Supportutils, before version 3.1-5.7.1, when run with command line argument -A searched the file system for a ndspath binary. If an attacker provides one at an arbitrary location it is executed with root privileges

The remote SUSE Linux SLES11 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2019:13976-1 advisory.

  - Supportutils, before version 3.1-5.7.1, when run with command line argument -A searched the file system     for a ndspath binary. If an attacker provides one at an arbitrary location it is executed with root     privileges (CVE-2018-19636)

  - In supportutils, before version 3.1-5.7.1 and if pacemaker is installed on the system, an unprivileged     user could have overwritten arbitrary files in the directory that is used by supportutils to collect the     log files. (CVE-2018-19638)

  - If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the attacker     manages to manipulate the rpm listing (e.g. with CVE-2018-19638) he can execute arbitrary commands as     root. (CVE-2018-19639)

  - If the attacker manages to create files in the directory used to collect log files in supportutils before     version 3.1-5.7.1 (e.g. with CVE-2018-19638) he can kill arbitrary processes on the local machine.
    (CVE-2018-19640)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for hostinfo, supportutils fixes the following issues:
&#9; Security issues fixed for supportutils :

  - CVE-2018-19640: Fixed an issue where users could kill     arbitrary processes (bsc#1118463).

  - CVE-2018-19638: Fixed an issue where users could     overwrite arbitrary log files (bsc#1118460).

  - CVE-2018-19639: Fixed a code execution if run with -v     (bsc#1118462).

  - CVE-2018-19637: Fixed an issue where static temporary     filename could allow overwriting of files (bsc#1117776).

  - CVE-2018-19636: Fixed a local root exploit via inclusion     of attacker controlled shell script (bsc#1117751).

Other issues fixed for supportutils :

  - Fixed invalid exit code commands (bsc#1125666)

  - SUSE separation in supportconfig (bsc#1125623)

  - Clarified supportconfig(8) -x option (bsc#1115245)

  - supportconfig: 3.0.127

  - btrfs filesystem usage

  - List products.d

  - Dump lsof errors

  - Added ha commands for corosync

  - Dumped find errors in ib_info

Issues fixed in hostinfo :

  - Removed extra kernel install dates (bsc#1099498)

  - Resolved network bond issue (bsc#1054979)

This update was imported from the SUSE:SLE-12:Update update project.

ID	Name	Product	Family	Severity
150628	SUSE SLES11 Security Update : supportutils (SUSE-SU-2019:13976-1)	Nessus	SuSE Local Security Checks	high
124712	openSUSE Security Update : hostinfo / supportutils (openSUSE-2019-1351)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2018-19636

high

Tenable Plugins

high

high