SUSE SLES11 Security Update : salt (SUSE-SU-2021:14650-1)

critical Nessus Plugin ID 150586

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14650-1 advisory.

- An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory. (CVE-2020-28243)

- In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validate the SSL/TLS certificate. (CVE-2020-28972)

- In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated. (CVE-2020-35662)

- An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.
(CVE-2021-25281)

- An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal. (CVE-2021-25282)

- An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks. (CVE-2021-25283)

- An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level. (CVE-2021-25284)

- In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.) (CVE-2021-3144)

- An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py. (CVE-2021-3148)

- An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.
(CVE-2021-3197)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected salt, salt-doc and / or salt-minion packages.

See Also

https://bugzilla.suse.com/1181550

https://bugzilla.suse.com/1181556

https://bugzilla.suse.com/1181557

https://bugzilla.suse.com/1181558

https://bugzilla.suse.com/1181559

https://bugzilla.suse.com/1181560

https://bugzilla.suse.com/1181561

https://bugzilla.suse.com/1181562

https://bugzilla.suse.com/1181563

https://bugzilla.suse.com/1181564

https://bugzilla.suse.com/1181565

https://bugzilla.suse.com/1182740

http://www.nessus.org/u?e8f71505

https://www.suse.com/security/cve/CVE-2020-28243

https://www.suse.com/security/cve/CVE-2020-28972

https://www.suse.com/security/cve/CVE-2020-35662

https://www.suse.com/security/cve/CVE-2021-25281

https://www.suse.com/security/cve/CVE-2021-25282

https://www.suse.com/security/cve/CVE-2021-25283

https://www.suse.com/security/cve/CVE-2021-25284

https://www.suse.com/security/cve/CVE-2021-3144

https://www.suse.com/security/cve/CVE-2021-3148

https://www.suse.com/security/cve/CVE-2021-3197

Plugin Details

Severity: Critical

ID: 150586

File Name: suse_SU-2021-14650-1.nasl

Version: 1.4

Type: local

Agent: unix

Published: 6/10/2021

Updated: 1/21/2022

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.7

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2021-3197

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:salt, p-cpe:/a:novell:suse_linux:salt-minion, p-cpe:/a:novell:suse_linux:salt-doc, cpe:/o:novell:suse_linux:11

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/26/2021

Vulnerability Publication Date: 2/26/2021

Exploitable With

Metasploit (SaltStack Salt API Unauthenticated RCE through wheel_async client)

Reference Information

CVE: CVE-2020-28243, CVE-2020-28972, CVE-2020-35662, CVE-2021-25281, CVE-2021-25282, CVE-2021-25283, CVE-2021-25284, CVE-2021-3144, CVE-2021-3148, CVE-2021-3197

IAVA: 2021-A-0112-S

SuSE: SUSE-SU-2021:14650-1