Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing). The issue was found in policycoreutils 2.5-11.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - policycoreutils: Relabelling of symbolic links in /tmp and /var/tmp change the context of their target     instead (CVE-2018-1063)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

According to the version of the policycoreutils packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - Context relabeling of filesystems is vulnerable to     symbolic link attack, allowing a local, unprivileged     malicious entity to change the SELinux context of an     arbitrary file to a context with few restrictions. This     only happens when the relabeling process is done,     usually when taking SELinux state from disabled to     enable (permissive or enforcing)(CVE-2018-1063)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the policycoreutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Context relabeling of filesystems is vulnerable to     symbolic link attack, allowing a local, unprivileged     malicious entity to change the SELinux context of an     arbitrary file to a context with few restrictions. This     only happens when the relabeling process is done,     usually when taking SELinux state from disabled to     enable (permissive or enforcing). The issue was found     in policycoreutils 2.5-11.(CVE-2018-1063)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has policycoreutils packages installed that are affected by a vulnerability:

  - Context relabeling of filesystems is vulnerable to     symbolic link attack, allowing a local, unprivileged     malicious entity to change the SELinux context of an     arbitrary file to a context with few restrictions. This     only happens when the relabeling process is done,     usually when taking SELinux state from disabled to     enable (permissive or enforcing). (CVE-2018-1063)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing).(CVE-2018-1063)

Security Fix(es) :

  - policycoreutils: Relabelling of symbolic links in /tmp     and /var/tmp change the context of their target instead     (CVE-2018-1063)

This issue was discovered by Renaud Mtrich (Red Hat).

Additional Changes :

An update for policycoreutils is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The policycoreutils packages contain the core policy utilities required to manage a SELinux environment.

Security Fix(es) :

* policycoreutils: Relabelling of symbolic links in /tmp and /var/tmp change the context of their target instead (CVE-2018-1063)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

This issue was discovered by Renaud Metrich (Red Hat).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-0913 advisory.

    [2.5-22.0.1]
    - Lazy unmount private, shared entry (Joe Jin) [orabug 12560705]

    [2.5-22]
    - semanage: Fix fcontext help message (#1499259)
    - semanage: Improve semanage-user.8 man page (#1079946)
    - semodule: Improve man page (#1337192)

    [2.5-21]
    - Update translations

    [2.5-20]
    - setfiles: Mention customizable types in restorecon man page (#1260238)
    - sepolicy: do not fail when file_contexts.local or .subs do not exist (#1512590)
    - semanage: Fix export of ibendport entries (#1471809)

    [2.5-19]
    - semanage: Call semanage_set_reload only if -N is used (#1421160)

    [2.5-18]
    - semanage: Enable listing file_contexts.homedirs
    - semanage: Fix manpage author for ibpkey and ibendport pages.
    - semanage: Update man pages for infiniband
    - semanage: Update semanage to allow runtime labeling of ibendports
    - semanage: Update semanage to allow runtime labeling of Infiniband Pkeys
    - semanage: Improve semanage-port man page
    - fixfiles: do not dereference link files in tmp

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for policycoreutils fixes the following issues :

  - CVE-2018-1063: Fixed problem to prevent chcon from     following symlinks in /tmp, /var/tmp, /var/run and     /var/lib/debug (bsc#1083624).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for policycoreutils fixes the following issues :

  - CVE-2018-1063: Prevent chcon from following symlinks in     /tmp, /var/tmp, /var/run and /var/lib/debug     (bsc#1083624).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for policycoreutils fixes the following issues :

  - CVE-2018-1063: Fixed problem to prevent chcon from     following symlinks in /tmp, /var/tmp, /var/run and     /var/lib/debug (bsc#1083624).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:0913 advisory.

  - policycoreutils: Relabelling of symbolic links in /tmp and /var/tmp change the context of their target     instead (CVE-2018-1063)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199816	RHEL 6 : policycoreutils (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
147539	EulerOS Virtualization for ARM 64 3.0.2.0 : policycoreutils (EulerOS-SA-2021-1395)	Nessus	Huawei Local Security Checks	medium
135552	EulerOS 2.0 SP3 : policycoreutils (EulerOS-SA-2020-1423)	Nessus	Huawei Local Security Checks	medium
131892	EulerOS 2.0 SP2 : policycoreutils (EulerOS-SA-2019-2400)	Nessus	Huawei Local Security Checks	medium
127195	NewStart CGSL CORE 5.04 / MAIN 5.04 : policycoreutils Vulnerability (NS-SA-2019-0030)	Nessus	NewStart CGSL Local Security Checks	medium
117590	Amazon Linux 2 : policycoreutils (ALAS-2018-1076)	Nessus	Amazon Linux Local Security Checks	medium
109457	Scientific Linux Security Update : policycoreutils on SL7.x x86_64 (20180410)	Nessus	Scientific Linux Local Security Checks	medium
109377	CentOS 7 : policycoreutils (CESA-2018:0913)	Nessus	CentOS Local Security Checks	medium
109110	Oracle Linux 7 : policycoreutils (ELSA-2018-0913)	Nessus	Oracle Linux Local Security Checks	medium
109023	openSUSE Security Update : policycoreutils (openSUSE-2018-362)	Nessus	SuSE Local Security Checks	medium
109015	SUSE SLES11 Security Update : policycoreutils (SUSE-SU-2018:0927-1)	Nessus	SuSE Local Security Checks	medium
109014	SUSE SLES12 Security Update : policycoreutils (SUSE-SU-2018:0926-1)	Nessus	SuSE Local Security Checks	medium
108991	RHEL 7 : policycoreutils (RHSA-2018:0913)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2018-1063

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium