Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter).

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7117-1 advisory.

    Qualys discovered that needrestart passed unsanitized data to a library

    (libmodule-scandeps-perl) which expects safe input. A local attacker could possibly use this issue to     execute arbitrary code as root. (CVE-2024-11003)

    Qualys discovered that the library libmodule-scandeps-perl incorrectly

    parsed perl code. This could allow a local attacker to execute arbitrary shell commands. (CVE-2024-10224)

    Qualys discovered that needrestart incorrectly used the PYTHONPATH

    environment variable to spawn a new Python interpreter. A local attacker

    could possibly use this issue to execute arbitrary code as root.

    (CVE-2024-48990)

    Qualys discovered that needrestart incorrectly checked the path to the Python interpreter. A local     attacker could possibly use this issue to win a race condition and execute arbitrary code as root.
    (CVE-2024-48991)

    Qualys discovered that needrestart incorrectly used the RUBYLIB environment variable to spawn a new Ruby     interpreter. A local attacker could possibly use this issue to execute arbitrary code as root.
    (CVE-2024-48992)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3957 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3957-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                 Salvatore Bonaccorso     November 19, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : needrestart     Version        : 3.5-4+deb11u4     CVE ID         : CVE-2024-11003 CVE-2024-48990 CVE-2024-48991 CVE-2024-48992

    The Qualys Threat Research Unit discovered several local privilege     escalation vulnerabilities in needrestart, a utility to check which     daemons need to be restarted after library upgrades. A local attacker     can execute arbitrary code as root by tricking needrestart into running     the Python interpreter with an attacker-controlled PYTHONPATH     environment variable (CVE-2024-48990) or running the Ruby interpreter     with an attacker-controlled RUBYLIB environment variable     (CVE-2024-48992).  Additionally a local attacker can trick needrestart     into running a fake Python interpreter (CVE-2024-48991) or cause     needrestart to call the Perl module Module::ScanDeps with     attacker-controlled files (CVE-2024-11003).

    Details can be found in the Qualys advisory at     https://www.qualys.com/2024/11/19/needrestart/needrestart.txt

    For Debian 11 bullseye, these problems have been fixed in version     3.5-4+deb11u4.

    We recommend that you upgrade your needrestart packages.

    For the detailed security status of needrestart please refer to its     security tracker page at:
    https://security-tracker.debian.org/tracker/needrestart

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5815 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5815-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     November 19, 2024                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : needrestart     CVE ID         : CVE-2024-11003 CVE-2024-48990 CVE-2024-48991 CVE-2024-48992

    The Qualys Threat Research Unit discovered several local privilege     escalation vulnerabilities in needrestart, a utility to check which     daemons need to be restarted after library upgrades. A local attacker     can execute arbitrary code as root by tricking needrestart into running     the Python interpreter with an attacker-controlled PYTHONPATH     environment variable (CVE-2024-48990) or running the Ruby interpreter     with an attacker-controlled RUBYLIB environment variable     (CVE-2024-48992).  Additionally a local attacker can trick needrestart     into running a fake Python interpreter (CVE-2024-48991) or cause     needrestart to call the Perl module Module::ScanDeps with     attacker-controlled files (CVE-2024-11003).

    Details can be found in the Qualys advisory at     https://www.qualys.com/2024/11/19/needrestart/needrestart.txt

    For the stable distribution (bookworm), these problems have been fixed in     version 3.6-4+deb12u2.

    We recommend that you upgrade your needrestart packages.

    For the detailed security status of needrestart please refer to its     security tracker page at:
    https://security-tracker.debian.org/tracker/needrestart

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211621	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : needrestart and Module::ScanDeps vulnerabilities (USN-7117-1)	Nessus	Ubuntu Local Security Checks	high
211606	Debian dla-3957 : needrestart - security update	Nessus	Debian Local Security Checks	high
211604	Debian dsa-5815 : needrestart - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2024-48991

high

Tenable Plugins

high

high

high