Unspecified tests in Lynis before 2.5.0 allow local users to write to arbitrary files or possibly gain privileges via a symlink attack on a temporary file.

Unspecified tests in Lynis before 2.5.0 allow local users to write to arbitrary files or possibly gain privileges via a symlink attack on a temporary file. (CVE-2017-8108)

This update for lynis fixes the following issues :

Lynis 2.5.1 :

  - Improved detection of SSL certificate files

  - Minor changes to improve logging and results

  - Firewall tests: Determine if CSF is in testing mode

The Update also includes changes from Lynis 2.5.0 :

  - CVE-2017-8108: symlink attack may have allowed arbitrary     file overwrite or privilege escalation (boo#1043463)

  - Deleted unused tests from database file

  - Additional sysctls are tested

  - Extended test with Symantec components

  - Snort detection

  - Snort configuration file

The update also includes Lynis 2.4.8 (Changelog from 2.4.1)

  - More PHP paths added

  - Minor changes to text

  - Show atomic test in report

  - Added FileInstalledByPackage function (dpkg and rpm     supported)

  - Mark Arch Linux version as rolling release (instead of     unknown)

  - Support for Manjaro Linux

  - Escape files when testing if they are readable

  - Code cleanups

  - Allow host alias to be specified in profile

  - Code readability enhancements

  - Solaris support has been improved

  - Fix for upload function to be used from profile

  - Reduce screen output for mail section, unless --verbose     is used

  - Code cleanups and removed 'update release' command

  - Colored output can now be tuned with profile     (colors=yes/no)

  - Allow data upload to be set as a profile option

  - Properly detect SSH daemon version

  - Generic code improvements

  - Improved the update check and display

  - Finish, Portuguese, and Turkish translation

  - Extended support and tests for DragonFlyBSD

  - Option to configure hostid and hostid2 in profile

  - Support for Trend Micro and Cylance (macOS)

  - Remove comments at end of nginx configuration

  - Used machine ID to create host ID when no SSH keys are     available

  - Added detection of iptables-save to binaries

And Lynis 2.4.0 

  - Mainly improved support for macOS users

  - Support for CoreOS

  - Support for clamconf utility

  - Support for chinese translation

  - More sysctl values in the default profile

  - New commands: 'upload-only', 'show hostids', 'show     environment', 'show os'

Update to 2.5.0 / https://cisofy.com/security/cve/cve-2017-8108/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
101000	Amazon Linux AMI : lynis (ALAS-2017-847)	Nessus	Amazon Linux Local Security Checks	high
100863	openSUSE Security Update : lynis (openSUSE-2017-705)	Nessus	SuSE Local Security Checks	high
100495	Fedora 24 : lynis (2017-c3ce061ea7)	Nessus	Fedora Local Security Checks	high
100492	Fedora 25 : lynis (2017-8d625a8d2b)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2017-8108

high

Tenable Plugins

high

high

high

high