The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite arbitrary files via a symlink attack on a /var/tmp/rltrace.[PID] file.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - readline: insecure temporary file use in _rl_tropen() (CVE-2014-2524)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

Updated readline packages fix security vulnerability :

Steve Kemp discovered the _rl_tropen() function in readline insecurely handled a temporary file. This could allow a local attacker to perform symbolic link attacks (CVE-2014-2524).

Also, upstream patches have been added to fix an infinite loop in vi input mode, and to fix an issue with slowness when pasting text.

bash was updated to fix a critical security issue, a minor security issue and bugs :

In some circumstances, the shell would evaluate shellcode in environment variables passed at startup time. This allowed code execution by local or remote attackers who could pass environment variables to bash scripts. (CVE-2014-6271)

Fixed a temporary file misuse in _rl_tropen (bnc#868822) Even if used only by developers to debug readline library do not open temporary files from public location without O_EXCL (CVE-2014-2524)

Additional bugfixes :

  - Backported corrected german error message for a failing     getpwd (bnc#895475)

  - Add bash upstream patch 47 to fix a problem where the     function that shortens pathnames for $PS1 according to     the value of $PROMPT_DIRTRIM uses memcpy on     potentially-overlapping regions of memory, when it     should use memmove. The result is garbled pathnames in     prompt strings.

  - Add bash upstream patch 46 to fix a problem introduced     by patch 32 a problem with '$@' and arrays expanding     empty positional parameters or array elements when using     substring expansion, pattern substitution, or case     modfication. The empty parameters or array elements are     removed instead of expanding to empty strings ('').

  - Add bash-4.2-strcpy.patch from upstream mailing list to     patch collection tar ball to avoid when using \w in the     prompt and changing the directory outside of HOME the a     strcpy work on overlapping memory areas.

readline in Fedora is very slow when rl_event_hook is used, this update fix it. Security patch for debug functions

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199523	RHEL 6 : readline (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
82385	Mandriva Linux Security Advisory : readline (MDVSA-2015:132)	Nessus	Mandriva Local Security Checks	low
78300	Amazon Linux AMI : readline (ALAS-2014-357)	Nessus	Amazon Linux Local Security Checks	low
77846	openSUSE Security Update : bash (openSUSE-SU-2014:1226-1) (Shellshock)	Nessus	SuSE Local Security Checks	critical
77042	Mandriva Linux Security Advisory : readline (MDVSA-2014:154)	Nessus	Mandriva Local Security Checks	low
76691	Fedora 20 : readline-6.2-10.fc20 (2014-7523)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2014-2524

medium

Tenable Plugins

medium

low

low

critical

low

low