CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2106-1 advisory.

  - Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before     2018.3.3 allows remote attackers to determine which files exist on the server. (CVE-2018-15750)

  - SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass     authentication and execute arbitrary commands via salt-api(netapi). (CVE-2018-15751)

  - An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process     ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods     without authentication. These methods can be used to retrieve user tokens from the salt master and/or run     arbitrary commands on salt minions. (CVE-2020-11651)

  - An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process     ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow     arbitrary directory access to authenticated users. (CVE-2020-11652)

  - In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can     bypass authentication and invoke Salt SSH. (CVE-2020-25592)

  - A Incorrect Implementation of Authentication Algorithm vulnerability in of SUSE SUSE Linux Enterprise     Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the     need to specify valid credentials. This issue affects: SUSE SUSE Linux Enterprise Server 15 SP 3 salt     versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.
    (CVE-2021-25315)

  - In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module     that allows for local privilege escalation on a minion. The attack requires that a file is created with a     pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes     popen unsafely). (CVE-2021-31607)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:0899-1 advisory.

  - Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before     2018.3.3 allows remote attackers to determine which files exist on the server. (CVE-2018-15750)

  - SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass     authentication and execute arbitrary commands via salt-api(netapi). (CVE-2018-15751)

  - An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process     ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods     without authentication. These methods can be used to retrieve user tokens from the salt master and/or run     arbitrary commands on salt minions. (CVE-2020-11651)

  - An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process     ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow     arbitrary directory access to authenticated users. (CVE-2020-11652)

  - In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can     bypass authentication and invoke Salt SSH. (CVE-2020-25592)

  - A Incorrect Implementation of Authentication Algorithm vulnerability in of SUSE SUSE Linux Enterprise     Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the     need to specify valid credentials. This issue affects: SUSE SUSE Linux Enterprise Server 15 SP 3 salt     versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.
    (CVE-2021-25315)

  - In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module     that allows for local privilege escalation on a minion. The attack requires that a file is created with a     pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes     popen unsafely). (CVE-2021-31607)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the salt3 package has been released.

ID	Name	Product	Family	Severity
151732	openSUSE 15 Security Update : salt (openSUSE-SU-2021:2106-1)	Nessus	SuSE Local Security Checks	critical
151062	openSUSE 15 Security Update : salt (openSUSE-SU-2021:0899-1)	Nessus	SuSE Local Security Checks	critical
150920	Photon OS 4.0: Salt3 PHSA-2021-4.0-0047	Nessus	PhotonOS Local Security Checks	critical

Detections

Analytics

CVE-2021-25315

high

Tenable Plugins

critical

critical

critical