The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted date string, as demonstrated by the "--date=TZ="123"345" @1" string to the touch or date command.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash)     or possibly execute arbitrary code via a crafted date string, as demonstrated by the --date=TZ=123345     @1 string to the touch or date command. (CVE-2014-9471)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-201612-22 (Coreutils: Arbitrary code execution)

    A memory corruption flaw in GNU Coreutils&rsquo; parse_datetime function was       reported. Applications using parse_datetime(), such as touch or date, may       accepted untrusted input.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Coreutils was updated to fix one security issue and one non-security bug.

The following vulnerability was fixed :

  - Commands such as date, touch or using parse_datetime()     could, when accepting untrusted input, allow an attacker     to crash the application or, potentially, execute     arbitrary code. (bnc#911832, CVE-2014-9471)

The following non-security bug was fixed :

  - df(1) executed against a bind mounted path which resided     on a different file system could issue many unnecessary     stat calls, causing unwanted performance issues.
    (bnc#919809)

Updated coreutils packages fix security vulnerability :

Bertrand Jacquin and Fiedler Roman discovered date and touch incorrectly handled user-supplied input. An attacker could possibly use this to cause a denial of service or potentially execute code (CVE-2014-9471).

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2473-1 advisory.

    It was discovered that the distcheck rule in dist-check.mk in GNU coreutils allows local users to gain     privileges via a symlink attack on a directory tree under /tmp. This issue only affected Ubuntu 10.04 LTS.
    (CVE-2009-4135)

    Bertrand Jacquin and Fiedler Roman discovered date and touch incorrectly handled user-supplied input. An     attacker could possibly use this to cause a denial of service or potentially execute code. (CVE-2014-9471)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
218580	Linux Distros Unpatched Vulnerability : CVE-2014-9471	Nessus	Misc.	critical
95638	GLSA-201612-22 : Coreutils: Arbitrary code execution	Nessus	Gentoo Local Security Checks	high
83133	SuSE 11.3 Security Update : coreutils (SAT Patch Number 10620)	Nessus	SuSE Local Security Checks	high
82454	Mandriva Linux Security Advisory : coreutils (MDVSA-2015:179)	Nessus	Mandriva Local Security Checks	high
80552	Ubuntu 14.04 LTS : coreutils vulnerabilities (USN-2473-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2014-9471

critical

Tenable Plugins

critical

high

high

high

critical