NewStart CGSL CORE 5.05 / MAIN 5.05 : polkit Multiple Vulnerabilities (NS-SA-2023-0027)

high Nessus Plugin ID 174078

Synopsis

The remote NewStart CGSL host is affected by multiple vulnerabilities.

Description

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has polkit packages installed that are affected by multiple vulnerabilities:

- A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure. (CVE-2018-1116)

- A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine. (CVE-2021-4034)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the vulnerable CGSL polkit packages. Note that updated packages may not be available yet. Please contact ZTE for more information.

Plugin Details

Severity: High

ID: 174078

File Name: newstart_cgsl_NS-SA-2023-0027_polkit.nasl

Version: 1.2

Type: local

Family: NewStart CGSL Local Security Checks

Published: 4/11/2023

Updated: 4/12/2023

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.8

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 6.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2021-4034

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7.5

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:zte:cgsl_core:polkit-docs, p-cpe:/a:zte:cgsl_core:polkit-devel, p-cpe:/a:zte:cgsl_main:polkit-docs, p-cpe:/a:zte:cgsl_main:polkit, p-cpe:/a:zte:cgsl_main:polkit-debuginfo, cpe:/o:zte:cgsl_main:5, p-cpe:/a:zte:cgsl_core:polkit, p-cpe:/a:zte:cgsl_main:polkit-devel, cpe:/o:zte:cgsl_core:5, p-cpe:/a:zte:cgsl_core:polkit-debuginfo

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/ZTE-CGSL/release, Host/ZTE-CGSL/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/11/2023

Vulnerability Publication Date: 7/10/2018

CISA Known Exploited Vulnerability Due Dates: 7/18/2022

Exploitable With

CANVAS (CANVAS)

Core Impact

Metasploit (Local Privilege Escalation in polkits pkexec)

Reference Information

CVE: CVE-2018-1116, CVE-2021-4034

Detections

Analytics