A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privileges through a malicious symlink.

The version of AOS installed on the remote host is prior to 6.10.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.10.0.5 advisory.

  - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer     overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)

  - A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure     temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions     of the running user provides a window of opportunity for attackers to escalate privileges through a     malicious symlink. (CVE-2024-5742)

  - An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for     XML_ParseBuffer. (CVE-2024-45490)

  - An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for     nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45491)

  - The ipaddress module contained incorrect information about whether certain IPv4 and IPv6 addresses were     designated as globally reachable or private. This affected the is_private and is_global properties of     the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network     classes, where values wouldn't be returned in accordance with the latest information from the IANA     Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated information from these     registries and thus have the intended behavior. (CVE-2024-4032)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.0. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.0 advisory.

  - squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different     vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link     and then contents under the same filename in a filesystem can cause unsquashfs to first create the     symbolic link pointing outside the expected directory, and then the subsequent write operation will cause     the unsquashfs process to write through the symbolic link elsewhere in the filesystem. (CVE-2021-41072)

  - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer     overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)

  - Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache     Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers     correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect     infinite timeout which allowed connections to remain open which should have been closed. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1     through 9.0.89. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the     issue. (CVE-2024-34750)

  - Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of     service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of     Service (ReDoS) in package_index.py. (CVE-2022-40897)

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In     affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol,     but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated,     thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an     exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
    (CVE-2023-23931)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2024-9430 advisory.

    [5.6.1-6]
    - fix emergency file replacement vulnerability (RHEL-35237)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:9430 advisory.

    GNU nano is a small and friendly text editor.

    Security Fix(es):

    * nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file     with a malicious symlink to a root-owned file (CVE-2024-5742)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7064-2 advisory.

    USN-7064-1 fixed a vulnerability in nano. This update provides the corresponding update for Ubuntu 14.04     LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7064-1 advisory.

    It was discovered that nano allowed a possible privilege escalation through an insecure temporary file. If     nano was killed while editing, the permissions granted to the emergency save file could be used by an     attacker to escalate privileges using a malicious symlink.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the nano package has been released.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:6986 advisory.

    * nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file     with a malicious symlink to a root-owned file (CVE-2024-5742)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2024:6986 advisory.

    * nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file     with a malicious symlink to a root-owned file (CVE-2024-5742)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2024-6986 advisory.

    [2.9.8-3]
    - fix incomplete backport of the fix for the emergency file replacement       vulnerability (RHEL-35236)

    [2.9.8-2]
    - fix emergency file replacement vulnerability (RHEL-35236)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:6986 advisory.

    GNU nano is a small and friendly text editor.

    Security Fix(es):

    * nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file     with a malicious symlink to a root-owned file (CVE-2024-5742)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of nano installed on the remote host is prior to 2.9.8-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2590 advisory.

    nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with     a malicious symlink to a root-owned file (CVE-2024-5742)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-652 advisory.

    nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with     a malicious symlink to a root-owned file (CVE-2024-5742)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of nano installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-5742 advisory.

  - A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure     temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions     of the running user provides a window of opportunity for attackers to escalate privileges through a     malicious symlink. (CVE-2024-5742)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3831 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3831-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Adrian Bunk     June 17, 2024                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : nano     Version        : 3.2-3+deb10u1     CVE ID         : CVE-2024-5742

    A symlink attack with emergency file saving has been fixed in the text     editor nano.

    For Debian 10 buster, this problem has been fixed in version     3.2-3+deb10u1.

    We recommend that you upgrade your nano packages.

    For the detailed security status of nano please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/nano

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2024:0157-1 advisory.

    - CVE-2024-5742: Avoid privilege escalations via symlink attacks on emergency save file (boo#1226099)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
213288	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.10.0.5)	Nessus	Misc.	critical
212124	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.0)	Nessus	Misc.	medium
211554	Oracle Linux 9 : nano (ELSA-2024-9430)	Nessus	Oracle Linux Local Security Checks	medium
210805	RHEL 9 : nano (RHSA-2024:9430)	Nessus	Red Hat Local Security Checks	medium
209875	Ubuntu 14.04 LTS : nano vulnerability (USN-7064-2)	Nessus	Ubuntu Local Security Checks	medium
209028	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : nano vulnerability (USN-7064-1)	Nessus	Ubuntu Local Security Checks	medium
208722	Photon OS 4.0: Nano PHSA-2024-4.0-0699	Nessus	PhotonOS Local Security Checks	medium
207925	Rocky Linux 8 : nano (RLSA-2024:6986)	Nessus	Rocky Linux Local Security Checks	medium
207751	AlmaLinux 8 : nano (ALSA-2024:6986)	Nessus	Alma Linux Local Security Checks	medium
207708	Oracle Linux 8 : nano (ELSA-2024-6986)	Nessus	Oracle Linux Local Security Checks	medium
207684	RHEL 8 : nano (RHSA-2024:6986)	Nessus	Red Hat Local Security Checks	medium
204656	Photon OS 5.0: Nano PHSA-2024-5.0-0329	Nessus	PhotonOS Local Security Checks	medium
202984	Amazon Linux 2 : nano (ALAS-2024-2590)	Nessus	Amazon Linux Local Security Checks	medium
202930	Amazon Linux 2023 : default-editor, nano, nano-default-editor (ALAS2023-2024-652)	Nessus	Amazon Linux Local Security Checks	medium
202204	CBL Mariner 2.0 Security Update: nano (CVE-2024-5742)	Nessus	MarinerOS Local Security Checks	medium
200694	Debian dla-3831 : nano - security update	Nessus	Debian Local Security Checks	medium
200394	openSUSE 15 Security Update : nano (openSUSE-SU-2024:0157-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2024-5742

medium

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium