Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file, which allows local attackers to inject Sudo rules and escalate privileges to root. This occurs in certain situations involving a race condition.

The version of Amazon SSM Agent installed on the remote host is prior to 3.1.1208.0. It is, therefore, affected by a vulnerability as referenced in the advisory.

  - Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file, which allows local     attackers to inject Sudo rules and escalate privileges to root. This occurs in certain situations     involving a race condition. (CVE-2022-29527)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:3654-1 advisory.

  - Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file, which allows local     attackers to inject Sudo rules and escalate privileges to root. This occurs in certain situations     involving a race condition. (CVE-2022-29527)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:1510-1 advisory.

  - Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file, which allows local     attackers to inject Sudo rules and escalate privileges to root. This occurs in certain situations     involving a race condition. (CVE-2022-29527)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
191491	Amazon SSM Agent < 3.1.1208.0	Nessus	Misc.	high
166295	SUSE SLES12 Security Update : amazon-ssm-agent (SUSE-SU-2022:3654-1)	Nessus	SuSE Local Security Checks	high
160488	SUSE SLES15 Security Update : amazon-ssm-agent (SUSE-SU-2022:1510-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2022-29527

high

Tenable Plugins

high

high

high