libstorage, libstorage-ng, and yast-storage improperly store passphrases for encrypted storage devices in a temporary file on disk, which might allow local users to obtain sensitive information by reading the file, as demonstrated by /tmp/libstorage-XXXXXX/pwdf.

This update for libstorage fixes the following issues :

  - Use stdin, not tmp files for passwords (bsc#986971,     CVE-2016-5746)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for yast2-storage provides the following fixes: Security issues fixed :

  - Use standard IPC, and not temporary files, to pass     passwords between processes. (bsc#986971, CVE-2016-5746)     Non security bugs fixed :

  - Fix usage of complete multipath disk as LVM physical     volume. (bsc#984245)

  - Load the correct multipath module (dm-multipath).
    (bsc#937942)

  - Improve message for creating volumes with a filesystem     but without a mount point. (bsc#996208)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libstorage fixes the following issues :

  - Use stdin, not tmp files for passwords (bsc#986971,     CVE-2016-5746)

This update was imported from the SUSE:SLE-12-SP1:Update update project.

ID	Name	Product	Family	Severity
93713	SUSE SLES12 Security Update : libstorage (SUSE-SU-2016:2355-1)	Nessus	SuSE Local Security Checks	medium
93712	SUSE SLES11 Security Update : yast2-storage (SUSE-SU-2016:2353-1)	Nessus	SuSE Local Security Checks	medium
93390	openSUSE Security Update : libstorage (openSUSE-2016-1062)	Nessus	SuSE Local Security Checks	medium
93311	SUSE SLED12 / SLES12 Security Update : libstorage (SUSE-SU-2016:2189-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2016-5746

medium

Tenable Plugins

medium

medium

medium

medium