sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other Linux implementations preserves the value of INPUTRC which could lead to information disclosure. A local user with sudo access to a restricted program that uses readline could use this flaw to read content from specially formatted files with elevated privileges provided by sudo.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other     Linux implementations preserves the value of INPUTRC which could lead to information disclosure. A local     user with sudo access to a restricted program that uses readline could use this flaw to read content from     specially formatted files with elevated privileges provided by sudo. (CVE-2016-7091)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the version of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It was discovered that the default sudo configuration     preserved the value of INPUTRC from the user's     environment, which could lead to information     disclosure. A local user with sudo access to a     restricted program that uses readline could use this     flaw to read content from specially formatted files     with elevated privileges provided by     sudo.(CVE-2016-7091)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - It was discovered that the default sudo configuration     preserved the value of INPUTRC from the user's     environment, which could lead to information disclosure.
    A local user with sudo access to a restricted program     that uses readline could use this flaw to read content     from specially formatted files with elevated privileges     provided by sudo. (CVE-2016-7091)

Note: With this update, INPUTRC was removed from the env_keep list in /etc/sudoers to avoid having sudo preserve the value of this variable when invoking privileged commands.

Additional Changes :

An update for sudo is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.

Security Fix(es) :

* It was discovered that the default sudo configuration preserved the value of INPUTRC from the user's environment, which could lead to information disclosure. A local user with sudo access to a restricted program that uses readline could use this flaw to read content from specially formatted files with elevated privileges provided by sudo.
(CVE-2016-7091)

Note: With this update, INPUTRC was removed from the env_keep list in /etc/ sudoers to avoid having sudo preserve the value of this variable when invoking privileged commands.

Red Hat would like to thank Grisha Levit for reporting this issue.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-2593 advisory.

    [1.8.6p7-20]
    - RHEL 7.3 erratum
      - fixed visudo's -q flag       Resolves: rhbz#1350828

    [1.8.6p7-19]
    - RHEL 7.3 erratum
      - removed INPUTRC from env_keep to prevent a potential info leak       Resolves: rhbz#1340700

    [1.8.6p7-18]
    - RHEL 7.3 erratum
      - removed requiretty flag from the default sudoers policy
      - backported pam_service and pam_login_service defaults options
      - implemented netgroup_tuple defaults option for changing netgroup         processing semantics
      - fixed user matching logic in the LDAP nss backend
      - don't allow visudo to accept an invalid sudoers file
      - fixed a bug causing that non-root users can list privileges of         other users
      - modified digest check documentation to mention the raciness of         the checking mechanism       Resolves: rhbz#1196451       Resolves: rhbz#1247230       Resolves: rhbz#1334331       Resolves: rhbz#1334360       Resolves: rhbz#1261998       Resolves: rhbz#1313364       Resolves: rhbz#1312486       Resolves: rhbz#1268958       Resolves: rhbz#1335039       Resolves: rhbz#1335042       Resolves: rhbz#1335045       Resolves: rhbz#1273243       Resolves: rhbz#1299883

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
219992	Linux Distros Unpatched Vulnerability : CVE-2016-7091	Nessus	Misc.	medium
99817	EulerOS 2.0 SP1 : sudo (EulerOS-SA-2016-1055)	Nessus	Huawei Local Security Checks	medium
95861	Scientific Linux Security Update : sudo on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	medium
95339	CentOS 7 : sudo (CESA-2016:2593)	Nessus	CentOS Local Security Checks	medium
94713	Oracle Linux 7 : sudo (ELSA-2016-2593)	Nessus	Oracle Linux Local Security Checks	medium
94556	RHEL 7 : sudo (RHSA-2016:2593)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2016-7091

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium