The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - guile: REPL server vulnerable to HTTP inter-protocol attacks (CVE-2016-8606)

  - The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window,     in a multithreaded application, other threads could end up creating files with insecure permissions. For     example, mkdir without the optional mode argument would create directories as 0777. This is fixed in Guile     2.0.13. Prior versions are affected. (CVE-2016-8605)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

An update of the guile package has been released.

Ludovic Courtes reports :

The REPL server is vulnerable to the HTTP inter-protocol attack

The 'mkdir' procedure of GNU Guile, an implementation of the Scheme programming language, temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions.

Update to the latest stable release, which fixes CVE-2016-8605 and CVE-2016-8606.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for guile fixes the following issues :

  - CVE-2016-8606: REPL server vulnerable to HTTP     inter-protocol attacks (bsc#1004226).

  - CVE-2016-8605: Thread-unsafe umask modification     (bsc#1004221).

Several vulnerabilities were discovered in GNU Guile, an implementation of the Scheme programming language. The Common Vulnerabilities and Exposures project identifies the following issues.

CVE-2016-8605: The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions.

CVE-2016-8606: GNU Guile provides a 'REPL server' which is a command prompt that developers can connect to for live coding and debugging purposes. The REPL server is started by the '--listen' command-line option or equivalent API.

It was reported that the REPL server is vulnerable to the HTTP inter-protocol attack.

This constitutes a remote code execution vulnerability for developers running a REPL server that listens on a loopback device or private network. Applications that do not run a REPL server, as is usually the case, are unaffected.

For Debian 7 'Wheezy', these problems have been fixed in version 2.0.5+1-3+deb7u1.

We recommend that you upgrade your guile-2.0 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199172	RHEL 7 : guile (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
121667	Photon OS 1.0: Guile PHSA-2017-0003	Nessus	PhotonOS Local Security Checks	critical
96994	FreeBSD : guile2 -- multiple vulnerabilities (b4ecf774-eb01-11e6-9ac1-a4badb2f4699)	Nessus	FreeBSD Local Security Checks	critical
94771	Fedora 25 : 5:guile (2016-0aab71f552)	Nessus	Fedora Local Security Checks	critical
94310	openSUSE Security Update : guile (openSUSE-2016-1235)	Nessus	SuSE Local Security Checks	critical
94210	Fedora 23 : 5:guile (2016-a47bf58beb)	Nessus	Fedora Local Security Checks	critical
94120	Fedora 24 : 5:guile (2016-34209c3a8e)	Nessus	Fedora Local Security Checks	critical
94114	Debian DLA-666-1 : guile-2.0 security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2016-8606

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical