Race condition in GNU nano before 2.2.4, when run by root to edit a file that is not owned by root, allows local user-assisted attackers to change the ownership of arbitrary files via vectors related to the creation of backup files.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - nano: multiple file editing insecurities (CVE-2010-1160, CVE-2010-1161)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - nano: multiple file editing insecurities (CVE-2010-1160, CVE-2010-1161)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 3 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - nano: multiple file editing insecurities (CVE-2010-1160, CVE-2010-1161)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

CVE-2010-1160 CVE-2010-1161

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201006-08 (nano: Multiple vulnerabilities)

    Multiple race condition vulnerabilities have been discovered in nano.
    For further information please consult the CVE entries referenced     below.
  Impact :

    Under certain conditions, a local, user-assisted attacker could     possibly overwrite arbitrary files via a symlink attack on an     attacker-owned file that is being edited by the victim, or change the     ownership of arbitrary files.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
198444	RHEL 4 : nano (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
198367	RHEL 5 : nano (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
198355	RHEL 3 : nano (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
49153	Fedora 12 : nano-2.0.9-7.fc12 (2010-13157)	Nessus	Fedora Local Security Checks	low
47452	Fedora 11 : nano-2.0.9-1.fc11 (2010-6776)	Nessus	Fedora Local Security Checks	low
47451	Fedora 12 : nano-2.0.9-6.fc12 (2010-6775)	Nessus	Fedora Local Security Checks	low
47447	Fedora 13 : nano-2.2.4-1.fc13 (2010-6735)	Nessus	Fedora Local Security Checks	low
46775	GLSA-201006-08 : nano: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	low

Detections

Analytics

CVE-2010-1161

critical

Tenable Plugins

medium

medium

medium

low

low

low

low

low