The version of ecs-service-connect-agent installed on the remote host is prior to v1.27.2.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2023-016 advisory.

  - This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the     specific series of conditions are met. libcurl performs transfers. In its API, an application creates     easy handles that are the individual handles for single transfers. libcurl provides a function call that     duplicates en easy handle called     [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). If a transfer has cookies     enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the     actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned     version of the handle would instead store the file name as `none` (using the four ASCII letters, no     quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from     would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in     the current directory of the program using libcurl. And if using the correct file format of course.
    (CVE-2023-38546)

  - CVE-2023-38546 is a cookie injection vulnerability in the curl_easy_duphandle(), a function in libcurl     that duplicates easy handles.  When duplicating an easy handle, if cookies are enabled, the duplicated     easy handle will not duplicate the cookies themselves, but would instead set the filename to none.'     Therefore, when the duplicated easy handle is subsequently used, if a source was not set for the cookies,     libcurl would attempt to load them from the file named none' on the disk.  This vulnerability is rated     low, as the various conditions required for exploitation are unlikely.  (CVE-2023-38546)

  - Line directives (//line) can be used to bypass the restrictions on //go:cgo_ directives, allowing     blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution     of arbitrary code when running go build. The line directive requires the absolute path of the file in     which the directive lives, which makes exploiting this issue significantly more complex. (CVE-2023-39323)

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2023-016)

high Nessus Plugin ID 184181

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.0

Version 1.5 Feb 9, 2024, 11:26 PM CEA reference Plugin Feed: 202402092326
Version 1.4 Jan 5, 2024, 3:16 PM CVSS metrics ("CVSSv2 score" set to 7.6. "CVSSv2 vector" set to "CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C". "CVSSv3 score" set to 8.1. "CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H") Plugin Feed: 202401051516
Version 1.3 Dec 8, 2023, 11:43 AM IAVM reference Plugin Feed: 202312081143
Version 1.2 Nov 2, 2023, 8:18 PM CEA reference Plugin Feed: 202311022018
Version 1.1 Nov 2, 2023, 2:21 PM CVSS metrics ("CVSSv2 score" set to 10.0. "CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSSv2 score source (changed from "CVE-2023-38546" to "CVE-2023-39323") CVSSv2 severity (based on CVE-2023-39323, severity increased from "Medium" to "High") CVSSv3 score source (changed from "CVE-2023-39323" to none) Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202311021421
Version 1.0 Nov 2, 2023, 4:31 AM New Plugin Feed: 202311020431