The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5784 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5784-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     October 04, 2024                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : oath-toolkit     CVE ID         : CVE-2024-47191

    Fabian Vogt reported that the PAM module in oath-toolkit, a collection     of components to build one-time password authentication systems, does     not safely perform file operations in users's home directories when     using the usersfile feature (allowing to place the OTP state in the home     directory of the to-be-authenticated user). A local user can take     advantage of this flaw for root privilege escalation.

    For the stable distribution (bookworm), this problem has been fixed in     version 2.6.7-3.1+deb12u1.

    We recommend that you upgrade your oath-toolkit packages.

    For the detailed security status of oath-toolkit please refer to its     security tracker page at:
    https://security-tracker.debian.org/tracker/oath-toolkit

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dsa-5784 : liboath-dev - security update

high Nessus Plugin ID 208203

Version 1.2

Version 1.1

Version 1.2 Oct 10, 2024, 7:59 AM CVSS metrics ("CVSSv3 score" set to 7.1) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N") Plugin Feed: 202410100759
Version 1.1 Oct 5, 2024, 1:27 AM New Plugin Feed: 202410050127