- 最新の開発バージョン1.9.0b1に更新してください

  - sudo_logsrvdおよびsudo_sendlogをファイルおよび適切なmanページに追加しました。解決： rhbz#1787823

  - pwfeedbackが有効な場合のスタックベースのバッファオーバーフロー。解決： rhbz#1796945

  - 次を修正します： CVE-2019-18634 

  - パスワードハッシュの代わりにシャドウファイルの！文字を使うと、すべてのsudoerアカウントにアクセスして実行できます。解決： rhbz#1786709

  - CVE-2019-19234を修正します

  - Runas ALL sudoerアカウントへのアクセス権を持つ攻撃者が、存在しないユーザーになりすます可能性があります。解決： rhbz#1786705

  - CVE-2019-19232を修正します

  - setrlimit（RLIMIT_CORE）：操作が許可されない警告メッセージの修正。解決： rhbz#1773148

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

リモートの Redhat Enterprise Linux 8 ホストにインストールされているパッケージは、RHSA-2020: 1804のアドバイザリに記載されている複数の脆弱性の影響を受けます。

  - sudo: Runas ALL sudoerアカウントへのアクセス権を持つ攻撃者が、存在しないユーザーになりすます可能性があります（CVE-2019-19232）

  - sudo：パスワードハッシュの代わりにシャドーファイルで!文字を使用することで、run as all sudoerアカウントにアクセスできる（CVE-2019-19234）

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

遠端 Redhat Enterprise Linux 8 主機上安裝的套件受到 RHSA-2020: 1804 公告中提及的弱點影響。

  - sudo：如果攻擊者具有 Runas ALL sudoer 帳戶存取權，則可模擬不存在的使用者 (CVE-2019-19232)

  - sudo：使用遮蔽檔案中的 ! 字元 (而非密碼雜湊) 可作為所有 sudoer 帳戶存取執行 (CVE-2019-19234)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程 Redhat Enterprise Linux 8 主机上安装的程序包受到 RHSA-2020: 1804 公告中提及的多个漏洞影响。

  - sudo：如果攻击者具有 Runas ALL sudoer 帐户访问权限，则可冒充不存在的用户 (CVE-2019-19232)

  - sudo：通过使用影子文件中的 ! 字符（而非密码哈希）可访问 run as all sudoer 帐户 (CVE-2019-19234)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

An update of the sudo package has been released.

According to the versions of the sudo package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - ** DISPUTED ** In Sudo through 1.8.29, the fact that a     user has been blocked (e.g., by using the ! character     in the shadow file instead of a password hash) is not     considered, allowing an attacker (who has access to a     Runas ALL sudoer account) to impersonate any blocked     user. NOTE: The software maintainer believes that this     CVE is not valid. Disabling local password     authentication for a user is not the same as disabling     all access to that user--the user may still be able to     login via other means (ssh key, kerberos, etc). Both     the Linux shadow(5) and passwd(1) manuals are clear on     this. Indeed it is a valid use case to have local     accounts that are _only_ accessible via sudo and that     cannot be logged into with a password. Sudo 1.8.30     added an optional setting to check the _shell_ of the     target user (not the encrypted password!) against the     contents of /etc/shells but that is not the same thing     as preventing access to users with an invalid password     hash.(CVE-2019-19234)

  - ** DISPUTED ** In Sudo through 1.8.29, an attacker with     access to a Runas ALL sudoer account can impersonate a     nonexistent user by invoking sudo with a numeric uid     that is not associated with any user. NOTE: The     software maintainer believes that this is not a     vulnerability because running a command via sudo as a     user not present in the local password database is an     intentional feature. Because this behavior surprised     some users, sudo 1.8.30 introduced an option to     enable/disable this behavior with the default being     disabled. However, this does not change the fact that     sudo was behaving as intended, and as documented, in     earlier versions.(CVE-2019-19232)

  - In Sudo before 1.8.26, if pwfeedback is enabled in     /etc/sudoers, users can trigger a stack-based buffer     overflow in the privileged sudo process. (pwfeedback is     a default setting in Linux Mint and elementary OS     however, it is NOT the default for upstream and many     other packages, and would exist only if enabled by an     administrator.) The attacker needs to deliver a long     string to the stdin of getln() in     tgetpass.c.(CVE-2019-18634)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - ** DISPUTED ** In Sudo through 1.8.29, an attacker with     access to a Runas ALL sudoer account can impersonate a     nonexistent user by invoking sudo with a numeric uid     that is not associated with any user. NOTE: The     software maintainer believes that this is not a     vulnerability because running a command via sudo as a     user not present in the local password database is an     intentional feature. Because this behavior surprised     some users, sudo 1.8.30 introduced an option to     enable/disable this behavior with the default being     disabled. However, this does not change the fact that     sudo was behaving as intended, and as documented, in     earlier versions.(CVE-2019-19232)

  - ** DISPUTED ** In Sudo through 1.8.29, the fact that a     user has been blocked (e.g., by using the ! character     in the shadow file instead of a password hash) is not     considered, allowing an attacker (who has access to a     Runas ALL sudoer account) to impersonate any blocked     user. NOTE: The software maintainer believes that this     CVE is not valid. Disabling local password     authentication for a user is not the same as disabling     all access to that user--the user may still be able to     login via other means (ssh key, kerberos, etc). Both     the Linux shadow(5) and passwd(1) manuals are clear on     this. Indeed it is a valid use case to have local     accounts that are _only_ accessible via sudo and that     cannot be logged into with a password. Sudo 1.8.30     added an optional setting to check the _shell_ of the     target user (not the encrypted password!) against the     contents of /etc/shells but that is not the same thing     as preventing access to users with an invalid password     hash.(CVE-2019-19234)

  - In Sudo before 1.8.26, if pwfeedback is enabled in     /etc/sudoers, users can trigger a stack-based buffer     overflow in the privileged sudo process. (pwfeedback is     a default setting in Linux Mint and elementary OS     however, it is NOT the default for upstream and many     other packages, and would exist only if enabled by an     administrator.) The attacker needs to deliver a long     string to the stdin of getln() in     tgetpass.c.(CVE-2019-18634)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sudo: noexec bypass via wordexp() (CVE-2016-7076)

  - sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file,     which allows local users to open arbitrary files for read access (but not view file contents) by running a     program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log     messages, or repositioning tape drives. (CVE-2014-9680)

  - sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose     full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by /home/*/*/file.txt.
    (CVE-2015-5602)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the sudo package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In PHP before 5.6.28 and 7.x before 7.0.13, incorrect     handling of various URI components in the URL parser     could be used by attackers to bypass hostname-specific     URL checks, as demonstrated by     evil.example.com:80#@good.example.com/ and     evil.example.com:80?@good.example.com/ inputs to the     parse_url function (implemented in the php_url_parse_ex     function in ext/standard/url.c).(CVE-2019-19234)

  - In Sudo through 1.8.29, the fact that a user has been     blocked (e.g., by using the ! character in the shadow     file instead of a password hash) is not considered,     allowing an attacker (who has access to a Runas ALL     sudoer account) to impersonate any blocked     user.(CVE-2019-19232)

  - In Sudo before 1.8.26, if pwfeedback is enabled in     /etc/sudoers, users can trigger a stack-based buffer     overflow in the privileged sudo process. (pwfeedback is     a default setting in Linux Mint and elementary OS     however, it is NOT the default for upstream and many     other packages, and would exist only if enabled by an     administrator.) The attacker needs to deliver a long     string to the stdin of getln() in     tgetpass.c.(CVE-2019-18634)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1804 advisory.

    The sudo packages contain the sudo utility which allows system administrators to provide certain users     with the permission to execute privileged commands, which are used for system management purposes, without     having to log in as root.

    The following packages have been upgraded to a later upstream version: sudo (1.8.29). (BZ#1733961)

    Security Fix(es):

    * sudo: attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user     (CVE-2019-19232)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Sudo before 1.8.26, if pwfeedback is enabled in     /etc/sudoers, users can trigger a stack-based buffer     overflow in the privileged sudo process. (pwfeedback is     a default setting in Linux Mint and elementary OS     however, it is NOT the default for upstream and many     other packages, and would exist only if enabled by an     administrator.) The attacker needs to deliver a long     string to the stdin of getln() in     tgetpass.c.(CVE-2019-18634)

  - ** DISPUTED ** In Sudo through 1.8.29, an attacker with     access to a Runas ALL sudoer account can impersonate a     nonexistent user by invoking sudo with a numeric uid     that is not associated with any user. NOTE: The     software maintainer believes that this is not a     vulnerability because running a command via sudo as a     user not present in the local password database is an     intentional feature. Because this behavior surprised     some users, sudo 1.8.30 introduced an option to     enable/disable this behavior with the default being     disabled. However, this does not change the fact that     sudo was behaving as intended, and as documented, in     earlier versions.(CVE-2019-19232)

  - ** DISPUTED ** In Sudo through 1.8.29, the fact that a     user has been blocked (e.g., by using the ! character     in the shadow file instead of a password hash) is not     considered, allowing an attacker (who has access to a     Runas ALL sudoer account) to impersonate any blocked     user. NOTE: The software maintainer believes that this     CVE is not valid. Disabling local password     authentication for a user is not the same as disabling     all access to that user--the user may still be able to     login via other means (ssh key, kerberos, etc). Both     the Linux shadow(5) and passwd(1) manuals are clear on     this. Indeed it is a valid use case to have local     accounts that are _only_ accessible via sudo and that     cannot be logged into with a password. Sudo 1.8.30     added an optional setting to check the _shell_ of the     target user (not the encrypted password!) against the     contents of /etc/shells but that is not the same thing     as preventing access to users with an invalid password     hash.(CVE-2019-19234)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- update to latest development version 1.9.0b1

  - added sudo_logsrvd and sudo_sendlog to files and their     appropriate man pages Resolves: rhbz#1787823

  - Stack based buffer overflow in when pwfeedback is     enabled Resolves: rhbz#1796945

  - fixes: CVE-2019-18634 

  - By using ! character in the shadow file instead of a     password hash can access to a run as all sudoer account     Resolves: rhbz#1786709

  - fixes CVE-2019-19234

  - attacker with access to a Runas ALL sudoer account can     impersonate a nonexistent user Resolves: rhbz#1786705

  - fixes CVE-2019-19232

  - setrlimit(RLIMIT_CORE): Operation not permitted warning     message fix Resolves: rhbz#1773148

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the sudo package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - ** DISPUTED ** In Sudo through 1.8.29, the fact that a     user has been blocked (e.g., by using the ! character     in the shadow file instead of a password hash) is not     considered, allowing an attacker (who has access to a     Runas ALL sudoer account) to impersonate any blocked     user. NOTE: The software maintainer believes that this     CVE is not valid. Disabling local password     authentication for a user is not the same as disabling     all access to that user--the user may still be able to     login via other means (ssh key, kerberos, etc). Both     the Linux shadow(5) and passwd(1) manuals are clear on     this. Indeed it is a valid use case to have local     accounts that are _only_ accessible via sudo and that     cannot be logged into with a password. Sudo 1.8.30     added an optional setting to check the _shell_ of the     target user (not the encrypted password!) against the     contents of /etc/shells but that is not the same thing     as preventing access to users with an invalid password     hash.(CVE-2019-19234)

  - ** DISPUTED ** In Sudo through 1.8.29, an attacker with     access to a Runas ALL sudoer account can impersonate a     nonexistent user by invoking sudo with a numeric uid     that is not associated with any user. NOTE: The     software maintainer believes that this is not a     vulnerability because running a command via sudo as a     user not present in the local password database is an     intentional feature. Because this behavior surprised     some users, sudo 1.8.30 introduced an option to     enable/disable this behavior with the default being     disabled. However, this does not change the fact that     sudo was behaving as intended, and as documented, in     earlier versions.(CVE-2019-19232)

  - In Sudo before 1.8.26, if pwfeedback is enabled in     /etc/sudoers, users can trigger a stack-based buffer     overflow in the privileged sudo process. (pwfeedback is     a default setting in Linux Mint and elementary OS     however, it is NOT the default for upstream and many     other packages, and would exist only if enabled by an     administrator.) The attacker needs to deliver a long     string to the stdin of getln() in     tgetpass.c.(CVE-2019-18634)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the sudo package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In Sudo before 1.8.26, if pwfeedback is enabled in     /etc/sudoers, users can trigger a stack-based buffer     overflow in the privileged sudo process. (pwfeedback is     a default setting in Linux Mint and elementary OS     however, it is NOT the default for upstream and many     other packages, and would exist only if enabled by an     administrator.) The attacker needs to deliver a long     string to the stdin of getln() in     tgetpass.c.(CVE-2019-18634)

  - In Sudo through 1.8.29, an attacker with access to a     Runas ALL sudoer account can impersonate a nonexistent     user by invoking sudo with a numeric uid that is not     associated with any user.(CVE-2019-19232)

  - In Sudo through 1.8.29, the fact that a user has been     blocked (e.g., by using the ! character in the shadow     file instead of a password hash) is not considered,     allowing an attacker (who has access to a Runas ALL     sudoer account) to impersonate any blocked     user.(CVE-2019-19234)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Sudo through 1.8.29, an attacker with access to a     Runas ALL sudoer account can impersonate a nonexistent     user by invoking sudo with a numeric uid that is not     associated with any user. NOTE: The software maintainer     believes that this is not a vulnerability because     running a command via sudo as a user not present in the     local password database is an intentional feature.
    Because this behavior surprised some users, sudo 1.8.30     introduced an option to enable/disable this behavior     with the default being disabled. However, this does not     change the fact that sudo was behaving as intended, and     as documented, in earlier versions.(CVE-2019-19232)

  - In Sudo through 1.8.29, the fact that a user has been     blocked (e.g., by using the ! character in the shadow     file instead of a password hash) is not considered,     allowing an attacker (who has access to a Runas ALL     sudoer account) to impersonate any blocked user. NOTE:
    The software maintainer believes that this CVE is not     valid. Disabling local password authentication for a     user is not the same as disabling all access to that     user--the user may still be able to login via other     means (ssh key, kerberos, etc). Both the Linux     shadow(5) and passwd(1) manuals are clear on this.
    Indeed it is a valid use case to have local accounts     that are _only_ accessible via sudo and that cannot be     logged into with a password. Sudo 1.8.30 added an     optional setting to check the _shell_ of the target     user (not the encrypted password!) against the contents     of /etc/shells but that is not the same thing as     preventing access to users with an invalid password     hash.(CVE-2019-19234)

  - In Sudo before 1.8.26, if pwfeedback is enabled in     /etc/sudoers, users can trigger a stack-based buffer     overflow in the privileged sudo process. (pwfeedback is     a default setting in Linux Mint and elementary OS     however, it is NOT the default for upstream and many     other packages, and would exist only if enabled by an     administrator.) The attacker needs to deliver a long     string to the stdin of getln() in     tgetpass.c.(CVE-2019-18634)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sudo: Unauthorized privilege escalation in sudoedit (CVE-2015-5602)

  - sudo: by using ! character in the shadow file instead of a password hash can access to a run as all sudoer     account (CVE-2019-19234)

  - The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write     permissions to parts of the called command to replace them before it is executed. (CVE-2015-8239)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sudo: Unauthorized privilege escalation in sudoedit (CVE-2015-5602)

  - sudo: by using ! character in the shadow file instead of a password hash can access to a run as all sudoer     account (CVE-2019-19234)

  - sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other     Linux implementations preserves the value of INPUTRC which could lead to information disclosure. A local     user with sudo access to a restricted program that uses readline could use this flaw to read content from     specially formatted files with elevated privileges provided by sudo. (CVE-2016-7091)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	名稱	產品	系列	已發布	已更新	嚴重性
134253	Fedora 31：sudo（2020-8b563bc5f4）	Nessus	Fedora Local Security Checks	2020/3/6	2024/3/25	high
143004	RHEL 8：sudo（RHSA-2020: 1804)	Nessus	Red Hat Local Security Checks	2020/11/18	2024/6/4	high
143004	RHEL 8：sudo (RHSA-2020: 1804)	Nessus	Red Hat Local Security Checks	2020/11/18	2024/6/4	high
143004	RHEL 8：sudo (RHSA-2020: 1804)	Nessus	Red Hat Local Security Checks	2020/11/18	2024/6/4	high
132985	Photon OS 1.0: Sudo PHSA-2020-1.0-0264	Nessus	PhotonOS Local Security Checks	2020/1/16	2020/1/18	high
135136	EulerOS Virtualization for ARM 64 3.0.6.0 : sudo (EulerOS-SA-2020-1349)	Nessus	Huawei Local Security Checks	2020/4/2	2022/5/13	high
133936	EulerOS 2.0 SP5 : sudo (EulerOS-SA-2020-1135)	Nessus	Huawei Local Security Checks	2020/2/24	2022/5/18	high
198848	RHEL 5 : sudo (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	high
136267	EulerOS Virtualization for ARM 64 3.0.2.0 : sudo (EulerOS-SA-2020-1564)	Nessus	Huawei Local Security Checks	2020/5/1	2022/5/13	high
143004	RHEL 8 : sudo (RHSA-2020:1804)	Nessus	Red Hat Local Security Checks	2020/11/18	2024/6/4	high
134015	EulerOS 2.0 SP8 : sudo (EulerOS-SA-2020-1181)	Nessus	Huawei Local Security Checks	2020/2/25	2022/5/18	high
134253	Fedora 31 : sudo (2020-8b563bc5f4)	Nessus	Fedora Local Security Checks	2020/3/6	2024/3/25	high
137504	EulerOS 2.0 SP2 : sudo (EulerOS-SA-2020-1662)	Nessus	Huawei Local Security Checks	2020/6/17	2022/5/13	high
138004	EulerOS Virtualization 3.0.6.0 : sudo (EulerOS-SA-2020-1785)	Nessus	Huawei Local Security Checks	2020/7/1	2022/5/12	high
141722	EulerOS Virtualization 3.0.2.2 : sudo (EulerOS-SA-2020-2196)	Nessus	Huawei Local Security Checks	2020/10/21	2022/5/11	high
135564	EulerOS 2.0 SP3 : sudo (EulerOS-SA-2020-1435)	Nessus	Huawei Local Security Checks	2020/4/15	2022/5/13	high
198754	RHEL 7 : sudo (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	high
198797	RHEL 6 : sudo (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high