The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0441-1 advisory.

  - A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory     corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and     size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and     escalate their privileges on the system. (CVE-2021-3999)

  - The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its path argument on the stack without validating its length, which may result in a     buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23218)

  - The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its hostname argument on the stack without validating its length, which may result in     a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23219)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0330-1 advisory.

  - A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory     corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and     size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and     escalate their privileges on the system. (CVE-2021-3999)

  - The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its path argument on the stack without validating its length, which may result in a     buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23218)

  - The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its hostname argument on the stack without validating its length, which may result in     a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23219)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0330-1 advisory.

  - The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its hostname argument on the stack without validating its length, which may result in     a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23219)

  - A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory     corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and     size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and     escalate their privileges on the system. (CVE-2021-3999)

  - The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its path argument on the stack without validating its length, which may result in a     buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23218)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the glibc package has been released.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5310-1 advisory.

    Jan Engelhardt, Tavis Ormandy, and others discovered that the GNU C Library iconv feature incorrectly     handled certain input sequences. An attacker could possibly use this issue to cause the GNU C Library to     hang or crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu     20.04 LTS. (CVE-2016-10228, CVE-2019-25013, CVE-2020-27618, CVE-2020-29562, CVE-2021-3326)

    Jason Royes and Samuel Dytrych discovered that the GNU C Library incorrectly handled signed comparisons on     ARMv7 targets. A remote attacker could use this issue to cause the GNU C Library to crash, resulting in a     denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and     Ubuntu 20.04 LTS. (CVE-2020-6096)

    It was discovered that the GNU C Library nscd daemon incorrectly handled certain netgroup lookups. An     attacker could possibly use this issue to cause the GNU C Library to crash, resulting in a denial of     service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-27645)

    It was discovered that the GNU C Library wordexp function incorrectly handled certain patterns. An     attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or     possibly obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
    (CVE-2021-35942)

    It was discovered that the GNU C Library realpath function incorrectly handled return values. An attacker     could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 21.10.
    (CVE-2021-3998)

    It was discovered that the GNU C library getcwd function incorrectly handled buffers. An attacker could     use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2021-3999)

    It was discovered that the GNU C Library sunrpc module incorrectly handled buffer lengths. An attacker     could possibly use this issue to cause the GNU C Library to crash, resulting in a denial of service.
    (CVE-2022-23218, CVE-2022-23219)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	名稱	產品	系列	已發布	已更新	嚴重性
158126	SUSE SLES12 Security Update : glibc (SUSE-SU-2022:0441-1)	Nessus	SuSE Local Security Checks	2022/2/17	2023/7/13	critical
157391	SUSE SLED15 / SLES15 Security Update : glibc (SUSE-SU-2022:0330-1)	Nessus	SuSE Local Security Checks	2022/2/5	2023/7/13	critical
157399	openSUSE 15 Security Update : glibc (openSUSE-SU-2022:0330-1)	Nessus	SuSE Local Security Checks	2022/2/5	2023/11/17	critical
203392	Photon OS 4.0: Glibc PHSA-2022-4.0-0155	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	critical
158502	Ubuntu 18.04 LTS / 20.04 LTS : GNU C Library vulnerabilities (USN-5310-1)	Nessus	Ubuntu Local Security Checks	2022/3/1	2024/8/29	critical
502985	Siemens SIMATIC S7-1500 TM MFP BIOS Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CVE-2022-23219)	Tenable OT Security	Tenable.ot	2025/2/25	2025/2/26	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical