Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data. This issue does not affect non-Unix platforms, or builds with APR_USE_SHMEM_SHMGET=1 (apr.h) Users are recommended to upgrade to APR version 1.7.5, which fixes this issue.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-789 advisory.

    Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read     access to named shared memory segments, potentially revealing sensitive application data.

    This issue does not affect non-Unix platforms, or builds with APR_USE_SHMEM_SHMGET=1 (apr.h)

    Users are recommended to upgrade to APR version 1.7.5, which fixes this issue. (CVE-2023-49582)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Security Center running on the remote host is prior to 6.5.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2024-19 advisory.

  - Security Center leverages third-party software to help provide underlying functionality. Several of the     third-party components (OpenSSL, PHP, Apache Portable Runtime) were found to contain vulnerabilities, and     updated versions have been made available by the providers.Out of caution and in line with best practice,     Tenable has opted to upgrade these components to address the potential impact of the issues. Security     Center 6.5.0 updates OpenSSL to version 3.0.15, PHP to version 8.2.24 and Apache Portable Runtime to     version 1.7.5 to address the identified vulnerabilities.Additionally, one separate vulnerability was     discovered, reported and fixed:An Improper Certificate Validation vulnerability exists in Tenable Security     Center where an authenticated, privileged attacker could intercept email messages sent from Security     Center via a rogue SMTP server. - CVE-2024-12174 Tenable has released Security Center 6.5.0 to address     these issues. The installation files can be obtained from the Tenable Downloads Portal:
    https://www.tenable.com/downloads/security-center (CVE-2023-49582, CVE-2024-12174, CVE-2024-4603,     CVE-2024-4741, CVE-2024-5458, CVE-2024-5535, CVE-2024-5585, CVE-2024-6119)

  - An Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated,     privileged attacker could intercept email messages sent from Security Center via a rogue SMTP server.
    (CVE-2024-12174)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the apr package has been released.

The version of April installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-49582 advisory.

  - Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read     access to named shared memory segments, potentially revealing sensitive application data. This issue does     not affect non-Unix platforms, or builds with APR_USE_SHMEM_SHMGET=1 (apr.h) Users are recommended to     upgrade tAprilPR version 1.7.5, which fixes this issue. (CVE-2023-49582)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7038-2 advisory.

    USN-7038-1 fixed a vulnerability in Apache Portable Runtime (APR) library. This update provides the     corresponding update for Ubuntu 14.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7038-1 advisory.

    Thomas Stangner discovered a permission vulnerability in the Apache

    Portable Runtime (APR) library. A local attacker could possibly use this issue to read named shared memory     segments, potentially exposing sensitive application data.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3429-1 advisory.

    - CVE-2023-49582: Fixed an unexpected lax shared memory permissions. (bsc#1229783)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3428-1 advisory.

    - CVE-2023-49582: Fixed an unexpected lax shared memory permissions. (bsc#1229783)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-318343049c advisory.

    This update to the `apr` package fixes a security issue in the handling of shared memory permissions.

         SECURITY: CVE-2023-49582: Apache Portable Runtime (APR):
         Unexpected lax shared memory permissions (cve.mitre.org)          Lax permissions set by the Apache Portable Runtime library on          Unix platforms would allow local users read access to named          shared memory segments, potentially revealing sensitive          application data.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-b40491b84b advisory.

    This update to the `apr` package fixes a security issue in the handling of shared memory permissions.

         SECURITY: CVE-2023-49582: Apache Portable Runtime (APR):
         Unexpected lax shared memory permissions (cve.mitre.org)          Lax permissions set by the Apache Portable Runtime library on          Unix platforms would allow local users read access to named          shared memory segments, potentially revealing sensitive          application data.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
212339	Amazon Linux 2023 : apr, apr-devel (ALAS2023-2024-789)	Nessus	Amazon Linux Local Security Checks	medium
212128	Tenable Security Center < 6.5.0 Multiple Vulnerabilities (TNS-2024-19)	Nessus	Misc.	high
211394	Photon OS 4.0: Apr PHSA-2024-4.0-0711	Nessus	PhotonOS Local Security Checks	medium
210125	CBL Mariner 2.0 Security Update: apr (CVE-2023-49582)	Nessus	MarinerOS Local Security Checks	medium
209119	Ubuntu 14.04 LTS : APR vulnerability (USN-7038-2)	Nessus	Ubuntu Local Security Checks	medium
207799	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : APR vulnerability (USN-7038-1)	Nessus	Ubuntu Local Security Checks	medium
207735	Photon OS 5.0: Apr PHSA-2024-5.0-0375	Nessus	PhotonOS Local Security Checks	medium
207732	SUSE SLES12 Security Update : apr (SUSE-SU-2024:3429-1)	Nessus	SuSE Local Security Checks	medium
207726	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : apr (SUSE-SU-2024:3428-1)	Nessus	SuSE Local Security Checks	medium
207253	Fedora 39 : apr (2024-318343049c)	Nessus	Fedora Local Security Checks	medium
206560	Fedora 40 : apr (2024-b40491b84b)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2023-49582

medium

Tenable Plugins

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium