According to the versions of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an 'INPUTRC' environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4. (CVE-2022-0563)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an 'INPUTRC' environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4.(CVE-2022-0563)

Tenable has extracted the preceding description block directly from the EulerOS util-linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the util package has been released.

According to the versions of the util-linux package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an 'INPUTRC' environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4. (CVE-2022-0563)

  - A logical error was found in util-linux's libmount library in a function that allows unprivileged users to     unmount FUSE filesystems. Incorrect uid checking allows unprivileged users to unmount FUSE filesystems     with similar uid users, an attacker could exploit this vulnerability to cause a denial of (CVE-2021-3995)

  - that allows unprivileged users to unmount FUSE filesystems. Issues related to parsing the     /proc/self/mountinfo file allow unprivileged users to unmount other users' filesystems that are themselves     world-writable (such as /tmp) or mounted in a world-writable directory. An attacker could exploit this     (CVE-2021-3996)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the util-linux packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an 'INPUTRC' environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4. (CVE-2022-0563)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-099 advisory.

    A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE     filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker     in its string form. An attacker may use this flaw to cause a denial of service to applications that use     the affected filesystems. (CVE-2021-3995)

    A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other     users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable     directory. An attacker may use this flaw to cause a denial of service to applications that use the     affected filesystems. (CVE-2021-3996)

    A flaw was found in the Linux kernel's util-linux chfn and chsh utilities when compiled with Readline     support. The Readline library uses an INPUTRC environment variable to get a path to the library config     file. When the library cannot parse the specified file, it prints an error message containing data from     the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege     escalation. (CVE-2022-0563)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
162251	EulerOS 2.0 SP9 : util-linux (EulerOS-SA-2022-1879)	Nessus	Huawei Local Security Checks	2022/6/15	2022/6/15	medium
198169	EulerOS 2.0 SP12 : util-linux (EulerOS-SA-2024-1780)	Nessus	Huawei Local Security Checks	2024/5/30	2024/5/30	medium
203796	Photon OS 3.0: Util PHSA-2022-3.0-0375	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	medium
163197	EulerOS Virtualization 2.10.0 : util-linux (EulerOS-SA-2022-2041)	Nessus	Huawei Local Security Checks	2022/7/15	2023/10/18	medium
163600	EulerOS Virtualization 2.9.1 : util-linux (EulerOS-SA-2022-2192)	Nessus	Huawei Local Security Checks	2022/7/29	2022/7/29	medium
163625	EulerOS Virtualization 2.9.0 : util-linux (EulerOS-SA-2022-2211)	Nessus	Huawei Local Security Checks	2022/7/29	2022/7/29	medium
165925	EulerOS Virtualization 3.0.6.0 : util-linux (EulerOS-SA-2022-2593)	Nessus	Huawei Local Security Checks	2022/10/10	2022/10/10	medium
164772	Amazon Linux 2022 : libblkid, libblkid-devel, libfdisk (ALAS2022-2022-099)	Nessus	Amazon Linux Local Security Checks	2022/9/6	2024/12/11	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium