The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment     before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to     set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using     the allow_active element rather than allow_any. (CVE-2019-3842)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for systemd fixes the following issues :

Security issues fixed :

CVE-2019-3842: Fixed a privilege escalation in pam_systemd which could be exploited by a local user (bsc#1132348).

CVE-2019-6454: Fixed a denial of service via crafted D-Bus message (bsc#1125352).

CVE-2019-3843, CVE-2019-3844: Fixed a privilege escalation where services with DynamicUser could gain new privileges or create SUID/SGID binaries (bsc#1133506, bsc#1133509).

Non-security issued fixed: logind: fix killing of scopes (bsc#1125604)

namespace: make MountFlags=shared work again (bsc#1124122)

rules: load drivers only on 'add' events (bsc#1126056)

sysctl: Don't pass null directive argument to '%s' (bsc#1121563)

systemd-coredump: generate a stack trace of all core dumps and log into the journal (jsc#SLE-5933)

udevd: notify when max number value of children is reached only once per batch of events (bsc#1132400)

sd-bus: bump message queue size again (bsc#1132721)

Do not automatically online memory on s390x (bsc#1127557)

Removed sg.conf (bsc#1036463)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It has been discovered that systemd-tmpfiles mishandles     symbolic links present in non-terminal path components.
    In some configurations a local user could use this     vulnerability to get access to arbitrary files when the     systemd-tmpfiles command is run.(CVE-2018-6954)

  - In systemd before v242-rc4, it was discovered that     pam_systemd does not properly sanitize the environment     before using the XDG_SEAT variable. It is possible for     an attacker, in some particular configurations, to set     a XDG_SEAT environment variable which allows for     commands to be checked against polkit policies using     the 'allow_active' element rather than     'allow_any'.(CVE-2019-3842)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jann Horn 发现 systemd 中的 PAM 模块以不安全的方式使用环境，而且缺乏座位验证，允许伪造 PolicyKit 的活动会话。具备 SSH 访问权限的远程攻击者可利用此问题获取 PolicyKit 权限，此权限通常只提供给本地控制台上活动会话内的客户端。

Jann Horn 发现 pam_systemd 使用环境中的部分参数创建登录会话。本地攻击者可恶意利用此漏洞来伪造活动会话，并取得更多 PolicyKit 权限。

请注意，Tenable Network Security 已直接从 Ubuntu 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动清理和排版。

远程 Redhat Enterprise Linux 8 主机上安装的程序包受到 RHSA-2021: 1611 公告中提及的多个漏洞影响。

  - systemd：XDG_SEAT 伪造允许针对 allow_active 而非 allow_any 检查操作 (CVE-2019-3842)

  - systemd：错误处理以十进制数字或 0x 开头且后接十六进制数字的数字用户名 (CVE-2020-13776)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Rocky Linux 8 主机上存在安装的程序包该程序包受到公告 RLSA-2021:1611 中提及的多个漏洞的影响。

  - 据发现，在 v242-rc4 之前的系统中，pam_systemd 未先正确清理环境即使用 XDG_SEAT 变量。在某些特定配置中，攻击者可设置 XDG_SEAT 环境变量，以便使用“allow_active”元素而非“allow_any”来依据 polkit 策略检查命令。(CVE-2019-3842)

  - systemd v245 及之前的版本未正确处理数字用户名（例如由十进制数字或 0x 后接十六进制数字组成的用户名），比如，预期会使用 0x0 用户帐户的权限，但实际使用的是根权限。注意：存在此问题的原因是对 CVE-2017-1000082 的修复不完整。(CVE-2020-13776)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

Jann Horn discovered that the PAM module in systemd insecurely uses the environment and lacks seat verification permitting spoofing an active session to PolicyKit. A remote attacker with SSH access can take advantage of this issue to gain PolicyKit privileges that are normally only granted to clients in an active session on the local console.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3938-1 advisory.

    Jann Horn discovered that pam_systemd created logind sessions using some parameters from the environment.
    A local attacker could exploit this in order to spoof the active session and gain additional PolicyKit     privileges.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for systemd fixes the following issues :

Security issues fixed :

CVE-2018-6954: Fixed a vulnerability in the symlink handling of systemd-tmpfiles which allowed a local user to obtain ownership of arbitrary files (bsc#1080919).

CVE-2019-3842: Fixed a vulnerability in pam_systemd which allowed a local user to escalate privileges (bsc#1132348).

CVE-2019-6454: Fixed a denial of service caused by long dbus messages (bsc#1125352).

Non-security issues fixed: systemd-coredump: generate a stack trace of all core dumps (jsc#SLE-5933)

udevd: notify when max number value of children is reached only once per batch of events (bsc#1132400)

sd-bus: bump message queue size again (bsc#1132721)

core: only watch processes when it's really necessary (bsc#955942 bsc#1128657)

rules: load drivers only on 'add' events (bsc#1126056)

sysctl: Don't pass null directive argument to '%s' (bsc#1121563)

Do not automatically online memory on s390x (bsc#1127557)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.02, has systemd packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the     udevadm trigger command, a memory leak may occur. (CVE-2019-20386)

  - In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment     before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to     set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using     the allow_active element rather than allow_any. (CVE-2019-3842)

  - systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed     by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were     intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082. (CVE-2020-13776)

  - basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an     Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that     results in an operating system crash. (CVE-2021-33910)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1611 advisory.

  - In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment     before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to     set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using     the allow_active element rather than allow_any. (CVE-2019-3842)

  - systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed     by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were     intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082. (CVE-2020-13776)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1611 advisory.

    The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and     LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for     starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups.
    In addition, it supports snapshotting and restoring of the system state, maintains mount and automount     points, and implements an elaborate transactional dependency-based service control logic. It can also work     as a drop-in replacement for sysvinit.

    Security Fix(es):

    * systemd: Spoofing of XDG_SEAT allows for actions to be checked against allow_active instead of     allow_any (CVE-2019-3842)

    * systemd: Mishandles numerical usernames beginning with decimal digits or 0x followed by hexadecimal     digits (CVE-2020-13776)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
222936	Linux Distros Unpatched Vulnerability : CVE-2019-3842	Nessus	Misc.	2025/3/4	2025/9/3	high
126736	SUSE SLED15 / SLES15 Security Update : systemd (SUSE-SU-2019:1364-2)	Nessus	SuSE Local Security Checks	2019/7/16	2021/1/13	high
128100	EulerOS 2.0 SP5 : systemd (EulerOS-SA-2019-1808)	Nessus	Huawei Local Security Checks	2019/8/23	2024/5/2	high
123836	Debian DSA-4428-1：systemd - 安全更新	Nessus	Debian Local Security Checks	2019/4/9	2024/6/5	high
123930	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS：systemd 漏洞 (USN-3938-1)	Nessus	Ubuntu Local Security Checks	2019/4/9	2024/8/27	high
149692	RHEL 8：systemd (RHSA-2021: 1611)	Nessus	Red Hat Local Security Checks	2021/5/19	2025/9/10	high
184771	Rocky Linux 8systemd (RLSA-2021:1611)	Nessus	Rocky Linux Local Security Checks	2023/11/6	2023/12/22	high
123836	Debian DSA-4428-1 : systemd - security update	Nessus	Debian Local Security Checks	2019/4/9	2024/6/5	high
123930	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : systemd vulnerability (USN-3938-1)	Nessus	Ubuntu Local Security Checks	2019/4/9	2024/8/27	high
125244	SUSE SLED12 / SLES12 Security Update : systemd (SUSE-SU-2019:1265-1)	Nessus	SuSE Local Security Checks	2019/5/17	2024/5/22	high
160827	NewStart CGSL MAIN 6.02 : systemd Multiple Vulnerabilities (NS-SA-2022-0055)	Nessus	NewStart CGSL Local Security Checks	2022/5/10	2022/5/10	high
184771	Rocky Linux 8 : systemd (RLSA-2021:1611)	Nessus	Rocky Linux Local Security Checks	2023/11/6	2023/12/22	high
149692	RHEL 8 : systemd (RHSA-2021:1611)	Nessus	Red Hat Local Security Checks	2021/5/19	2025/9/10	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

high

high