systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows local users to bypass intended access restrictions via vectors involving a hard link to a file for which the user lacks write access, as demonstrated by changing the ownership of the /etc/passwd file.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - systemd: Mishandled symlinks in systemd-tmpfiles allows local users to obtain ownership of arbitrary files     (CVE-2018-6954)

  - systemd, when updating file permissions, allows local users to change the permissions and SELinux security     contexts for arbitrary files via a symlink attack on unspecified files. (CVE-2013-4392)

  - The machinectl command in oci-register-machine allows local users to list running containers and possibly     obtain sensitive information by running that command. (CVE-2016-6349)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the versions of the systemd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way systemd handled empty     notification messages. A local attacker could use this     flaw to make systemd freeze its execution, preventing     further management of system services, system shutdown,     or zombie process collection via     systemd.i1/4^CVE-2016-7795i1/4%0

  - systemd-tmpfiles in systemd before 237 attempts to     support ownership/permission changes on hardlinked     files even if the fs.protected_hardlinks sysctl is     turned off, which allows local users to bypass intended     access restrictions via vectors involving a hard link     to a file for which the user lacks write access, as     demonstrated by changing the ownership of the     /etc/passwd file.i1/4^CVE-2017-18078i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - systemd: Out-of-bounds heap write in systemd-networkd     dhcpv6 option handling (CVE-2018-15688)

  - systemd: stack overflow when calling syslog from a     command with long cmdline (CVE-2018-16864)

  - systemd: stack overflow when receiving many journald     entries (CVE-2018-16865)

  - systemd: Assertion failure when PID 1 receives a     zero-length message over notify socket(CVE-2016-7795)

  - systemd: Unsafe handling of hard links allowing     privilege escalation(CVE-2017-18078)

  - systemd: Out-of-bounds write in systemd-resolved due to     allocating too small buffer in     dns_packet_new(CVE-2017-9445)

  - systemd: memory leak in journald-server.c introduced by     fix for CVE-2018-16864 (CVE-2019-3815)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the systemd package has been released.

This update for systemd fixes the following issues :

Security issue fixed :

  - CVE-2017-18078: tmpfiles: refuse to chown()/chmod()     files which are hardlinked, unless protected_hardlinks     sysctl is on. This could be used by local attackers to     gain privileges (bsc#1077925)

Non Security issues fixed :

  - core: use id unit when retrieving unit file state     (#8038) (bsc#1075801)

  - cryptsetup-generator: run cryptsetup service before swap     unit (#5480)

  - udev-rules: all values can contain escaped double quotes     now (#6890)

  - strv: fix buffer size calculation in strv_join_quoted()

  - tmpfiles: change ownership of symlinks too

  - stdio-bridge: Correctly propagate error

  - stdio-bridge: remove dead code

  - remove bus-proxyd (bsc#1057974)

  - core/timer: Prevent timer looping when unit cannot start     (bsc#1068588)

  - Make systemd-timesyncd use the openSUSE NTP servers by     default Previously systemd-timesyncd used the Google     Public NTP servers time(1..4).google.com

  - Don't ship /usr/lib/systemd/system/tmp.mnt at all     (bsc#1071224) But we still ship a copy in /var. Users     who want to use tmpfs on /tmp are supposed to add a     symlink in /etc/ pointing to the copy shipped in /var.
    To support the update path we automatically create the     symlink if tmp.mount in use is located in /usr.

  - Enable systemd-networkd on Leap distros only     (bsc#1071311)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for systemd fixes the following issues: Security issue fixed :

  - CVE-2017-18078: tmpfiles: refuse to chown()/chmod()     files which are hardlinked, unless protected_hardlinks     sysctl is on. This could be used by local attackers to     gain privileges (bsc#1077925) Non Security issues fixed :

  - core: use id unit when retrieving unit file state     (#8038) (bsc#1075801)

  - cryptsetup-generator: run cryptsetup service before swap     unit (#5480)

  - udev-rules: all values can contain escaped double quotes     now (#6890)

  - strv: fix buffer size calculation in strv_join_quoted()

  - tmpfiles: change ownership of symlinks too

  - stdio-bridge: Correctly propagate error

  - stdio-bridge: remove dead code

  - remove bus-proxyd (bsc#1057974)

  - core/timer: Prevent timer looping when unit cannot start     (bsc#1068588)

  - Make systemd-timesyncd use the openSUSE NTP servers by     default Previously systemd-timesyncd used the Google     Public NTP servers time{1..4}.google.com

  - Don't ship /usr/lib/systemd/system/tmp.mnt at all     (bsc#1071224) But we still ship a copy in /var. Users     who want to use tmpfs on /tmp are supposed to add a     symlink in /etc/ pointing to the copy shipped in /var.
    To support the update path we automatically create the     symlink if tmp.mount in use is located in /usr.

  - Enable systemd-networkd on Leap distros only     (bsc#1071311)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199660	RHEL 7 : systemd (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
195801	RHEL 7 : systemd (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
123903	EulerOS Virtualization 2.5.4 : systemd (EulerOS-SA-2019-1217)	Nessus	Huawei Local Security Checks	high
123866	EulerOS Virtualization 2.5.3 : systemd (EulerOS-SA-2019-1180)	Nessus	Huawei Local Security Checks	high
122218	EulerOS 2.0 SP5 : systemd (EulerOS-SA-2019-1045)	Nessus	Huawei Local Security Checks	high
121927	Photon OS 2.0: Systemd PHSA-2018-2.0-0026	Nessus	PhotonOS Local Security Checks	high
121814	Photon OS 1.0: Systemd PHSA-2018-1.0-0116	Nessus	PhotonOS Local Security Checks	high
119062	EulerOS Virtualization 2.5.2 : systemd (EulerOS-SA-2018-1371)	Nessus	Huawei Local Security Checks	high
107050	openSUSE Security Update : systemd (openSUSE-2018-216)	Nessus	SuSE Local Security Checks	high
107022	SUSE SLED12 / SLES12 Security Update : systemd (SUSE-SU-2018:0546-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2017-18078

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high