sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other Linux implementations preserves the value of INPUTRC which could lead to information disclosure. A local user with sudo access to a restricted program that uses readline could use this flaw to read content from specially formatted files with elevated privileges provided by sudo.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sudo: noexec bypass via wordexp() (CVE-2016-7076)

  - sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file,     which allows local users to open arbitrary files for read access (but not view file contents) by running a     program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log     messages, or repositioning tape drives. (CVE-2014-9680)

  - sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose     full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by /home/*/*/file.txt.
    (CVE-2015-5602)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sudo: Unauthorized privilege escalation in sudoedit (CVE-2015-5602)

  - sudo: by using ! character in the shadow file instead of a password hash can access to a run as all sudoer     account (CVE-2019-19234)

  - sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other     Linux implementations preserves the value of INPUTRC which could lead to information disclosure. A local     user with sudo access to a restricted program that uses readline could use this flaw to read content from     specially formatted files with elevated privileges provided by sudo. (CVE-2016-7091)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sudo: Unauthorized privilege escalation in sudoedit (CVE-2015-5602)

  - sudo: by using ! character in the shadow file instead of a password hash can access to a run as all sudoer     account (CVE-2019-19234)

  - The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write     permissions to parts of the called command to replace them before it is executed. (CVE-2015-8239)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the version of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It was discovered that the default sudo configuration     preserved the value of INPUTRC from the user's     environment, which could lead to information     disclosure. A local user with sudo access to a     restricted program that uses readline could use this     flaw to read content from specially formatted files     with elevated privileges provided by     sudo.(CVE-2016-7091)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - It was discovered that the default sudo configuration     preserved the value of INPUTRC from the user's     environment, which could lead to information disclosure.
    A local user with sudo access to a restricted program     that uses readline could use this flaw to read content     from specially formatted files with elevated privileges     provided by sudo. (CVE-2016-7091)

Note: With this update, INPUTRC was removed from the env_keep list in /etc/sudoers to avoid having sudo preserve the value of this variable when invoking privileged commands.

Additional Changes :

An update for sudo is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.

Security Fix(es) :

* It was discovered that the default sudo configuration preserved the value of INPUTRC from the user's environment, which could lead to information disclosure. A local user with sudo access to a restricted program that uses readline could use this flaw to read content from specially formatted files with elevated privileges provided by sudo.
(CVE-2016-7091)

Note: With this update, INPUTRC was removed from the env_keep list in /etc/ sudoers to avoid having sudo preserve the value of this variable when invoking privileged commands.

Red Hat would like to thank Grisha Levit for reporting this issue.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-2593 advisory.

    [1.8.6p7-20]
    - RHEL 7.3 erratum
      - fixed visudo's -q flag       Resolves: rhbz#1350828

    [1.8.6p7-19]
    - RHEL 7.3 erratum
      - removed INPUTRC from env_keep to prevent a potential info leak       Resolves: rhbz#1340700

    [1.8.6p7-18]
    - RHEL 7.3 erratum
      - removed requiretty flag from the default sudoers policy
      - backported pam_service and pam_login_service defaults options
      - implemented netgroup_tuple defaults option for changing netgroup         processing semantics
      - fixed user matching logic in the LDAP nss backend
      - don't allow visudo to accept an invalid sudoers file
      - fixed a bug causing that non-root users can list privileges of         other users
      - modified digest check documentation to mention the raciness of         the checking mechanism       Resolves: rhbz#1196451       Resolves: rhbz#1247230       Resolves: rhbz#1334331       Resolves: rhbz#1334360       Resolves: rhbz#1261998       Resolves: rhbz#1313364       Resolves: rhbz#1312486       Resolves: rhbz#1268958       Resolves: rhbz#1335039       Resolves: rhbz#1335042       Resolves: rhbz#1335045       Resolves: rhbz#1273243       Resolves: rhbz#1299883

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198848	RHEL 5 : sudo (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198797	RHEL 6 : sudo (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198754	RHEL 7 : sudo (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
195537	RHEL 5 : sudo (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195500	RHEL 6 : sudo (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195499	RHEL 7 : sudo (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
99817	EulerOS 2.0 SP1 : sudo (EulerOS-SA-2016-1055)	Nessus	Huawei Local Security Checks	medium
95861	Scientific Linux Security Update : sudo on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	medium
95339	CentOS 7 : sudo (CESA-2016:2593)	Nessus	CentOS Local Security Checks	medium
94713	Oracle Linux 7 : sudo (ELSA-2016-2593)	Nessus	Oracle Linux Local Security Checks	medium
94556	RHEL 7 : sudo (RHSA-2016:2593)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2016-7091

medium

Tenable Plugins

high

high

high

high

high

high

medium

medium

medium

medium

medium