The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - fuseiso: Stack-based buffer overflow when scanning directory structure for absolute path entries     (CVE-2015-8837)

  - Integer overflow in the isofs_real_read_zf function in isofs.c in FuseISO 20070708 might allow remote     attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a     large ZF block size in an ISO file, leading to a heap-based buffer overflow. (CVE-2015-8836)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote host is affected by the vulnerability described in GLSA-202007-20 (fuseiso: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in fuseiso. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted ISO       file using fuseiso, possibly resulting in execution of arbitrary code       with the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

According to the versions of the fuseiso package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Integer overflow in the isofs_real_read_zf function in isofs.c in FuseISO 20070708 might allow remote     attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a     large ZF block size in an ISO file, leading to a heap-based buffer overflow. (CVE-2015-8836)

  - Stack-based buffer overflow in the isofs_real_readdir function in isofs.c in FuseISO 20070708 allows     remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a     long pathname in an ISO file. (CVE-2015-8837)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

FUSE をベースにしている ISO 9660 ファイルシステムのユーザー空間実装である fuseiso に、いくつかの脆弱性があることが判明しました。

- CVE-2015-8836 スタックベースのバッファオーバーフローにより、ユーザーを騙して細工された ISO 9660 ファイルシステムをマウントさせることのできる攻撃者が、サービス拒否（クラッシュ）を引き起こし、任意のコードを実行することが可能です。

- CVE-2015-8837 ヒープベースのバッファオーバーフローにつながる整数オーバーフローにより、（ユーザーを騙して細工された ISO 9660 ファイルシステムをマウントさせることのできる）攻撃者が、サービス拒否（クラッシュ）を引き起こし、任意のコードを実行することが可能です。

It was discovered that fuseiso, a user-space implementation of the ISO 9660 file system based on FUSE, contains several vulnerabilities.

  - CVE-2015-8836     A stack-based buffer overflow may allow attackers who     can trick a user into mounting a crafted ISO 9660 file     system to cause a denial of service (crash), or,     potentially, execute arbitrary code.

  - CVE-2015-8837     An integer overflow leads to a heap-based buffer     overflow, which allows an attacker (who can trick a user     into mounting a crafted ISO 9660 file system) to cause a     denial of service (crash), or, potentially, execute     arbitrary code.

远程主机受到 GLSA-202007-20 中所述漏洞的影响（fuseiso：多个漏洞）

    在 fuseiso 中发现多个漏洞。请检查下方引用的 CVE 标识符以了解详细信息。
  影响：

    远程攻击者可引诱用户使用 fuseiso 打开特别构建的 ISO 文件，这可能导致以进程权限执行任意代码或拒绝服务情况。
  变通方案：

    目前无任何已知的变通方案。

已发现 fuseiso（基于 FUSE 的 ISO 9660 文件系统的用户空间实现）中包含多个漏洞。

- CVE-2015-8836 攻击者如能诱骗用户挂载特别构建的 ISO 9660 文件系统，即可利用基于堆栈的缓冲区溢出造成拒绝服务（崩溃），或可能执行任意代码。

- CVE-2015-8837 整数溢出会导致基于堆的缓冲区溢出，攻击者如能诱骗用户挂载特别构建的 ISO 9660 文件系统，即可利用所述缓冲区溢出造成拒绝服务（崩溃），或可能执行任意代码。

據發現，fuseiso (以 FUSE 為基礎的 ISO 9660 檔案系統的使用者空間實作) 中含有數個弱點。

- CVE-2015-8836 堆疊型緩衝區溢位問題可能會允許可誘騙使用者掛載特製 ISO 9660 檔案系統的攻擊者造成拒絕服務 (當機)，或可能執行任意程式碼。

- CVE-2015-8837 整數溢位問題會導致堆積型緩衝區溢位，這可讓攻擊者 (可誘騙使用者掛載特製 ISO 9660 檔案系統) 造成拒絕服務 (當機)，或可能執行任意程式碼。

遠端主機受到 GLSA-202007-20 中所述的弱點影響 (fuseiso：多個弱點)

    已在 fuseiso 中發現多個弱點。如需詳細資訊，請檢閱下方提及的 CVE 識別碼。
  影響：

    遠端攻擊者可引誘使用者開啟使用 fuseiso 的特製 ISO 檔案，可能藉此以處理程序的權限來執行任意程式碼，或導致拒絕服務情形。
  因應措施：

    目前尚無已知的因應措施。

ID	名稱	產品	系列	已發布	已更新	嚴重性
199590	RHEL 7 : fuseiso (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	high
138943	GLSA-202007-20 : fuseiso: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2020/7/27	2024/2/28	high
159094	EulerOS 2.0 SP5 : fuseiso (EulerOS-SA-2022-1319)	Nessus	Huawei Local Security Checks	2022/3/21	2023/11/3	high
90551	Debian DSA-3551-1：fuseiso - セキュリティ更新	Nessus	Debian Local Security Checks	2016/4/18	2021/1/11	high
161567	EulerOS 2.0 SP3 : fuseiso (EulerOS-SA-2022-1719)	Nessus	Huawei Local Security Checks	2022/5/26	2023/10/26	high
90551	Debian DSA-3551-1 : fuseiso - security update	Nessus	Debian Local Security Checks	2016/4/18	2021/1/11	high
138943	GLSA-202007-20 ：fuseiso：多个漏洞	Nessus	Gentoo Local Security Checks	2020/7/27	2024/2/28	high
90551	Debian DSA-3551-1：fuseiso - 安全更新	Nessus	Debian Local Security Checks	2016/4/18	2021/1/11	high
90551	Debian DSA-3551-1：fuseiso - 安全性更新	Nessus	Debian Local Security Checks	2016/4/18	2021/1/11	high
138943	GLSA-202007-20 : fuseiso：多個弱點	Nessus	Gentoo Local Security Checks	2020/7/27	2024/2/28	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high