The parse_dos_extended function in partitions/dos.c in the libblkid library in util-linux allows physically proximate attackers to cause a denial of service (memory consumption) via a crafted MSDOS partition table with an extended partition boot record at zero offset.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - util-linux: mount folder existence information disclosure (CVE-2013-0157)

  - util-linux: Extended partition loop in MBR partition table leads to DOS (CVE-2016-5011)

  - Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a     denial of service (crash) via a crafted file, related to the page global variable. (CVE-2015-5218)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - util-linux: command injection flaw in blkid (CVE-2014-9114)

  - Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a     denial of service (crash) via a crafted file, related to the page global variable. (CVE-2015-5218)

  - The parse_dos_extended function in partitions/dos.c in the libblkid library in util-linux allows     physically proximate attackers to cause a denial of service (memory consumption) via a crafted MSDOS     partition table with an extended partition boot record at zero offset. (CVE-2016-5011)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5478-1 advisory.

    Christian Moch and Michael Gruhn discovered that the libblkid library of util-linux did not properly     manage memory under certain circumstances. A local attacker could possibly use this issue

    to cause denial of service by consuming all memory through a specially crafted MSDOS partition table.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the util package has been released.

According to the version of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It was found that util-linux's libblkid library did not     properly handle Extended Boot Record (EBR) partitions     when reading MS-DOS partition tables. An attacker with     physical USB access to a protected machine could insert     a storage device with a specially crafted partition     table that could, for example, trigger an infinite loop     in systemd-udevd, resulting in a denial of service on     that machine.(CVE-2016-5011)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for util-linux fixes a number of bugs and two security issues. The following security bugs were fixed :

  - CVE-2016-5011: Infinite loop DoS in libblkid while     parsing DOS partition (bsc#988361)

  - CVE-2017-2616: In su with PAM support it was possible     for local users to send SIGKILL to selected other     processes with root privileges (bsc#1023041).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - It was found that util-linux's libblkid library did not     properly handle Extended Boot Record (EBR) partitions     when reading MS-DOS partition tables. An attacker with     physical USB access to a protected machine could insert     a storage device with a specially crafted partition     table that could, for example, trigger an infinite loop     in systemd-udevd, resulting in a denial of service on     that machine. (CVE-2016-5011)

Additional Changes :

This update for util-linux fixes the following issues :

  - Consider redundant slashes when comparing paths     (bsc#982331,     util-linux-libmount-ignore-redundant-slashes.patch,     affects backport of     util-linux-libmount-cifs-is_mounted.patch).

  - Use upstream compatibility patches for
    --show-pt-geometry with obsolescence and deprecation     warning (bsc#990531)

  - Replace cifs mount detection patch with upstream one     that covers all cases (bsc#987176).

  - Reuse existing loop device to prevent possible data     corruption when multiple -o loop are used to mount a     single file (bsc#947494)

  - Safe loop re-use in libmount, mount and losetup     (bsc#947494)

  - UPSTREAM DIVERGENCE!!! losetup -L continues to use SLE12     SP1 and SP2 specific meaning

    --logical-blocksize instead of upstream --nooverlap     (bsc#966891).

  - Make release-dependent conflict with old sysvinit-tools     SLE specific, as it is required only for SLE 11 upgrade,     and breaks openSUSE staging builds (bsc#994399).

  - Extended partition loop in MBR partition table leads to     DoS (bsc#988361, CVE-2016-5011)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for util-linux fixes the following issues :

  - Consider redundant slashes when comparing paths     (bsc#982331,     util-linux-libmount-ignore-redundant-slashes.patch,     affects backport of     util-linux-libmount-cifs-is_mounted.patch).

  - Use upstream compatibility patches for
    --show-pt-geometry with obsolescence and deprecation     warning (bsc#990531)

  - Replace cifs mount detection patch with upstream one     that covers all cases (bsc#987176).

  - Reuse existing loop device to prevent possible data     corruption when multiple -o loop are used to mount a     single file (bsc#947494)

  - Safe loop re-use in libmount, mount and losetup     (bsc#947494)

  - UPSTREAM DIVERGENCE!!! losetup -L continues to use SLE12     SP1 and SP2 specific meaning

    --logical-blocksize instead of upstream --nooverlap     (bsc#966891).

  - Make release-dependent conflict with old sysvinit-tools     SLE specific, as it is required only for SLE 11 upgrade,     and breaks openSUSE staging builds (bsc#994399).

  - Extended partition loop in MBR partition table leads to     DoS (bsc#988361, CVE-2016-5011)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for util-linux is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program.

Security Fix(es) :

* It was found that util-linux's libblkid library did not properly handle Extended Boot Record (EBR) partitions when reading MS-DOS partition tables. An attacker with physical USB access to a protected machine could insert a storage device with a specially crafted partition table that could, for example, trigger an infinite loop in systemd-udevd, resulting in a denial of service on that machine.
(CVE-2016-5011)

Red Hat would like to thank Michael Gruhn for reporting this issue.
Upstream acknowledges Christian Moch as the original reporter.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

This update for util-linux fixes a number of bugs and one minor security issue.

The following minor vulnerability was fixed :

  - CVE-2016-5011: Infinite loop DoS in libblkid while     parsing DOS partition (bsc#988361)

The following bugs were fixed :

  - bsc#987176: When mounting a subfolder of a CIFS share,     mount -a would show the mount as busy

  - bsc#947494: mount -a would fail to recognize btrfs     already mounted, address loop re-use in libmount

  - bsc#966891: Conflict in meaning of losetup -L. This     switch in SLE12 SP1 and SP2 continues to carry the     meaning of --logical-blocksize instead of upstream
    --nooverlap

  - bsc#994399: Package would trigger conflicts with     sysvinit-tools

  - bsc#983164: mount uid= and gid= would reject valid non     UID/GID values

  - bsc#978993: cfdisk would mangle some text output

  - bsc#982331: libmount: ignore redundant slashes

This update was imported from the SUSE:SLE-12-SP1:Update update project.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-2605 advisory.

    [2.23.2-33.0.1]
    - fix Oracle bug 23001516 - backport lscpu: correct the Virtualization type on Xen DomU PV guest
    - Reviewed-by: Joe Jin <joe.jin@oracle.com>

    [2.23.2-33]
    - improve patch for #1007734 (libblkid realpaths)

    [2.23.2-32]
    - improve patch for chrt(1) deadline support #1298384
    - fix #1007734 - blkid shows devices as /dev/block/:
    - fix #1349536 - Extended partition loop in MBR partition table leads to DOS

    [2.23.2-31]
    - improve spec file for #1092520

    [2.23.2-30]
    - improve patch for chrt(1) deadline support #1298384
    - improve regression tests

    [2.23.2-29]
    - fix #1029385 - lack of non-ascii support
    - fix #1092520 - util-linux - PIE and RELRO check
    - fix #1153770 - backport lsipc
    - fix #1248003 - mount only parses <param>=<value> lines from fstab fs_spec field available from blkid     block device
    - fix #1271850 - mount -a doesn't catch a typo in /etc/fstab and a typo in /etc/fstab can make a system     not reboot properly
    - fix #1281839 - [RFE]Bind mounts should be handled gracefully by the operating system
    - fix #1290689 - util-linux: /bin/login does not retry getpwnam_r with larger buffers, leading to login     failure
    - fix #1296366 - Bash completion for more(1) handles file names with spaces incorrectly
    - fix #1296521 - RHEL7: update audit event in hwclock
    - fix #1298384 - RFE: add SCHED_DEADLINE support to chrt
    - fix #1304246 - fdisk 'f' subcommand updates partition ranges wrongly
    - fix #1304426 - [rfe] /bin/su should be improved to reduce stack use
    - fix #1326615 - util-linux/lscpu: Fix model and model name on Power Systems
    - fix #1327886 - Backport blkdiscard's '-z' flag to RHEL
    - fix #1332084 - [RFE] Inclusion of lsns command in util-linux Package
    - fix #1335671 - extra quotes around UUID confuses findfs in RHEL (but not in Fedora)
    - fix #1344222 - logger port option in help is misleading
    - fix #1344482 - util-linux fails valid_pmbr() size checks if device is > 2.14TB, Device label type: dos     instead of gpt
    - fix #587393 - [RFE] Make sure util-linux is ready for writable overlays

    [2.23.2-28]
    - fix #1291554 - lslogins crash when executed with buggy username

    [2.23.2-27]
    - fix #1301091 - [libblkid] Failed to get offset of the xfs_external_log signature

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for util-linux fixes a number of bugs and one minor security issue. The following minor vulnerability was fixed :

  - CVE-2016-5011: Infinite loop DoS in libblkid while     parsing DOS partition (bsc#988361) The following bugs     were fixed :

  - bsc#987176: When mounting a subfolder of a CIFS share,     mount -a would show the mount as busy

  - bsc#947494: mount -a would fail to recognize btrfs     already mounted, address loop re-use in libmount

  - bsc#966891: Conflict in meaning of losetup -L. This     switch in SLE12 SP1 and SP2 continues to carry the     meaning of --logical-blocksize instead of upstream
    --nooverlap

  - bsc#994399: Package would trigger conflicts with     sysvinit-tools

  - bsc#983164: mount uid= and gid= would reject valid non     UID/GID values

  - bsc#978993: cfdisk would mangle some text output

  - bsc#982331: libmount: ignore redundant slashes

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198622	RHEL 5 : util-linux (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
198615	RHEL 6 : util-linux (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196197	RHEL 6 : util-linux (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	medium
196195	RHEL 5 : util-linux (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	medium
162221	Ubuntu 16.04 ESM : util-linux vulnerability (USN-5478-1)	Nessus	Ubuntu Local Security Checks	medium
141440	Photon OS 1.0: Util PHSA-2020-1.0-0330	Nessus	PhotonOS Local Security Checks	medium
99830	EulerOS 2.0 SP1 : util-linux (EulerOS-SA-2016-1068)	Nessus	Huawei Local Security Checks	medium
97380	SUSE SLES12 Security Update : util-linux (SUSE-SU-2017:0553-1)	Nessus	SuSE Local Security Checks	medium
95864	Scientific Linux Security Update : util-linux on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	medium
95752	openSUSE Security Update : util-linux (openSUSE-2016-1446)	Nessus	SuSE Local Security Checks	medium
95424	SUSE SLED12 / SLES12 Security Update : util-linux (SUSE-SU-2016:2954-1)	Nessus	SuSE Local Security Checks	medium
95351	CentOS 7 : util-linux (CESA-2016:2605)	Nessus	CentOS Local Security Checks	medium
94951	openSUSE Security Update : util-linux (openSUSE-2016-1317)	Nessus	SuSE Local Security Checks	medium
94724	Oracle Linux 7 : util-linux (ELSA-2016-2605)	Nessus	Oracle Linux Local Security Checks	medium
94668	SUSE SLED12 / SLES12 Security Update : util-linux (SUSE-SU-2016:2764-1)	Nessus	SuSE Local Security Checks	medium
94568	RHEL 7 : util-linux (RHSA-2016:2605)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2016-5011

medium

Tenable Plugins

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium