It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - file: Buffer over-write in finfo_open with malformed magic file (CVE-2015-8865)

  - rpm: Following symlinks to files when installing packages allows privilege escalation (CVE-2017-7501)

  - softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of     service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable.
    (CVE-2014-2270)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - file: Buffer over-write in finfo_open with malformed magic file (CVE-2015-8865)

  - rpm: Following symlinks to files when installing packages allows privilege escalation (CVE-2017-7501)

  - The ELF parser in file 5.08 through 5.21 allows remote attackers to cause a denial of service via a large     number of notes. (CVE-2014-9620)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - file: Buffer over-write in finfo_open with malformed magic file (CVE-2015-8865)

  - rpm: Following symlinks to files when installing packages allows privilege escalation (CVE-2017-7501)

  - It was found that rpm did not properly handle RPM installations when a destination path was a symbolic     link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files     being placed in an arbitrary destination. An attacker, with write access to a directory in which a     subdirectory will be installed, could redirect that directory to an arbitrary location and gain root     privilege. (CVE-2017-7500)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the version of the rpm packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - It was found that rpm uses temporary files with     predictable names when installing an RPM. An attacker     with ability to write in a directory where files will     be installed could create symbolic links to an     arbitrary location and modify content, and possibly     permissions to arbitrary files, which could be used for     denial of service or possibly privilege     escalation.(CVE-2017-7501)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the rpm packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - It was found that rpm uses temporary files with     predictable names when installing an RPM. An attacker     with ability to write in a directory where files will     be installed could create symbolic links to an     arbitrary location and modify content, and possibly     permissions to arbitrary files, which could be used for     denial of service or possibly privilege     escalation.(CVE-2017-7501)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the rpm packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - It was found that rpm uses temporary files with     predictable names when installing an RPM. An attacker     with ability to write in a directory where files will     be installed could create symbolic links to an     arbitrary location and modify content, and possibly     permissions to arbitrary files, which could be used for     denial of service or possibly privilege     escalation.i1/4^CVE-2017-7501i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the rpm packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It was found that rpm uses temporary files with     predictable names when installing an RPM. An attacker     with ability to write in a directory where files will     be installed could create symbolic links to an     arbitrary location and modify content, and possibly     permissions to arbitrary files, which could be used for     denial of service or possibly privilege     escalation.(CVE-2017-7501)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the rpm package has been released.

The remote host is affected by the vulnerability described in GLSA-201811-22 (RPM: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in RPM. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by enticing the user to process a specially crafted       RPM file, could escalate privileges, execute arbitrary code, or cause a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for rpm fixes the following issues :

These security issues were fixed :

CVE-2017-7500: rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination (bsc#943457).

CVE-2017-7501: rpm used temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation (bsc#943457)

This is a reissue of the above security fixes for SUSE Linux Enterprise 12 GA, SP1 and SP2 LTSS, they have already been released for SUSE Linux Enterprise Server 12 SP3.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for rpm fixes the following issues :

These security issues were fixed :

  - CVE-2017-7500: rpm did not properly handle RPM     installations when a destination path was a symbolic     link to a directory, possibly changing ownership and     permissions of an arbitrary directory, and RPM files     being placed in an arbitrary destination (bsc#943457).

  - CVE-2017-7501: rpm used temporary files with predictable     names when installing an RPM. An attacker with ability     to write in a directory where files will be installed     could create symbolic links to an arbitrary location and     modify content, and possibly permissions to arbitrary     files, which could be used for denial of service or     possibly privilege escalation (bsc#943457)

This non-security issue was fixed :

  - Use ksym-provides tool [bsc#1077692]

This update was imported from the SUSE:SLE-12:Update update project.

This update for rpm fixes the following issues :

These security issues were fixed :

CVE-2017-7500: rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination (bsc#943457).

CVE-2017-7501: rpm used temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation (bsc#943457)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This latest stable release on rpm 4.13.x branch brings in several important bugfixes. For details see release notes at http://rpm.org/wiki/Releases/4.13.0.2.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198569	RHEL 5 : rpm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198479	RHEL 7 : rpm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198468	RHEL 6 : rpm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
195681	RHEL 7 : rpm (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195653	RHEL 6 : rpm (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195642	RHEL 5 : rpm (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
125568	EulerOS Virtualization for ARM 64 3.0.2.0 : rpm (EulerOS-SA-2019-1616)	Nessus	Huawei Local Security Checks	high
124969	EulerOS Virtualization 3.0.1.0 : rpm (EulerOS-SA-2019-1466)	Nessus	Huawei Local Security Checks	high
123896	EulerOS Virtualization 2.5.4 : rpm (EulerOS-SA-2019-1210)	Nessus	Huawei Local Security Checks	high
122216	EulerOS 2.0 SP3 : rpm (EulerOS-SA-2019-1043)	Nessus	Huawei Local Security Checks	high
121787	Photon OS 1.0: Rpm PHSA-2017-1.0-0095	Nessus	PhotonOS Local Security Checks	high
120999	EulerOS 2.0 SP5 : rpm (EulerOS-SA-2019-1011)	Nessus	Huawei Local Security Checks	high
119276	GLSA-201811-22 : RPM: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
119145	SUSE SLED12 / SLES12 Security Update : rpm (SUSE-SU-2018:3884-1)	Nessus	SuSE Local Security Checks	high
118736	EulerOS 2.0 SP2 : rpm (EulerOS-SA-2018-1353)	Nessus	Huawei Local Security Checks	high
118382	openSUSE Security Update : rpm (openSUSE-2018-1246)	Nessus	SuSE Local Security Checks	high
118319	SUSE SLED12 / SLES12 Security Update : rpm (SUSE-SU-2018:3286-1)	Nessus	SuSE Local Security Checks	high
104828	Fedora 25 : rpm (2017-ab57a100f3)	Nessus	Fedora Local Security Checks	high
104447	Fedora 26 : rpm (2017-9232eac8e8)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2017-7501

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high