An elevation of privilege vulnerability in libnl could enable a local malicious application to execute arbitrary code within the context of the Wi-Fi service. This issue is rated as Moderate because it first requires compromising a privileged process and is mitigated by current platform configurations. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32342065. NOTE: this issue also exists in the upstream libnl before 3.3.0 library.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - libnl: Integer overflow in nlmsg_reserve() (CVE-2017-0553)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - libnl: Integer overflow in nlmsg_reserve() (CVE-2017-0553)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - libnl: Integer overflow in nlmsg_reserve() (CVE-2017-0553)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the version of the libnl package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - An elevation of privilege vulnerability in libnl could     enable a local malicious application to execute     arbitrary code within the context of the Wi-Fi service.
    This issue is rated as Moderate because it first     requires compromising a privileged process and is     mitigated by current platform configurations. Product:
    Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0,     7.1.1. Android ID: A-32342065. NOTE: this issue also     exists in the upstream libnl before 3.3.0     library.(CVE-2017-0553)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libnl package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - An integer overflow leading to a heap-buffer overflow     was found in the libnl library. An attacker could use     this flaw to cause an application compiled with libnl     to crash or possibly execute arbitrary code in the     context of the user running such an     application.(CVE-2017-0553)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libnl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An elevation of privilege vulnerability in libnl could     enable a local malicious application to execute     arbitrary code within the context of the Wi-Fi service.
    This issue is rated as Moderate because it first     requires compromising a privileged process and is     mitigated by current platform configurations. Product:
    Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0,     7.1.1. Android ID: A-32342065. NOTE: this issue also     exists in the upstream libnl before 3.3.0     library.(CVE-2017-0553)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libnl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An integer overflow leading to a heap-buffer overflow     was found in the libnl library. An attacker could use     this flaw to cause an application compiled with libnl     to crash or possibly execute arbitrary code in the     context of the user running such an application.
    (CVE-2017-0553)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libnl3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An integer overflow leading to a heap-buffer overflow     was found in the libnl library. An attacker could use     this flaw to cause an application compiled with libnl     to crash or possibly execute arbitrary code in the     context of the user running such an application.
    (CVE-2017-0553)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Integer overflow in nlmsg_reserve() :

An integer overflow leading to a heap-buffer overflow was found in the libnl library. An attacker could use this flaw to cause an application compiled with libnl to crash or possibly execute arbitrary code in the context of the user running such an application. (CVE-2017-0553)

An update for NetworkManager, NetworkManager-libreswan, libnl3, and network-manager-applet is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services.

The libnl3 packages contain a convenience library that simplifies using the Linux kernel's Netlink sockets interface for network manipulation.

The following packages have been upgraded to a later upstream version:
NetworkManager (1.8.0), network-manager-applet (1.8.0). (BZ#1413312, BZ# 1414103, BZ#1441621)

Security Fix(es) in the libnl3 component :

* An integer overflow leading to a heap-buffer overflow was found in the libnl library. An attacker could use this flaw to cause an application compiled with libnl to crash or possibly execute arbitrary code in the context of the user running such an application.
(CVE-2017-0553)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

The libnl3 packages contain a convenience library that simplifies using the Linux kernel's Netlink sockets interface for network manipulation.

The following packages have been upgraded to a later upstream version:
NetworkManager (1.8.0), network-manager-applet (1.8.0).

Security Fix(es) in the libnl3 component :

  - An integer overflow leading to a heap-buffer overflow     was found in the libnl library. An attacker could use     this flaw to cause an application compiled with libnl to     crash or possibly execute arbitrary code in the context     of the user running such an application. (CVE-2017-0553)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-2299 advisory.

    NetworkManager     [1:1.8.0-9]
    - device: don't change MTU unless explicitly configured (rh #1460760)
    - core: don't remove external IPv4 addresses (rh #1459813)

    [1:1.8.0-8]
    - cli: fix output of iface in overview output (rh#1460219)
    - ppp: unexport NMPPPManager instance on dispose (rh#1459579)
    - cli: remove spurious device names from wifi subcommands output (rh#1460527)

    [1:1.8.0-7]
    - bond: fix crash comparing mode while generating bond connection (rh #1459580)
    - connectivity: fix route penalty if WWAN and BT device using ip-ifindex (rh #1459932)
    - device: persist nm-owned in run state (rh #1376199)
    - device: fix assuming master device on restart (rh #1452062)
    - device: apply route metric penality only when the default route exists (rh #1459604)

    [1:1.8.0-6]
    - connectivity: fix periodic connectivity check (rh #1458399)
    - bond: improve option matching on daemon restart (rh #1457909)
    - device: fix touching device after external activation (rh #1457242)

    [1:1.8.0-5]
    - ifcfg-rh: fix writing legacy NETMASK value (rh #1445414)
    - tui: fix crash during connect (rh #1456826)
    - libnm: fix libnm rejecting VLAN ID 4095 (rh #1456911)

    [1:1.8.0-4]
    - device: update external configuration before commit (rh #1449873)
    - bluetooth: fix crash on connecting to a NAP (rh #1454385)
    - device: release removed devices from master on cleanup (rh #1448907)
    - core: activate slaves using ifindex order by default (rh #1452585)
    - nmcli: fix crash when setting 802-1x.password-raw (rh #1456362)
    - po: update translations (rh #1382625)

    [1:1.8.0-3]
    - dhcp: don't add route to DHCP4 server (rh #1448987)
    - libnm: fix NUL termination of device's description (rh #1443114)
    - libnm, core: ensure valid UTF-8 in device properties (rh #1443114)
    - core: fix device's UDI property on D-Bus (rh #1443114)
    - ifcfg-rh: omit empty next hop for routes in legacy format (rh #1452648)

    [1:1.8.0-2]
    - core: fix persisting managed state of device (rh #1440171)
    - proxy: fix use-after-free (rh #1450459)
    - device: don't wrongly delay startup complete waiting for carrier (rh #1450444)

    [1:1.8.0-1]
    - Update to upstream release 1.8.0
    - device: support dummy devices (rh#1398932)
    - core: support attaching user-data to connection profiles (rh#1421429)
    - core: fix allowing FQDN in dhcp-hostname setting (rh#1443437)
    - core: fix configuring firewall while device is activating (rh#1445242)
    - core: don't block activation without carrier for IPv6 DAD (rh#1446367)
    - tui: force writing master key to ifcfg file when editing connection (rh#1425409)

    [1:1.8.0-0.4.rc3]
    - Update to third Release Candidate of NetworkManager 1.8
    - device: fix regressions in assuming devices on carryover from initrd (rh #1443878)
    - device: add support for SRIOV num_vfs (rh #1398934)
    - device: leave device up when setting it as unmanaged by user (rh #1371433)
    - core: properly track manager, route manager and default route manager references (rh #1440089)
    - route: properly deal with routes with non-empty host parts (rh #1439376)
    - vpn: fix a crash on disconnect (rh #1442064)
    - cli: fix hang on connection down (rh #1422786)
    - cli: fix interactive edit of bond slaves (rh #1440957)
    - vpn: fix early error handling on failed activations (rh #1440077)
    - core: only persist explicit managed state in device's state file (rh #1440171)

    [1:1.8.0-0.4.rc2]
    - Update to second Release Candidate of NetworkManager 1.8
    - device: don't update disconnected devices routes after connectivity check (rh #1436978)
    - ifcfg-rh: also check BONDING_OPTS to determine the connection type (rh #1434555)
    - nmcli: fix nmcli con edit crash (rh #1436993)
    - nmcli: fix nmcli con down (rh #1436990)

    [1:1.8.0-0.4.rc1]
    - Update to first Release Candidate of NetworkManager 1.8
    - nmcli: speedup with large numbers of VLANs (rh #1231526)
    - dns: avoid cleaning resolv.conf on exit if not needed (rh #1344303, rh #1426748)
    - device: bond: implement connection reapply (rh #1348198)
    - platform: add support for some route options (rh #1373698)
    - core: add mtu property to cdma and gsm settings (rh #1388613)
    - nmcli: fix output in terse mode (rh #1391170)
    - improve handling of unmanaged/assumed devices (rh #1394579)
    - policy: make DHCP hostname behaviour configurable (rh #1405275)
    - manager: ensure proper disposal of unrealized devices (rh #1433303)
    - nmcli: fix connection down (rh #1433883)
    - libnm-glib: fix memory leak (rh #1433912)
    - device: deal with non-existing IP settings in get_ip_config_may_fail() (rh #1436601)
    - nmcli: make --ask and --show-secrets global options (rh #1351263)
    - nmcli: improve error handling (rh #1394334)
    - device: apply a loose IPv4 rp_filter when it would interfere with multihoming (rh #1394344)
    - core: make connectivity checking per-device (rh #1394345)
    - manager: sort slaves to be autoconnected by device name (rh #1420708)
    - policy: add support to configurable hostname mode (rh #1422610)
    - team: support the ethernet.cloned-mac-address property (rh #1424641)
    - ifcfg-rh: fix reading team slave types of vlan type (rh #1427482)
    - default-route-manager: alyways force a sync of the default route (rh #1431268)
    - device: fail DHCPv6 if a link-local address is not present (rh #1432251)

    [1:1.8.0-0.3.git20170215.1d40c5f4]
    - Revert default behavior for clone-mac-address to permanent (rh #1413312)

    [1:1.8.0-0.2.git20170215.1d40c5f4]
    - Update to a 1.7.1 snapshot:
    - rebase NetworkManger package to new upstream 1.8.x version (rh #1414103)
    - device: introduce support to ipv6.method=shared (rh #1256822)
    - device: add support to vlan on virtual devices (rh #1312359)
    - core/supplicant: introduce support to MACsec connections (rh #1337997)
    - core: allow enforcing of 802-3 link properties (rh #1353612)
    - manager: allow a slave connection which has slaves to autoactivate them (rh #1360386)
    - cli: check the active-connection state to detect activation failure (rh #1367752, rh #1384937)
    - cli: remove the separate thread when in editor mode to fix races (rh #1368353)
    - ifcfg-rh: write the master device name even if the master property is an UUID (rh #1369008)
    - ifcfg-rh: higly improved parsing of ifcfg files (rh #1369380)
    - checkpoint: improved the checkpoint/rollback functionality (rh #1369716)
    - core: core: don't unmanage devices on shutdown (rh #1371126, rh #1378418)
    - cli: properly set multiple addresses in questionnaire mode (rh #1380165)
    - manager: keep scheduling connectivity check if there is a default active connection (rh #1386106)
    - device: allow custom MAC address on bond and bridge interfaces (rh #1386872)
    - core: avoid race reading permanent MAC address before udev initialized (rh #1388286)
    - ifcfg-rh: fix import of 802.1x connections with empty EAP-TLS identity (rh #1391477)
    - libnm-core: remove INFERRABLE flag from dhcp-hostname property (rh #1393997)
    - platform: preserve the order when multiple ip addresses are present (rh #1394500)
    - device: avoid a crash when both IPv4 and IPv6 configurations fail (rh #1404148)
    - dns: export dns state to DBUS (rh #1404594)
    - ppp: moved PPP support into a separate package (rh #1404598)
    - dns: don't apply DNS configuration coming from non-active devices (rh #1405431)
    - vlan: inherit default MTU from parent device (rh #1414186)
    - bond: fix crash when reading from sysfs 'NULL' (rh #1420244)
    - build: rebuild with correct hardening flags (rh #1420771)
    - platform: downgrade warning about failure to detect kernel support to debug (rh #1421019)
    - dns: change behavior for 'rc-manager=symlink' to preserve '/etc/resolv.conf' as file (rh #1367551)
    - libnm: order the property updates (rh #1417292)

    NetworkManager-libreswan     [1.2.4-2]
    - po: update Japanese translation (rh #1383163)

    libnl3     [3.2.28-4]
    * lib: check for integer overflow in nl_reserve() (rh#1440788, rh#1442723)

    network-manager-applet     [1.8.0-3]
    - editor: fix crash when destroying 802.1x page (rh #1458567)

    [1.8.0-2]
    - po: update Japanese translation (rh #1379642)

    [1.8.0-1]
    - Update to 1.8.0 release (rh #1441621)

    [1.8.0-0.1.git20170326.f260f8a]
    - Update to network-manager-applet 1.8 snapshot
    - c-e: add missing mnemonic characters to buttons (rh #1434317)
    - c-e: fix handling of devices without permanent MAC address in devices combo box (rh #1380424)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

USN-3311-1 fixed a vulnerability in libnl. This update provides the corresponding update for Ubuntu 12.04 ESM.

It was discovered that libnl incorrectly handled memory when performing certain operations. A local attacker could possibly use this issue to cause libnl to crash, resulting in a denial of service, or execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3311-1 advisory.

    It was discovered that libnl incorrectly handled memory when performing certain operations. A local     attacker could possibly use this issue to cause libnl to crash, resulting in a denial of service, or     execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

lib: check for integer overflow in nlmsg_reserve() (rh#1440788, rh#1440789, CVE-2017-0553)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

lib: check for integer overflow in nlmsg_reserve() (rh#1440789, CVE-2017-0553)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was an integer overflow in libnl3, a library for dealing with netlink sockets.

A missing check in nlmsg_reserve() could have allowed a malicious application to execute arbitrary code within the context of the WiFi service.

For Debian 7 'Wheezy', this issue has been fixed in libnl3 version 3.2.7-4+deb7u1.

We recommend that you upgrade your libnl3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was a FIXME in libnl, a FIXME...

For Debian 7 'Wheezy', this issue has been fixed in libnl version 1.1-7+deb7u1.

We recommend that you upgrade your libnl packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198969	RHEL 6 : libnl (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198943	RHEL 7 : libnl (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198872	RHEL 5 : libnl (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196795	RHEL 7 : libnl (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
196780	RHEL 6 : libnl (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
196770	RHEL 5 : libnl (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
135652	EulerOS Virtualization 3.0.2.2 : libnl (EulerOS-SA-2020-1490)	Nessus	Huawei Local Security Checks	high
134547	EulerOS Virtualization for ARM 64 3.0.2.0 : libnl (EulerOS-SA-2020-1258)	Nessus	Huawei Local Security Checks	high
130877	EulerOS 2.0 SP5 : libnl (EulerOS-SA-2019-2168)	Nessus	Huawei Local Security Checks	high
129244	EulerOS 2.0 SP3 : libnl (EulerOS-SA-2019-2051)	Nessus	Huawei Local Security Checks	high
128905	EulerOS 2.0 SP2 : libnl (EulerOS-SA-2019-1853)	Nessus	Huawei Local Security Checks	high
103000	EulerOS 2.0 SP2 : libnl3 (EulerOS-SA-2017-1162)	Nessus	Huawei Local Security Checks	high
102999	EulerOS 2.0 SP1 : libnl3 (EulerOS-SA-2017-1161)	Nessus	Huawei Local Security Checks	high
102864	Amazon Linux AMI : libnl3 (ALAS-2017-876)	Nessus	Amazon Linux Local Security Checks	high
102760	CentOS 7 : NetworkManager / NetworkManager-libreswan / libnl3 / network-manager-applet (CESA-2017:2299)	Nessus	CentOS Local Security Checks	high
102635	Scientific Linux Security Update : NetworkManager and libnl3 on SL7.x x86_64 (20170801)	Nessus	Scientific Linux Local Security Checks	high
102341	Oracle Linux 7 : NetworkManager / and / libnl3 (ELSA-2017-2299)	Nessus	Oracle Linux Local Security Checks	high
102155	RHEL 7 : NetworkManager and libnl3 (RHSA-2017:2299)	Nessus	Red Hat Local Security Checks	high
100919	Ubuntu 12.04 LTS : libnl3 vulnerability (USN-3311-2)	Nessus	Ubuntu Local Security Checks	high
100663	Ubuntu 14.04 LTS / 16.04 LTS : libnl vulnerability (USN-3311-1)	Nessus	Ubuntu Local Security Checks	high
99989	Fedora 24 : libnl3 (2017-7a5363b41d)	Nessus	Fedora Local Security Checks	high
99608	Fedora 25 : libnl3 (2017-34f6e70fdd)	Nessus	Fedora Local Security Checks	high
99270	Debian DLA-892-1 : libnl3 security update	Nessus	Debian Local Security Checks	high
99269	Debian DLA-891-1 : libnl security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-0553

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high