Detections
Analytics

Fedora 38 : nats-server (2023-c33188f575)

high Nessus Plugin ID 183762

Language:

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-c33188f575 advisory.


 Without any authorization rules in the nats-server, users can connect without authentication.

 Before nats-server 2.2.0, all authentication and authorization rules for a nats-server lived in an authorization block, defining users. With nats-server 2.2.0 all users live inside accounts. When using the authorization block, whose syntax predates this, those users will be placed into the implicit global account, $G. Users inside accounts go into the newer accounts block.

 If an accounts block is defined, in simple deployment scenarios this is often used only to enable client access to the system account. When the only account added is the system account $SYS, the nats-server would create an implicit user in $G and set it as the `no_auth_user` account, enabling the same without authentication logic as without any rules.

 This preserved the ability to connect simply, and then add one authenticated login for system access.

 But with an authorization block, this is wrong. Users exist in the global account, with login rules. And in simple testing, they might still connect fine without administrators seeing that authentication has been disabled.

 The blind-spot on our part came from encouraging and documenting a switch to using only accounts, instead of authorization.

 In the fixed versions, using an authorization block will inhibit the implicit creation of a $G user and setting it as the `no_auth_user` target. In unfixed versions, just creating a second account, with no users, will also inhibit this behavior.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected nats-server package.

See Also

https://bodhi.fedoraproject.org/updates/FEDORA-2023-c33188f575

Plugin Details

Severity: High

ID: 183762

File Name: fedora_2023-c33188f575.nasl

Version: 1.1

Type: local

Agent: unix

Published: 10/24/2023

Updated: 11/14/2024

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, continuous_assessment, Nessus

Vulnerability Information

CPE: p-cpe:/a:fedoraproject:fedora:nats-server, cpe:/o:fedoraproject:fedora:38

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/14/2023

Vulnerability Publication Date: 10/14/2023

Reference Information