The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted date string, as demonstrated by the "--date=TZ="123"345" @1" string to the touch or date command.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - coreutils: memory corruption flaw in parse_datetime() (CVE-2014-9471)

  - coreutils: Non-privileged session can escape to the parent session in chroot (CVE-2016-2781)

  - coreutils: race condition vulnerability in chown and chgrp (CVE-2017-18018)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - coreutils: memory corruption flaw in parse_datetime() (CVE-2014-9471)

  - coreutils: race condition vulnerability in chown and chgrp (CVE-2017-18018)

  - The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of     service (segmentation fault and crash) via a long string to the sort command, when using the (1) -d or (2)
    -M switch, which triggers a stack-based buffer overflow in the alloca function. (CVE-2013-0221)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - coreutils: memory corruption flaw in parse_datetime() (CVE-2014-9471)

  - coreutils: Non-privileged session can escape to the parent session in chroot (CVE-2016-2781)

  - coreutils: race condition vulnerability in chown and chgrp (CVE-2017-18018)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote host is affected by the vulnerability described in GLSA-201612-22 (Coreutils: Arbitrary code execution)

    A memory corruption flaw in GNU Coreutils&rsquo; parse_datetime function was       reported. Applications using parse_datetime(), such as touch or date, may       accepted untrusted input.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Coreutils was updated to fix one security issue and one non-security bug.

The following vulnerability was fixed :

  - Commands such as date, touch or using parse_datetime()     could, when accepting untrusted input, allow an attacker     to crash the application or, potentially, execute     arbitrary code. (bnc#911832, CVE-2014-9471)

The following non-security bug was fixed :

  - df(1) executed against a bind mounted path which resided     on a different file system could issue many unnecessary     stat calls, causing unwanted performance issues.
    (bnc#919809)

Updated coreutils packages fix security vulnerability :

Bertrand Jacquin and Fiedler Roman discovered date and touch incorrectly handled user-supplied input. An attacker could possibly use this to cause a denial of service or potentially execute code (CVE-2014-9471).

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2473-1 advisory.

    It was discovered that the distcheck rule in dist-check.mk in GNU coreutils allows local users to gain     privileges via a symlink attack on a directory tree under /tmp. This issue only affected Ubuntu 10.04 LTS.
    (CVE-2009-4135)

    Bertrand Jacquin and Fiedler Roman discovered date and touch incorrectly handled user-supplied input. An     attacker could possibly use this to cause a denial of service or potentially execute code. (CVE-2014-9471)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198445	RHEL 6 : coreutils (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198410	RHEL 5 : coreutils (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
198383	RHEL 7 : coreutils (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
95638	GLSA-201612-22 : Coreutils: Arbitrary code execution	Nessus	Gentoo Local Security Checks	high
83133	SuSE 11.3 Security Update : coreutils (SAT Patch Number 10620)	Nessus	SuSE Local Security Checks	high
82454	Mandriva Linux Security Advisory : coreutils (MDVSA-2015:179)	Nessus	Mandriva Local Security Checks	high
80552	Ubuntu 14.04 LTS : coreutils vulnerabilities (USN-2473-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2014-9471

critical

Tenable Plugins

high

medium

high

high

high

high

critical