Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-6015ee69f0 advisory.

    Rebase to fix CVEs

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-d2124788a8 advisory.

    Rebase to fix CVEs


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-a9cf3dad4f advisory.

    Rebase to fix CVEs



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7117-1 advisory.

    Qualys discovered that needrestart passed unsanitized data to a library

    (libmodule-scandeps-perl) which expects safe input. A local attacker could possibly use this issue to     execute arbitrary code as root. (CVE-2024-11003)

    Qualys discovered that the library libmodule-scandeps-perl incorrectly

    parsed perl code. This could allow a local attacker to execute arbitrary shell commands. (CVE-2024-10224)

    Qualys discovered that needrestart incorrectly used the PYTHONPATH

    environment variable to spawn a new Python interpreter. A local attacker

    could possibly use this issue to execute arbitrary code as root.

    (CVE-2024-48990)

    Qualys discovered that needrestart incorrectly checked the path to the Python interpreter. A local     attacker could possibly use this issue to win a race condition and execute arbitrary code as root.
    (CVE-2024-48991)

    Qualys discovered that needrestart incorrectly used the RUBYLIB environment variable to spawn a new Ruby     interpreter. A local attacker could possibly use this issue to execute arbitrary code as root.
    (CVE-2024-48992)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3957 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3957-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                 Salvatore Bonaccorso     November 19, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : needrestart     Version        : 3.5-4+deb11u4     CVE ID         : CVE-2024-11003 CVE-2024-48990 CVE-2024-48991 CVE-2024-48992

    The Qualys Threat Research Unit discovered several local privilege     escalation vulnerabilities in needrestart, a utility to check which     daemons need to be restarted after library upgrades. A local attacker     can execute arbitrary code as root by tricking needrestart into running     the Python interpreter with an attacker-controlled PYTHONPATH     environment variable (CVE-2024-48990) or running the Ruby interpreter     with an attacker-controlled RUBYLIB environment variable     (CVE-2024-48992).  Additionally a local attacker can trick needrestart     into running a fake Python interpreter (CVE-2024-48991) or cause     needrestart to call the Perl module Module::ScanDeps with     attacker-controlled files (CVE-2024-11003).

    Details can be found in the Qualys advisory at     https://www.qualys.com/2024/11/19/needrestart/needrestart.txt

    For Debian 11 bullseye, these problems have been fixed in version     3.5-4+deb11u4.

    We recommend that you upgrade your needrestart packages.

    For the detailed security status of needrestart please refer to its     security tracker page at:
    https://security-tracker.debian.org/tracker/needrestart

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211781	Fedora 39 : needrestart (2024-6015ee69f0)	Nessus	Fedora Local Security Checks	high
211780	Fedora 40 : needrestart (2024-d2124788a8)	Nessus	Fedora Local Security Checks	high
211779	Fedora 41 : needrestart (2024-a9cf3dad4f)	Nessus	Fedora Local Security Checks	high
211621	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : needrestart and Module::ScanDeps vulnerabilities (USN-7117-1)	Nessus	Ubuntu Local Security Checks	high
211606	Debian dla-3957 : needrestart - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2024-48991

high

Tenable Plugins

high

high

high

high

high