The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3782 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3782-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     April 07, 2024                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : util-linux     Version        : 2.33.1-0.1+deb10u1     CVE ID         : CVE-2021-37600 CVE-2024-28085     Debian Bug     : 826596 991619 1067849

    CVE-2024-28085

        Skyler Ferrante discovered that the wall(1) utility found in         util-linux, a collection of system utilities for Linux, does not         filter escape sequences from command line arguments.  This allows         unprivileged local users to put arbitrary text on other users         terminals if mesg is set to y and the wall executable is setgid,         which could lead to information disclosure.

        With this update the wall executable is no longer installed setgid         tty.

    CVE-2021-37600

        Kihong Heo found an integer overflow which can potentially lead to         buffer overflow if an attacker were able to use system resources in         a way that leads to a large number in the /proc/sysvipc/sem file.
        NOTE: this is issue is unexploitable in GNU C Library environments,         and possibly in all realistic environments.

    For Debian 10 buster, these problems have been fixed in version     2.33.1-0.1+deb10u1.

    We recommend that you upgrade your util-linux packages.

    For the detailed security status of util-linux please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/util-linux

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3782 : bsdutils - security update

critical Nessus Plugin ID 192962

Version 1.1

Version 1.0

Version 1.1 Jan 22, 2025, 3:03 PM CVSS metrics ("Cvssv4 score" set to 9.3) CVSS metrics ("Cvssv4 threat vector" set to "CVSS:4.0/E:P") CVSS metrics ("Cvssv4 vector" set to "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N") Plugin metadata Plugin Feed: 202501221503
Version 1.0 Apr 7, 2024, 3:10 PM New Plugin Feed: 202404071510