SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call.

According to the version of the policycoreutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It was found that the sandbox tool provided in     policycoreutils was vulnerable to a TIOCSTI ioctl     attack. A specially crafted program executed via the     sandbox command could use this flaw to execute     arbitrary commands in the context of the parent shell,     escaping the sandbox. (CVE-2016-7545)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:0536 advisory.

    The policycoreutils packages contain the core policy utilities required to manage a SELinux environment.

    Security Fix(es):

    * It was found that the sandbox tool provided in policycoreutils was vulnerable to a TIOCSTI ioctl attack.
    A specially crafted program executed via the sandbox command could use this flaw to execute arbitrary     commands in the context of the parent shell, escaping the sandbox. (CVE-2016-7545)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for policycoreutils is now available for Red Hat Enterprise Linux 7.2 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The policycoreutils packages contain the core policy utilities required to manage a SELinux environment.

Security Fix(es) :

* It was found that the sandbox tool provided in policycoreutils was vulnerable to a TIOCSTI ioctl attack. A specially crafted program executed via the sandbox command could use this flaw to execute arbitrary commands in the context of the parent shell, escaping the sandbox. (CVE-2016-7545)

This update for policycoreutils fixes the following issues :

  - CVE-2016-7545: nonpriv session can escape to parent     [bsc#1000998]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for policycoreutils is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The policycoreutils packages contain the core policy utilities required to manage a SELinux environment.

Security Fix(es) :

* It was found that the sandbox tool provided in policycoreutils was vulnerable to a TIOCSTI ioctl attack. A specially crafted program executed via the sandbox command could use this flaw to execute arbitrary commands in the context of the parent shell, escaping the sandbox. (CVE-2016-7545)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Lazy unmount private, shared entry(Joe Jin)[orabug     12560705]

  - sandbox: create a new session for sandboxed processes     Resolves: (CVE-2016-7545)

  - Update translations Resolves: rhbz#819794

  - Fix sepolgen test cases Resolves: rhbz#1306550

  - sandbox: Improve comments in sysconfig file Resolves:
    rhbz#1159336

  - secon, newrole: fix inconsistence between --help and man     page Resolves: rhbz#1278811, rhbz#1278913

  - restorecond: treat root as a regular user Resolves:
    rhbz#1281877

  - semanage: don't skip reserver_port_t Resolves:
    rhbz#1225806

  - semanage: check if a store exists Resolves: rhbz#1208801

  - fixfiles: check the SELinux status Resolves:
    rhbz#1240788

  - semanage: Use OrderedDict for list of fcontexts     Resolves: rhbz#1206767

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-2702 advisory.

    [2.0.83-30.1.0.1]
    - Lazy unmount private, shared entry(Joe Jin)[orabug 12560705]

    [2.0.83-30.1]
    - sandbox: create a new session for sandboxed processes     Resolves: CVE-2016-7545

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update backports several fixes from upstream and also fixes sandbox issues including CVE-2016-7545

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was found that the sandbox tool provided in policycoreutils was vulnerable to a TIOCSTI ioctl attack. A specially crafted program executed via the sandbox command could use this flaw to execute arbitrary commands in the context of the parent bash, escaping the sandbox.

It was discovered that there was a sandbox escape via the 'TIOCSTI' ioctl in policycoreutils, a set of programs required for the basic operation of an SELinux-based system.

For Debian 7 'Wheezy', this issue has been fixed in policycoreutils version 2.1.10-9+deb7u1.

We recommend that you upgrade your policycoreutils packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
99842	EulerOS 2.0 SP1 : policycoreutils (EulerOS-SA-2016-1083)	Nessus	Huawei Local Security Checks	high
97769	RHEL 7 : policycoreutils (RHSA-2017:0536)	Nessus	Red Hat Local Security Checks	high
97768	RHEL 7 : policycoreutils (RHSA-2017:0535)	Nessus	Red Hat Local Security Checks	high
96925	SUSE SLES12 Security Update : policycoreutils (SUSE-SU-2017:0340-1)	Nessus	SuSE Local Security Checks	high
96924	SUSE SLES11 Security Update : policycoreutils (SUSE-SU-2017:0339-1)	Nessus	SuSE Local Security Checks	high
96923	SUSE SLES12 Security Update : policycoreutils (SUSE-SU-2017:0338-1)	Nessus	SuSE Local Security Checks	high
94978	CentOS 6 / 7 : policycoreutils (CESA-2016:2702)	Nessus	CentOS Local Security Checks	high
94909	OracleVM 3.3 / 3.4 : policycoreutils (OVMSA-2016-0157)	Nessus	OracleVM Local Security Checks	high
94896	RHEL 6 / 7 : policycoreutils (RHSA-2016:2702)	Nessus	Red Hat Local Security Checks	high
94895	Oracle Linux 6 / 7 : policycoreutils (ELSA-2016-2702)	Nessus	Oracle Linux Local Security Checks	high
94854	Fedora 25 : checkpolicy / libselinux / libsemanage / libsepol / policycoreutils / etc (2016-b7e8e980ef)	Nessus	Fedora Local Security Checks	high
94685	Amazon Linux AMI : policycoreutils (ALAS-2016-765)	Nessus	Amazon Linux Local Security Checks	high
93691	Debian DLA-638-1 : policycoreutils security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2016-7545

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high