL-6.8 erratum

  - removed defaults option requiretty from /etc/sudoers

  - backported pam_service and pam_login_service defaults     options

  - implemented a new defaults option for changing netgroup     processing semantics

  - fixed visudo's quiet cli option Resolves: rhbz#1248695     Resolves: rhbz#1247231 Resolves: rhbz#1241896 Resolves:
    rhbz#1197885 Resolves: rhbz#1233205

  - added patch to re-introduce old group processing     behaviour Resolves: rhbz#1075836

An update for sudo is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.

Security Fix(es) :

* It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed system(), popen(), or wordexp() C library functions with a user-supplied argument. A local user permitted to run such application via sudo with noexec restriction could use these flaws to execute arbitrary commands with elevated privileges. (CVE-2016-7032, CVE-2016-7076)

These issues were discovered by Florian Weimer (Red Hat).

- update to 1.8.18p1

  - fixes CVE-2016-7076

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sudo fixes the following issues :

  - Fix two security vulnerabilities that allowed users to     bypass sudo's NOEXEC functionality :

  - noexec bypass via system() and popen() [CVE-2016-7032,     bsc#1007766]

  - noexec bypass via wordexp() [CVE-2016-7076, bsc#1007501]

  - The SSSD plugin would occasionally crash sudo with an     'internal error'. This issue has been fixed.
    [bsc#948973]

  - The SSSD plugin would occasionally apply @netgroups     rules from LDAP to all users rather than the @netgroup.
    This issue is now fixed. [bsc#966755]

  - When the SSSD plugin was used and a local user ran sudo,     an e-mail used to be sent to administrator because SSSD     did not support sudo rules for local users. This message     did not signify an error, however, it was only noise.
    [bsc#1008043]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sudo fixes the following security issues :

  - Fix two security vulnerabilities that allowed users to     bypass sudo's NOEXEC functionality :

  - noexec bypass via system() and popen() [CVE-2016-7032,     bsc#1007766]

  - noexec bypass via wordexp() [CVE-2016-7076, bsc#1007501]

  - Fix unsafe handling of TZ environment variable.
    [CVE-2014-9680, bsc#917806] Additionally, these     non-security fixes are included in the update :

  - Fix 'ignoring time stamp from the future' message after     each boot with !tty_tickets. [bsc#899252]

  - Enable support for SASL-based authentication.
    [bsc#979531]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.02, has sudo packages installed that are affected by multiple vulnerabilities:

  - A certain Fedora patch for parse.c in sudo before 1.7.4p5-1.fc14 on Fedora 14 does not properly interpret     a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to     that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a     sudo command. NOTE: this vulnerability exists because of a CVE-2009-0034 regression. (CVE-2011-0008)

  - check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for     command execution that involves a gid change but no uid change, which allows local users to bypass an     intended authentication requirement via the -g option to a sudo command. (CVE-2011-0010)

  - Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to     execute arbitrary code via format string sequences in the program name for sudo. (CVE-2012-0809)

  - sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations     that use a netmask syntax, which allows local users to bypass intended command restrictions in     opportunistic circumstances by executing a command on a host that has an IPv4 address. (CVE-2012-2337)

  - sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate     attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting     the system clock and sudo user timestamp to the epoch. (CVE-2013-1775)

  - sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not     properly validate the controlling terminal device, which allows local users with sudo permissions to     hijack the authorization of another terminal via vectors related to connecting to the standard input,     output, and error file descriptors of another terminal. NOTE: this is one of three closely-related     vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different     affected versions. (CVE-2013-1776)

  - sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file,     which allows local users to open arbitrary files for read access (but not view file contents) by running a     program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log     messages, or repositioning tape drives. (CVE-2014-9680)

  - sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose     full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by /home/*/*/file.txt.
    (CVE-2015-5602)

  - sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run     via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to     run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary     commands with elevated privileges. (CVE-2016-7076)

  - Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in     the get_process_ttyname() function resulting in information disclosure and command execution.
    (CVE-2017-1000367)

  - ** DISPUTED ** In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can     impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user.
    NOTE: The software maintainer believes that this is not a vulnerability because running a command via sudo     as a user not present in the local password database is an intentional feature. Because this behavior     surprised some users, sudo 1.8.30 introduced an option to enable/disable this behavior with the default     being disabled. However, this does not change the fact that sudo was behaving as intended, and as     documented, in earlier versions. (CVE-2019-19232)

  - Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which     allows privilege escalation to root via sudoedit -s and a command-line argument that ends with a single     backslash character. (CVE-2021-3156)

  - A heap-based buffer overflow was found in the way sudo parses command line arguments. This flaw is     exploitable by any local user who can execute the sudo command without authentication. Successful     exploitation of this flaw could lead to privilege escalation.  (CVE-2021-3156)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
100530	OracleVM 3.3/3.4：sudo（OVMSA-2017-0110）	Nessus	OracleVM Local Security Checks	2017/5/31	2021/1/4	high
95599	OracleVM 3.3/3.4：sudo（OVMSA-2016-0170）	Nessus	OracleVM Local Security Checks	2016/12/7	2021/1/4	high
95600	RHEL 6/7：sudo（RHSA-2016:2872）	Nessus	Red Hat Local Security Checks	2016/12/7	2019/10/24	high
94998	Fedora 25：sudo（2016-3a0df9e256）	Nessus	Fedora Local Security Checks	2016/11/21	2021/1/11	high
95312	SUSE SLES11セキュリティ更新プログラム：sudo（SUSE-SU-2016:2891-1）	Nessus	SuSE Local Security Checks	2016/11/25	2021/1/19	high
95317	SUSE SLED12 / SLES12セキュリティ更新プログラム：sudo（SUSE-SU-2016:2904-1）	Nessus	SuSE Local Security Checks	2016/11/25	2021/1/6	high
96282	Amazon Linux AMI：sudo（ALAS-2017-780）	Nessus	Amazon Linux Local Security Checks	2017/1/5	2018/8/31	high
100530	OracleVM 3.3 / 3.4 : sudo (OVMSA-2017-0110)	Nessus	OracleVM Local Security Checks	2017/5/31	2021/1/4	high
96282	Amazon Linux AMI : sudo (ALAS-2017-780)	Nessus	Amazon Linux Local Security Checks	2017/1/5	2018/8/31	high
99851	EulerOS 2.0 SP1 : sudo (EulerOS-SA-2017-1004)	Nessus	Huawei Local Security Checks	2017/5/1	2021/1/6	high
95599	OracleVM 3.3 / 3.4 : sudo (OVMSA-2016-0170)	Nessus	OracleVM Local Security Checks	2016/12/7	2021/1/4	high
95600	RHEL 6 / 7 : sudo (RHSA-2016:2872)	Nessus	Red Hat Local Security Checks	2016/12/7	2019/10/24	high
94998	Fedora 25 : sudo (2016-3a0df9e256)	Nessus	Fedora Local Security Checks	2016/11/21	2021/1/11	high
95312	SUSE SLES11 Security Update : sudo (SUSE-SU-2016:2891-1)	Nessus	SuSE Local Security Checks	2016/11/25	2021/1/19	high
95317	SUSE SLED12 / SLES12 Security Update : sudo (SUSE-SU-2016:2904-1)	Nessus	SuSE Local Security Checks	2016/11/25	2021/1/6	high
154540	NewStart CGSL MAIN 6.02 : sudo Multiple Vulnerabilities (NS-SA-2021-0120)	Nessus	NewStart CGSL Local Security Checks	2021/10/27	2023/1/17	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high