A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privileges through a malicious symlink.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2024-9430 advisory.

    [5.6.1-6]
    - fix emergency file replacement vulnerability (RHEL-35237)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:9430 advisory.

    GNU nano is a small and friendly text editor.

    Security Fix(es):

    * nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file     with a malicious symlink to a root-owned file (CVE-2024-5742)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7064-2 advisory.

    USN-7064-1 fixed a vulnerability in nano. This update provides the corresponding update for Ubuntu 14.04     LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7064-1 advisory.

    It was discovered that nano allowed a possible privilege escalation through an insecure temporary file. If     nano was killed while editing, the permissions granted to the emergency save file could be used by an     attacker to escalate privileges using a malicious symlink.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the nano package has been released.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:6986 advisory.

    * nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file     with a malicious symlink to a root-owned file (CVE-2024-5742)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2024:6986 advisory.

    * nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file     with a malicious symlink to a root-owned file (CVE-2024-5742)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2024-6986 advisory.

    [2.9.8-3]
    - fix incomplete backport of the fix for the emergency file replacement       vulnerability (RHEL-35236)

    [2.9.8-2]
    - fix emergency file replacement vulnerability (RHEL-35236)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:6986 advisory.

    GNU nano is a small and friendly text editor.

    Security Fix(es):

    * nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file     with a malicious symlink to a root-owned file (CVE-2024-5742)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of nano installed on the remote host is prior to 2.9.8-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2590 advisory.

    nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with     a malicious symlink to a root-owned file (CVE-2024-5742)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-652 advisory.

    nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with     a malicious symlink to a root-owned file (CVE-2024-5742)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of nano installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-5742 advisory.

  - A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure     temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions     of the running user provides a window of opportunity for attackers to escalate privileges through a     malicious symlink. (CVE-2024-5742)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3831 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3831-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Adrian Bunk     June 17, 2024                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : nano     Version        : 3.2-3+deb10u1     CVE ID         : CVE-2024-5742

    A symlink attack with emergency file saving has been fixed in the text     editor nano.

    For Debian 10 buster, this problem has been fixed in version     3.2-3+deb10u1.

    We recommend that you upgrade your nano packages.

    For the detailed security status of nano please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/nano

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2024:0157-1 advisory.

    - CVE-2024-5742: Avoid privilege escalations via symlink attacks on emergency save file (boo#1226099)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211554	Oracle Linux 9 : nano (ELSA-2024-9430)	Nessus	Oracle Linux Local Security Checks	medium
210805	RHEL 9 : nano (RHSA-2024:9430)	Nessus	Red Hat Local Security Checks	medium
209875	Ubuntu 14.04 LTS : nano vulnerability (USN-7064-2)	Nessus	Ubuntu Local Security Checks	medium
209028	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : nano vulnerability (USN-7064-1)	Nessus	Ubuntu Local Security Checks	medium
208722	Photon OS 4.0: Nano PHSA-2024-4.0-0699	Nessus	PhotonOS Local Security Checks	medium
207925	Rocky Linux 8 : nano (RLSA-2024:6986)	Nessus	Rocky Linux Local Security Checks	medium
207751	AlmaLinux 8 : nano (ALSA-2024:6986)	Nessus	Alma Linux Local Security Checks	medium
207708	Oracle Linux 8 : nano (ELSA-2024-6986)	Nessus	Oracle Linux Local Security Checks	medium
207684	RHEL 8 : nano (RHSA-2024:6986)	Nessus	Red Hat Local Security Checks	medium
204656	Photon OS 5.0: Nano PHSA-2024-5.0-0329	Nessus	PhotonOS Local Security Checks	medium
202984	Amazon Linux 2 : nano (ALAS-2024-2590)	Nessus	Amazon Linux Local Security Checks	medium
202930	Amazon Linux 2023 : default-editor, nano, nano-default-editor (ALAS2023-2024-652)	Nessus	Amazon Linux Local Security Checks	medium
202204	CBL Mariner 2.0 Security Update: nano (CVE-2024-5742)	Nessus	MarinerOS Local Security Checks	medium
200694	Debian dla-3831 : nano - security update	Nessus	Debian Local Security Checks	medium
200394	openSUSE 15 Security Update : nano (openSUSE-SU-2024:0157-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2024-5742

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium