Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2015:1676 advisory.

    Redis is an advanced key-value store. It is often referred to as a data     structure server since keys can contain strings, hashes, lists, sets and     sorted sets.

    A flaw was discovered in redis that could allow an authenticated user, who     was able to use the EVAL command to run Lua code, to break out of the Lua     sandbox and execute arbitrary code on the system. (CVE-2015-4335)

    All users of redis are advised to upgrade to these updated packages, which     correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Redis installed on the remote host is affected by a remote code execution vulnerability. An attacker can exploit this issue via the eval command to execute arbitrary Lua bytecote.

The remote host is affected by the vulnerability described in GLSA-201702-16 (Redis: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Redis. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, able to connect to a Redis instance, could issue       malicious commands possibly resulting in the execution of arbitrary code       with the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

redis was updated to version 2.8.22 (boo#934048) to fix a LUA sandbox update. (CVE-2015-4335) Details can be found on http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-esc ape/

For the other changes see in the package:
/usr/share/doc/packages/redis/00-RELEASENOTES

- Upstream 2.8.21

    - Fix Lua sandbox escape and arbitrary code execution       (RHBZ #1228331)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Upstream 2.8.21 (RHBZ #1228245)

    - Fix Lua sandbox escape and arbitrary code execution       (RHBZ #1228331)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ben Murphy reports :

It is possible to break out of the Lua sandbox in Redis and execute arbitrary code.

This shouldn't pose a threat to users under the trusted Redis security model where only trusted users can connect to the database.
However, in real deployments there could be databases that can be accessed by untrusted users. The main deployments that are vulnerable are developers machines, places where redis servers can be reached via SSRF attacks and cloud hosting.

It was discovered that redis, a persistent key-value database, could execute insecure Lua bytecode by way of the EVAL command. This could allow remote attackers to break out of the Lua sandbox and execute arbitrary code.

ID	Name	Product	Family	Severity
210220	RHEL 7 : redis security advisory (Moderate) (RHSA-2015:1676)	Nessus	Red Hat Local Security Checks	critical
109323	Pivotal Software Redis < 2.8.21 / 3.x < 3.0.2 RCE	Nessus	Misc.	critical
97259	GLSA-201702-16 : Redis: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
86284	openSUSE Security Update : redis (openSUSE-2015-634)	Nessus	SuSE Local Security Checks	critical
84859	Fedora 22 : redis-2.8.21-1.fc22 (2015-9498)	Nessus	Fedora Local Security Checks	critical
84858	Fedora 21 : redis-2.8.21-1.fc21 (2015-9488)	Nessus	Fedora Local Security Checks	critical
84043	FreeBSD : redis -- EVAL Lua Sandbox Escape (838fa84a-0e25-11e5-90e4-d050996490d0)	Nessus	FreeBSD Local Security Checks	critical
84024	Debian DSA-3279-1 : redis - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2015-4335

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical