In supportutils, before version 3.1-5.7.1 and if pacemaker is installed on the system, an unprivileged user could have overwritten arbitrary files in the directory that is used by supportutils to collect the log files.

The remote SUSE Linux SLES11 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2019:13976-1 advisory.

  - Supportutils, before version 3.1-5.7.1, when run with command line argument -A searched the file system     for a ndspath binary. If an attacker provides one at an arbitrary location it is executed with root     privileges (CVE-2018-19636)

  - In supportutils, before version 3.1-5.7.1 and if pacemaker is installed on the system, an unprivileged     user could have overwritten arbitrary files in the directory that is used by supportutils to collect the     log files. (CVE-2018-19638)

  - If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the attacker     manages to manipulate the rpm listing (e.g. with CVE-2018-19638) he can execute arbitrary commands as     root. (CVE-2018-19639)

  - If the attacker manages to create files in the directory used to collect log files in supportutils before     version 3.1-5.7.1 (e.g. with CVE-2018-19638) he can kill arbitrary processes on the local machine.
    (CVE-2018-19640)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for hostinfo, supportutils fixes the following issues:
&#9; Security issues fixed for supportutils :

  - CVE-2018-19640: Fixed an issue where users could kill     arbitrary processes (bsc#1118463).

  - CVE-2018-19638: Fixed an issue where users could     overwrite arbitrary log files (bsc#1118460).

  - CVE-2018-19639: Fixed a code execution if run with -v     (bsc#1118462).

  - CVE-2018-19637: Fixed an issue where static temporary     filename could allow overwriting of files (bsc#1117776).

  - CVE-2018-19636: Fixed a local root exploit via inclusion     of attacker controlled shell script (bsc#1117751).

Other issues fixed for supportutils :

  - Fixed invalid exit code commands (bsc#1125666)

  - SUSE separation in supportconfig (bsc#1125623)

  - Clarified supportconfig(8) -x option (bsc#1115245)

  - supportconfig: 3.0.127

  - btrfs filesystem usage

  - List products.d

  - Dump lsof errors

  - Added ha commands for corosync

  - Dumped find errors in ib_info

Issues fixed in hostinfo :

  - Removed extra kernel install dates (bsc#1099498)

  - Resolved network bond issue (bsc#1054979)

This update was imported from the SUSE:SLE-12:Update update project.

This update for supportutils fixes the following issues :

Security issues fixed :

  - CVE-2018-19640: Fixed an issue where users could kill     arbitrary processes (bsc#1118463).

  - CVE-2018-19638: Fixed an issue where users could     overwrite arbitrary log files (bsc#1118460).

  - CVE-2018-19639: Fixed a code execution if run with -v     (bsc#1118462).

  - CVE-2018-19637: Fixed an issue where static temporary     filename could allow overwriting of files (bsc#1117776).

Other issues fixed :

  - Fixed invalid exit code commands (bsc#1125666).

  - Included additional SUSE separation (bsc#1125609).

  - Merged added listing of locked packes by zypper.

  - Exclude pam.txt per GDPR by default (bsc#1112461).&#9; 

  - Clarified -x functionality in supportconfig(8)     (bsc#1115245).&#9; 

  - udev service and provide the whole journal content in     supportconfig (bsc#1051797).

  - supportconfig collects tuned profile settings     (bsc#1071545).

  - sfdisk -d no disk device specified (bsc#1043311).

  - Added vulnerabilites status check in basic-health.txt     (bsc#1105849).

  - Added only sched_domain from cpu0.

  - Blacklist sched_domain from proc.txt (bsc#1046681).

  - Added firewall-cmd info.

  - Add ls -lA --time-style=long-iso /etc/products.d/

  - Dump lsof errors.

  - Added corosync status to ha_info.

  - Dump find errors in ib_info.

This update was imported from the SUSE:SLE-15:Update update project.

ID	Name	Product	Family	Severity
150628	SUSE SLES11 Security Update : supportutils (SUSE-SU-2019:13976-1)	Nessus	SuSE Local Security Checks	high
124712	openSUSE Security Update : hostinfo / supportutils (openSUSE-2019-1351)	Nessus	SuSE Local Security Checks	high
122643	openSUSE Security Update : supportutils (openSUSE-2019-293)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2018-19638

medium

Tenable Plugins

high

high

high