The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:1723 advisory.

    The sudo packages contain the sudo utility which allows system administrators to provide certain users     with the permission to execute privileged commands, which are used for system management purposes, without     having to log in as root.

    Security Fix(es):

    * sudo: symbolic link attack in SELinux-enabled sudoedit (CVE-2021-23240)

    * sudo: possible directory existence test due to race condition in sudoedit (CVE-2021-23239)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the sudo package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A race condition vulnerability was found in the     temporary file handling of sudoedit's SELinux RBAC     support. On systems where SELinux is enabled, this flaw     allows a malicious user with sudoedit permissions to     set the owner of an arbitrary file to the user ID of     the target user, potentially leading to local privilege     escalation. The highest threat from this vulnerability     is to confidentiality, integrity, as well as system     availability.(CVE-2021-23240)

  - A flaw was found in sudoedit. A race condition     vulnerability and improper symbolic link resolution     could be used by a local unprivileged user to test for     the existence of directories and files not normally     accessible to the user. This flaw cannot be used to     read the content or write to arbitrary files on the     file system. The highest threat from this vulnerability     is to data confidentiality.(CVE-2021-23239)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202101-33 (sudo: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in sudo. Please review the       CVE identifiers referenced below for details.
  Impact :

    Local users are able to gain unauthorized privileges on the system or       determine the existence of files.
  Workaround :

    There is no known workaround at this time.

This update for sudo fixes the following issues :

A Heap-based buffer overflow in sudo could be exploited to allow a user to gain root privileges [bsc#1181090,CVE-2021-3156]

It was possible for a user to test for the existence of a directory due to a Race Condition in `sudoedit` [bsc#1180684,CVE-2021-23239]

A Possible Symlink Attack vector existed in `sudoedit` if SELinux was running in permissive mode [bsc#1180685, CVE-2021-23240]

It was possible for a User to enable Debug Settings not Intended for them [bsc#1180687]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sudo fixes the following issues :

A Heap-based buffer overflow in sudo could be exploited to allow a user to gain root privileges [bsc#1181090,CVE-2021-3156]

It was possible for a user to test for the existence of a directory due to a Race Condition in `sudoedit` [bsc#1180684,CVE-2021-23239]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The sudoedit personality of Sudo before 1.9.5 may allow     a local unprivileged user to perform arbitrary     directory-existence tests by winning a sudo_edit.c race     condition in replacing a user-controlled directory by a     symlink to an arbitrary path.(CVE-2021-23239)

  - Sudo before 1.9.5p2 has a Heap-based Buffer Overflow,     allowing privilege escalation to root via 'sudoedit -s'     and a command-line argument that ends with a single     backslash character.(CVE-2021-3156)

  - selinux_edit_copy_tfiles in sudoedit in Sudo before     1.9.5 allows a local unprivileged user to gain file     ownership and escalate privileges by replacing a     temporary file with a symlink to an arbitrary file     target. This affects SELinux RBAC support in permissive     mode. Machines without SELinux are not     vulnerable.(CVE-2021-23240)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the sudo package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - selinux_edit_copy_tfiles in sudoedit in Sudo before     1.9.5 allows a local unprivileged user to gain file     ownership and escalate privileges by replacing a     temporary file with a symlink to an arbitrary file     target. This affects SELinux RBAC support in permissive     mode. Machines without SELinux are not     vulnerable.(CVE-2021-23240)

  - The sudoedit personality of Sudo before 1.9.5 may allow     a local unprivileged user to perform arbitrary     directory-existence tests by winning a sudo_edit.c race     condition in replacing a user-controlled directory by a     symlink to an arbitrary path.(CVE-2021-23239)

  - Sudo before 1.9.5p2 has a Heap-based Buffer Overflow,     allowing privilege escalation to root via 'sudoedit -s'     and a command-line argument that ends with a single     backslash character.(CVE-2021-3156)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - selinux_edit_copy_tfiles in sudoedit in Sudo before     1.9.5 allows a local unprivileged user to gain file     ownership and escalate privileges by replacing a     temporary file with a symlink to an arbitrary file     target. This affects SELinux RBAC support in permissive     mode. Machines without SELinux are not     vulnerable.(CVE-2021-23240)

  - The sudoedit personality of Sudo before 1.9.5 may allow     a local unprivileged user to perform arbitrary     directory-existence tests by winning a sudo_edit.c race     condition in replacing a user-controlled directory by a     symlink to an arbitrary path.(CVE-2021-23239)

  - Sudo before 1.9.5p2 has a Heap-based Buffer Overflow,     allowing privilege escalation to root via 'sudoedit -s'     and a command-line argument that ends with a single     backslash character.(CVE-2021-3156)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
149683	RHEL 8 : sudo (RHSA-2021:1723)	Nessus	Red Hat Local Security Checks	2021/5/19	2024/6/3	high
148592	EulerOS Virtualization 2.9.0 : sudo (EulerOS-SA-2021-1757)	Nessus	Huawei Local Security Checks	2021/4/15	2024/1/4	high
145477	GLSA-202101-33 : sudo: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2021/1/27	2023/1/12	high
145479	SUSE SLES12 Security Update : sudo (SUSE-SU-2021:0225-1)	Nessus	SuSE Local Security Checks	2021/1/27	2023/1/18	high
145520	SUSE SLES12 Security Update : sudo (SUSE-SU-2021:0232-1)	Nessus	SuSE Local Security Checks	2021/1/28	2023/1/18	high
146251	EulerOS 2.0 SP9 : sudo (EulerOS-SA-2021-1276)	Nessus	Huawei Local Security Checks	2021/2/5	2023/1/18	high
147547	EulerOS Virtualization 3.0.2.6 : sudo (EulerOS-SA-2021-1424)	Nessus	Huawei Local Security Checks	2021/3/10	2023/1/18	high
148081	EulerOS 2.0 SP5 : sudo (EulerOS-SA-2021-1707)	Nessus	Huawei Local Security Checks	2021/3/24	2023/1/18	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high