It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination. An attacker, with write access to a directory in which a subdirectory will be installed, could redirect that directory to an arbitrary location and gain root privilege.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - file: Buffer over-write in finfo_open with malformed magic file (CVE-2015-8865)

  - rpm: Following symlinks to files when installing packages allows privilege escalation (CVE-2017-7501)

  - softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of     service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable.
    (CVE-2014-2270)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - file: Buffer over-write in finfo_open with malformed magic file (CVE-2015-8865)

  - rpm: Following symlinks to files when installing packages allows privilege escalation (CVE-2017-7501)

  - The ELF parser in file 5.08 through 5.21 allows remote attackers to cause a denial of service via a large     number of notes. (CVE-2014-9620)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - file: Buffer over-write in finfo_open with malformed magic file (CVE-2015-8865)

  - rpm: Following symlinks to files when installing packages allows privilege escalation (CVE-2017-7501)

  - It was found that rpm did not properly handle RPM installations when a destination path was a symbolic     link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files     being placed in an arbitrary destination. An attacker, with write access to a directory in which a     subdirectory will be installed, could redirect that directory to an arbitrary location and gain root     privilege. (CVE-2017-7500)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the version of the rpm packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It was found that rpm did not properly handle RPM     installations when a destination path was a symbolic     link to a directory, possibly changing ownership and     permissions of an arbitrary directory, and RPM files     being placed in an arbitrary destination. An attacker,     with write access to a directory in which a     subdirectory will be installed, could redirect that     directory to an arbitrary location and gain root     privilege.(CVE-2017-7500)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for rpm fixes the following issues :

This security vulnerability was fixed :

  - CVE-2017-7500: Fixed symlink attacks during RPM     installation (bsc#943457)

This update was imported from the SUSE:SLE-15:Update update project.

An update of the rpm package has been released.

This update for rpm fixes the following issues: This security vulnerability was fixed :

  - CVE-2017-7500: Fixed symlink attacks during RPM     installation (bsc#943457)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for rpm fixes the following issues :

These security issues were fixed :

CVE-2017-7500: rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination (bsc#943457).

CVE-2017-7501: rpm used temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation (bsc#943457)

This is a reissue of the above security fixes for SUSE Linux Enterprise 12 GA, SP1 and SP2 LTSS, they have already been released for SUSE Linux Enterprise Server 12 SP3.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for rpm fixes the following issues :

These security issues were fixed :

  - CVE-2017-7500: rpm did not properly handle RPM     installations when a destination path was a symbolic     link to a directory, possibly changing ownership and     permissions of an arbitrary directory, and RPM files     being placed in an arbitrary destination (bsc#943457).

  - CVE-2017-7501: rpm used temporary files with predictable     names when installing an RPM. An attacker with ability     to write in a directory where files will be installed     could create symbolic links to an arbitrary location and     modify content, and possibly permissions to arbitrary     files, which could be used for denial of service or     possibly privilege escalation (bsc#943457)

This non-security issue was fixed :

  - Use ksym-provides tool [bsc#1077692]

This update was imported from the SUSE:SLE-12:Update update project.

This update for rpm fixes the following issues :

These security issues were fixed :

CVE-2017-7500: rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination (bsc#943457).

CVE-2017-7501: rpm used temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation (bsc#943457)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This latest stable release on rpm 4.13.x branch brings in several important bugfixes. For details see release notes at http://rpm.org/wiki/Releases/4.13.0.2.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198569	RHEL 5 : rpm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198479	RHEL 7 : rpm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198468	RHEL 6 : rpm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
195681	RHEL 7 : rpm (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195653	RHEL 6 : rpm (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195642	RHEL 5 : rpm (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
132193	EulerOS 2.0 SP3 : rpm (EulerOS-SA-2019-2658)	Nessus	Huawei Local Security Checks	high
131876	EulerOS 2.0 SP2 : rpm (EulerOS-SA-2019-2384)	Nessus	Huawei Local Security Checks	high
123243	openSUSE Security Update : rpm (openSUSE-2019-564)	Nessus	SuSE Local Security Checks	high
122006	Photon OS 2.0: Rpm PHSA-2018-2.0-0108	Nessus	PhotonOS Local Security Checks	high
121897	Photon OS 1.0: Rpm PHSA-2018-1.0-0194	Nessus	PhotonOS Local Security Checks	high
120062	SUSE SLED15 / SLES15 Security Update : rpm (SUSE-SU-2018:2073-1)	Nessus	SuSE Local Security Checks	high
119145	SUSE SLED12 / SLES12 Security Update : rpm (SUSE-SU-2018:3884-1)	Nessus	SuSE Local Security Checks	high
118382	openSUSE Security Update : rpm (openSUSE-2018-1246)	Nessus	SuSE Local Security Checks	high
118319	SUSE SLED12 / SLES12 Security Update : rpm (SUSE-SU-2018:3286-1)	Nessus	SuSE Local Security Checks	high
111570	openSUSE Security Update : rpm (openSUSE-2018-808)	Nessus	SuSE Local Security Checks	high
104828	Fedora 25 : rpm (2017-ab57a100f3)	Nessus	Fedora Local Security Checks	high
104447	Fedora 26 : rpm (2017-9232eac8e8)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2017-7500

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high