systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors involving creation of a directory and a file under that directory, and later replacing that directory with a symlink. This occurs even if the fs.protected_symlinks sysctl is turned on.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - systemd: Mishandled symlinks in systemd-tmpfiles allows local users to obtain ownership of arbitrary files     (CVE-2018-6954)

  - systemd, when updating file permissions, allows local users to change the permissions and SELinux security     contexts for arbitrary files via a symlink attack on unspecified files. (CVE-2013-4392)

  - The machinectl command in oci-register-machine allows local users to list running containers and possibly     obtain sensitive information by running that command. (CVE-2016-6349)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the version of the systemd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - systemd-tmpfiles in systemd through 237 mishandles     symlinks present in non-terminal path components, which     allows local users to obtain ownership of arbitrary     files via vectors involving creation of a directory and     a file under that directory, and later replacing that     directory with a symlink. This occurs even if the     fs.protected_symlinks sysctl is turned     on.(CVE-2018-6954)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It has been discovered that systemd-tmpfiles mishandles     symbolic links present in non-terminal path components.
    In some configurations a local user could use this     vulnerability to get access to arbitrary files when the     systemd-tmpfiles command is run.(CVE-2018-6954)

  - An out of bounds read was discovered in     systemd-journald in the way it parses log messages that     terminate with a colon ':'. A local attacker can use     this flaw to disclose process memory     data.(CVE-2018-16866)

  - A vulnerability in unit_deserialize of systemd allows     an attacker to supply arbitrary state across systemd     re-execution via NotifyAccess. This can be used to     improperly influence systemd execution and possibly     lead to root privilege escalation. (CVE-2018-15686)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the systemd packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that pam_systemd does not properly     sanitize the environment before using the XDG_SEAT     variable. It is possible for an attacker, in some     particular configurations, to set a XDG_SEAT     environment variable which allows for commands to be     checked against polkit policies using the     'allow_active' element rather than     'allow_any'.(CVE-2019-3842)

  - It has been discovered that systemd-tmpfiles mishandles     symbolic links present in non-terminal path components.
    In some configurations a local user could use this     vulnerability to get access to arbitrary files when the     systemd-tmpfiles command is run.(CVE-2018-6954)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It has been discovered that systemd-tmpfiles mishandles     symbolic links present in non-terminal path components.
    In some configurations a local user could use this     vulnerability to get access to arbitrary files when the     systemd-tmpfiles command is run.(CVE-2018-6954)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It has been discovered that systemd-tmpfiles mishandles     symbolic links present in non-terminal path components.
    In some configurations a local user could use this     vulnerability to get access to arbitrary files when the     systemd-tmpfiles command is run.(CVE-2018-6954)

  - In systemd before v242-rc4, it was discovered that     pam_systemd does not properly sanitize the environment     before using the XDG_SEAT variable. It is possible for     an attacker, in some particular configurations, to set     a XDG_SEAT environment variable which allows for     commands to be checked against polkit policies using     the 'allow_active' element rather than     'allow_any'.(CVE-2019-3842)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the systemd package has been released.

This update for systemd fixes the following issues :

Security issues fixed :

  - CVE-2018-6954: Fixed a vulnerability in the symlink     handling of systemd-tmpfiles which allowed a local user     to obtain ownership of arbitrary files (bsc#1080919).

  - CVE-2019-3842: Fixed a vulnerability in pam_systemd     which allowed a local user to escalate privileges     (bsc#1132348).

  - CVE-2019-6454: Fixed a denial of service caused by long     dbus messages (bsc#1125352).

Non-security issues fixed :

  - systemd-coredump: generate a stack trace of all core     dumps (jsc#SLE-5933)

  - udevd: notify when max number value of children is     reached only once per batch of events (bsc#1132400)

  - sd-bus: bump message queue size again (bsc#1132721)

  - core: only watch processes when it's really necessary     (bsc#955942 bsc#1128657)

  - rules: load drivers only on 'add' events (bsc#1126056)

  - sysctl: Don't pass null directive argument to '%s'     (bsc#1121563)

  - Do not automatically online memory on s390x     (bsc#1127557)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for systemd fixes the following issues :

Security issues fixed :

CVE-2018-6954: Fixed a vulnerability in the symlink handling of systemd-tmpfiles which allowed a local user to obtain ownership of arbitrary files (bsc#1080919).

CVE-2019-3842: Fixed a vulnerability in pam_systemd which allowed a local user to escalate privileges (bsc#1132348).

CVE-2019-6454: Fixed a denial of service caused by long dbus messages (bsc#1125352).

Non-security issues fixed: systemd-coredump: generate a stack trace of all core dumps (jsc#SLE-5933)

udevd: notify when max number value of children is reached only once per batch of events (bsc#1132400)

sd-bus: bump message queue size again (bsc#1132721)

core: only watch processes when it's really necessary (bsc#955942 bsc#1128657)

rules: load drivers only on 'add' events (bsc#1126056)

sysctl: Don't pass null directive argument to '%s' (bsc#1121563)

Do not automatically online memory on s390x (bsc#1127557)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for systemd provides the following fixes :

Security issues fixed :

  - CVE-2018-16864, CVE-2018-16865: Fixed two memory     corruptions through attacker-controlled alloca()s     (bsc#1120323)

  - CVE-2018-16866: Fixed an information leak in journald     (bsc#1120323)

  - CVE-2018-6954: Fix mishandling of symlinks present in     non-terminal path components (bsc#1080919)

  - Fixed an issue during system startup in relation to     encrypted swap disks (bsc#1119971)

Non-security issues fixed :

  - pam_systemd: Fix 'Cannot create session: Already running     in a session' (bsc#1111498)

  - systemd-vconsole-setup: vconsole setup fails, fonts will     not be copied to tty (bsc#1114933)

  - systemd-tmpfiles-setup: symlinked /tmp to /var/tmp     breaking multiple units (bsc#1045723)

  - Fixed installation issue with /etc/machine-id during     update (bsc#1117063)

  - btrfs: qgroups are assigned to parent qgroups after     reboot (bsc#1093753)

  - logind: Stop managing VT switches if no sessions are     registered on that VT. (bsc#1101591)

  - udev: Downgrade message when settting inotify watch up     fails. (bsc#1005023)

  - udev: Ignore the exit code of systemd-detect-virt for     memory hot-add. In SLE-12-SP3, 80-hotplug-cpu-mem.rules     has a memory hot-add rule that uses systemd-detect-virt     to detect non-zvm environment. The systemd-detect-virt     returns exit failure code when it detected _none_ state.
    The exit failure code causes that the hot-add memory     block can not be set to online. (bsc#1076696) This     update was imported from the SUSE:SLE-15:Update update     project.

This update for systemd provides the following fixes :

Security issues fixed :

CVE-2018-16864, CVE-2018-16865: Fixed two memory corruptions through attacker-controlled alloca()s (bsc#1120323)

CVE-2018-16866: Fixed an information leak in journald (bsc#1120323)

CVE-2018-6954: Fix mishandling of symlinks present in non-terminal path components (bsc#1080919)

Fixed an issue during system startup in relation to encrypted swap disks (bsc#1119971)

Non-security issues fixed: pam_systemd: Fix 'Cannot create session:
Already running in a session' (bsc#1111498)

systemd-vconsole-setup: vconsole setup fails, fonts will not be copied to tty (bsc#1114933)

systemd-tmpfiles-setup: symlinked /tmp to /var/tmp breaking multiple units (bsc#1045723)

Fixed installation issue with /etc/machine-id during update (bsc#1117063)

btrfs: qgroups are assigned to parent qgroups after reboot (bsc#1093753)

logind: Stop managing VT switches if no sessions are registered on that VT. (bsc#1101591)

udev: Downgrade message when settting inotify watch up fails.
(bsc#1005023)

udev: Ignore the exit code of systemd-detect-virt for memory hot-add.
In SLE-12-SP3, 80-hotplug-cpu-mem.rules has a memory hot-add rule that uses systemd-detect-virt to detect non-zvm environment. The systemd-detect-virt returns exit failure code when it detected _none_ state. The exit failure code causes that the hot-add memory block can not be set to online. (bsc#1076696)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3816-2 advisory.

    USN-3816-1 fixed several vulnerabilities in systemd. However, the fix for CVE-2018-6954 was not     sufficient. This update provides the remaining fixes.

    We apologize for the inconvenience.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3816-1 advisory.

    Jann Horn discovered that unit_deserialize incorrectly handled status messages above a certain length. A     local attacker could potentially exploit this via NotifyAccess to inject arbitrary state across re-     execution and obtain root privileges. (CVE-2018-15686)

    Jann Horn discovered a race condition in chown_one(). A local attacker could potentially exploit this by     setting arbitrary permissions on certain files to obtain root privileges. This issue only affected Ubuntu     18.04 LTS and Ubuntu 18.10. (CVE-2018-15687)

    It was discovered that systemd-tmpfiles mishandled symlinks in non-terminal path components. A local     attacker could potentially exploit this by gaining ownership of certain files to obtain root privileges.
    This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-6954)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199660	RHEL 7 : systemd (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
195801	RHEL 7 : systemd (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
141672	EulerOS Virtualization 3.0.2.2 : systemd (EulerOS-SA-2020-2221)	Nessus	Huawei Local Security Checks	high
129191	EulerOS 2.0 SP3 : systemd (EulerOS-SA-2019-1998)	Nessus	Huawei Local Security Checks	high
128926	EulerOS Virtualization for ARM 64 3.0.2.0 : systemd (EulerOS-SA-2019-1923)	Nessus	Huawei Local Security Checks	high
128924	EulerOS 2.0 SP2 : systemd (EulerOS-SA-2019-1872)	Nessus	Huawei Local Security Checks	high
128100	EulerOS 2.0 SP5 : systemd (EulerOS-SA-2019-1808)	Nessus	Huawei Local Security Checks	high
126473	Photon OS 2.0: Systemd PHSA-2019-2.0-0166	Nessus	PhotonOS Local Security Checks	high
125453	openSUSE Security Update : systemd (openSUSE-2019-1450)	Nessus	SuSE Local Security Checks	high
125244	SUSE SLED12 / SLES12 Security Update : systemd (SUSE-SU-2019:1265-1)	Nessus	SuSE Local Security Checks	high
125160	Photon OS 1.0: Systemd PHSA-2019-1.0-0220	Nessus	PhotonOS Local Security Checks	high
121464	openSUSE Security Update : systemd (openSUSE-2019-98)	Nessus	SuSE Local Security Checks	high
121304	SUSE SLED15 / SLES15 Security Update : systemd (SUSE-SU-2019:0137-1)	Nessus	SuSE Local Security Checks	high
119043	Ubuntu 16.04 LTS / 18.04 LTS : systemd vulnerability (USN-3816-2)	Nessus	Ubuntu Local Security Checks	high
118907	Ubuntu 16.04 LTS / 18.04 LTS : systemd vulnerabilities (USN-3816-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2018-6954

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high