Vulnerabilities > CVE-2016-7545 - Improper Access Control vulnerability in multiple products

047910
CVSS 8.8 - HIGH
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
local
low complexity
selinux-project
fedoraproject
redhat
CWE-284
nessus
NVD
Published: 2017-01-19
Updated: 2023-11-07

Summary

SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call.

Vulnerable Configurations

Part Description Count
Application
Selinux_Project
1
OS
Fedoraproject
1
OS
Redhat
9

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Embedding Scripts within Scripts
    An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute scripts. The attacker leverages this capability to execute scripts to execute his/her own script by embedding it within other scripts that the target software is likely to execute. The attacker must have the ability to inject script into script that is likely to be executed. If this is done, then the attacker can potentially launch a variety of probes and attacks against the web server's local environment, in many cases the so-called DMZ, back end resources the web server can communicate with, and other hosts. With the proliferation of intermediaries, such as Web App Firewalls, network devices, and even printers having JVMs and Web servers, there are many locales where an attacker can inject malicious scripts. Since this attack pattern defines scripts within scripts, there are likely privileges to execute said attack on the host. Of course, these attacks are not solely limited to the server side, client side scripts like Ajax and client side JavaScript can contain malicious scripts as well. In general all that is required is for there to be sufficient privileges to execute a script, but not protected against writing.
  • Signature Spoofing by Key Theft
    An attacker obtains an authoritative or reputable signer's private signature key by theft and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.

Nessus

  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-B7E8E980EF.NASL
    descriptionThis update backports several fixes from upstream and also fixes sandbox issues including CVE-2016-7545 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-11-15
    plugin id94854
    published2016-11-15
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/94854
    titleFedora 25 : checkpolicy / libselinux / libsemanage / libsepol / policycoreutils / etc (2016-b7e8e980ef)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory FEDORA-2016-b7e8e980ef.
#

include("compat.inc");

if (description)
{
  script_id(94854);
  script_version("2.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");

  script_cve_id("CVE-2016-7545");
  script_xref(name:"FEDORA", value:"2016-b7e8e980ef");

  script_name(english:"Fedora 25 : checkpolicy / libselinux / libsemanage / libsepol / policycoreutils / etc (2016-b7e8e980ef)");
  script_summary(english:"Checks rpm output for the updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update backports several fixes from upstream and also fixes
sandbox issues including CVE-2016-7545

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as
possible without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bodhi.fedoraproject.org/updates/FEDORA-2016-b7e8e980ef"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:checkpolicy");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:libselinux");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:libsemanage");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:libsepol");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:policycoreutils");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:secilc");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:25");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/01/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/10/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/11/15");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! preg(pattern:"^25([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 25", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);


flag = 0;
if (rpm_check(release:"FC25", reference:"checkpolicy-2.5-8.fc25")) flag++;
if (rpm_check(release:"FC25", reference:"libselinux-2.5-12.fc25")) flag++;
if (rpm_check(release:"FC25", reference:"libsemanage-2.5-8.fc25")) flag++;
if (rpm_check(release:"FC25", reference:"libsepol-2.5-10.fc25")) flag++;
if (rpm_check(release:"FC25", reference:"policycoreutils-2.5-17.fc25")) flag++;
if (rpm_check(release:"FC25", reference:"secilc-2.5-6.fc25")) flag++;


if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "checkpolicy / libselinux / libsemanage / libsepol / policycoreutils / etc");
}
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2016-1083.NASL
    descriptionAccording to the version of the policycoreutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that the sandbox tool provided in policycoreutils was vulnerable to a TIOCSTI ioctl attack. A specially crafted program executed via the sandbox command could use this flaw to execute arbitrary commands in the context of the parent shell, escaping the sandbox. (CVE-2016-7545) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2017-05-01
    plugin id99842
    published2017-05-01
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99842
    titleEulerOS 2.0 SP1 : policycoreutils (EulerOS-SA-2016-1083)
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(99842);
  script_version("1.11");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/04");

  script_cve_id(
    "CVE-2016-7545"
  );

  script_name(english:"EulerOS 2.0 SP1 : policycoreutils (EulerOS-SA-2016-1083)");
  script_summary(english:"Checks the rpm output for the updated package.");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"According to the version of the policycoreutils packages installed,
the EulerOS installation on the remote host is affected by the
following vulnerability :

  - It was found that the sandbox tool provided in
    policycoreutils was vulnerable to a TIOCSTI ioctl
    attack. A specially crafted program executed via the
    sandbox command could use this flaw to execute
    arbitrary commands in the context of the parent shell,
    escaping the sandbox. (CVE-2016-7545)

Note that Tenable Network Security has extracted the preceding
description block directly from the EulerOS security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2016-1083
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?351f8987");
  script_set_attribute(attribute:"solution", value:
"Update the affected policycoreutils package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");

  script_set_attribute(attribute:"patch_publication_date", value:"2016/11/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/05/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:policycoreutils");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:policycoreutils-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:policycoreutils-gui");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:policycoreutils-newrole");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:policycoreutils-python");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:policycoreutils-sandbox");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item("Host/EulerOS/release");
if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");

sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(1)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP1");

uvp = get_kb_item("Host/EulerOS/uvp_version");
if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP1", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

flag = 0;

pkgs = ["policycoreutils-2.2.5-15.h1",
        "policycoreutils-devel-2.2.5-15.h1",
        "policycoreutils-gui-2.2.5-15.h1",
        "policycoreutils-newrole-2.2.5-15.h1",
        "policycoreutils-python-2.2.5-15.h1",
        "policycoreutils-sandbox-2.2.5-15.h1"];

foreach (pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"1", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "policycoreutils");
}
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2016-2702.NASL
    descriptionAn update for policycoreutils is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The policycoreutils packages contain the core policy utilities required to manage a SELinux environment. Security Fix(es) : * It was found that the sandbox tool provided in policycoreutils was vulnerable to a TIOCSTI ioctl attack. A specially crafted program executed via the sandbox command could use this flaw to execute arbitrary commands in the context of the parent shell, escaping the sandbox. (CVE-2016-7545)
    last seen2020-06-01
    modified2020-06-02
    plugin id94896
    published2016-11-15
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/94896
    titleRHEL 6 / 7 : policycoreutils (RHSA-2016:2702)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Red Hat Security Advisory RHSA-2016:2702. The text 
# itself is copyright (C) Red Hat, Inc.
#

include("compat.inc");

if (description)
{
  script_id(94896);
  script_version("2.12");
  script_cvs_date("Date: 2019/10/24 15:35:42");

  script_cve_id("CVE-2016-7545");
  script_xref(name:"RHSA", value:"2016:2702");

  script_name(english:"RHEL 6 / 7 : policycoreutils (RHSA-2016:2702)");
  script_summary(english:"Checks the rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Red Hat host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"An update for policycoreutils is now available for Red Hat Enterprise
Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security
impact of Important. A Common Vulnerability Scoring System (CVSS) base
score, which gives a detailed severity rating, is available for each
vulnerability from the CVE link(s) in the References section.

The policycoreutils packages contain the core policy utilities
required to manage a SELinux environment.

Security Fix(es) :

* It was found that the sandbox tool provided in policycoreutils was
vulnerable to a TIOCSTI ioctl attack. A specially crafted program
executed via the sandbox command could use this flaw to execute
arbitrary commands in the context of the parent shell, escaping the
sandbox. (CVE-2016-7545)"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/errata/RHSA-2016:2702"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2016-7545"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:policycoreutils");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:policycoreutils-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:policycoreutils-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:policycoreutils-gui");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:policycoreutils-newrole");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:policycoreutils-python");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:policycoreutils-restorecond");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:policycoreutils-sandbox");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.7");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/01/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/11/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/11/15");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Red Hat Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
os_ver = os_ver[1];
if (! preg(pattern:"^(6|7)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 6.x / 7.x", "Red Hat " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);

yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
if (!empty_or_null(yum_updateinfo)) 
{
  rhsa = "RHSA-2016:2702";
  yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
  if (!empty_or_null(yum_report))
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : yum_report 
    );
    exit(0);
  }
  else
  {
    audit_message = "affected by Red Hat security advisory " + rhsa;
    audit(AUDIT_OS_NOT, audit_message);
  }
}
else
{
  flag = 0;
  if (rpm_check(release:"RHEL6", cpu:"i686", reference:"policycoreutils-2.0.83-30.1.el6_8")) flag++;

  if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"policycoreutils-2.0.83-30.1.el6_8")) flag++;

  if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"policycoreutils-2.0.83-30.1.el6_8")) flag++;

  if (rpm_check(release:"RHEL6", cpu:"i686", reference:"policycoreutils-debuginfo-2.0.83-30.1.el6_8")) flag++;

  if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"policycoreutils-debuginfo-2.0.83-30.1.el6_8")) flag++;

  if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"policycoreutils-debuginfo-2.0.83-30.1.el6_8")) flag++;

  if (rpm_check(release:"RHEL6", cpu:"i686", reference:"policycoreutils-gui-2.0.83-30.1.el6_8")) flag++;

  if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"policycoreutils-gui-2.0.83-30.1.el6_8")) flag++;

  if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"policycoreutils-gui-2.0.83-30.1.el6_8")) flag++;

  if (rpm_check(release:"RHEL6", cpu:"i686", reference:"policycoreutils-newrole-2.0.83-30.1.el6_8")) flag++;

  if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"policycoreutils-newrole-2.0.83-30.1.el6_8")) flag++;

  if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"policycoreutils-newrole-2.0.83-30.1.el6_8")) flag++;

  if (rpm_check(release:"RHEL6", cpu:"i686", reference:"policycoreutils-python-2.0.83-30.1.el6_8")) flag++;

  if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"policycoreutils-python-2.0.83-30.1.el6_8")) flag++;

  if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"policycoreutils-python-2.0.83-30.1.el6_8")) flag++;

  if (rpm_check(release:"RHEL6", cpu:"i686", reference:"policycoreutils-sandbox-2.0.83-30.1.el6_8")) flag++;

  if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"policycoreutils-sandbox-2.0.83-30.1.el6_8")) flag++;

  if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"policycoreutils-sandbox-2.0.83-30.1.el6_8")) flag++;


  if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"policycoreutils-2.5-9.el7")) flag++;

  if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"policycoreutils-2.5-9.el7")) flag++;

  if (rpm_check(release:"RHEL7", reference:"policycoreutils-debuginfo-2.5-9.el7")) flag++;

  if (rpm_check(release:"RHEL7", reference:"policycoreutils-devel-2.5-9.el7")) flag++;

  if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"policycoreutils-gui-2.5-9.el7")) flag++;

  if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"policycoreutils-gui-2.5-9.el7")) flag++;

  if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"policycoreutils-newrole-2.5-9.el7")) flag++;

  if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"policycoreutils-newrole-2.5-9.el7")) flag++;

  if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"policycoreutils-python-2.5-9.el7")) flag++;

  if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"policycoreutils-python-2.5-9.el7")) flag++;

  if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"policycoreutils-restorecond-2.5-9.el7")) flag++;

  if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"policycoreutils-restorecond-2.5-9.el7")) flag++;

  if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"policycoreutils-sandbox-2.5-9.el7")) flag++;

  if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"policycoreutils-sandbox-2.5-9.el7")) flag++;


  if (flag)
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get() + redhat_report_package_caveat()
    );
    exit(0);
  }
  else
  {
    tested = pkg_tests_get();
    if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
    else audit(AUDIT_PACKAGE_NOT_INSTALLED, "policycoreutils / policycoreutils-debuginfo / policycoreutils-devel / etc");
  }
}
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2017-0339-1.NASL
    descriptionThis update for policycoreutils fixes the following issues : - CVE-2016-7545: nonpriv session can escape to parent [bsc#1000998] Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id96924
    published2017-02-01
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96924
    titleSUSE SLES11 Security Update : policycoreutils (SUSE-SU-2017:0339-1)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20161114_POLICYCOREUTILS_ON_SL6_X.NASL
    descriptionSecurity Fix(es) : - It was found that the sandbox tool provided in policycoreutils was vulnerable to a TIOCSTI ioctl attack. A specially crafted program executed via the sandbox command could use this flaw to execute arbitrary commands in the context of the parent shell, escaping the sandbox. (CVE-2016-7545)
    last seen2020-06-01
    modified2020-06-02
    plugin id95048
    published2016-11-22
    reporterThis script is Copyright (C) 2016 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/95048
    titleScientific Linux Security Update : policycoreutils on SL6.x, SL7.x i386/x86_64
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2017-0338-1.NASL
    descriptionThis update for policycoreutils fixes the following issues : - CVE-2016-7545: nonpriv session can escape to parent [bsc#1000998] Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id96923
    published2017-02-01
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96923
    titleSUSE SLES12 Security Update : policycoreutils (SUSE-SU-2017:0338-1)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-0536.NASL
    descriptionAn update for policycoreutils is now available for Red Hat Enterprise Linux 7.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The policycoreutils packages contain the core policy utilities required to manage a SELinux environment. Security Fix(es) : * It was found that the sandbox tool provided in policycoreutils was vulnerable to a TIOCSTI ioctl attack. A specially crafted program executed via the sandbox command could use this flaw to execute arbitrary commands in the context of the parent shell, escaping the sandbox. (CVE-2016-7545)
    last seen2020-06-01
    modified2020-06-02
    plugin id97769
    published2017-03-16
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97769
    titleRHEL 7 : policycoreutils (RHSA-2017:0536)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2016-2702.NASL
    descriptionFrom Red Hat Security Advisory 2016:2702 : An update for policycoreutils is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The policycoreutils packages contain the core policy utilities required to manage a SELinux environment. Security Fix(es) : * It was found that the sandbox tool provided in policycoreutils was vulnerable to a TIOCSTI ioctl attack. A specially crafted program executed via the sandbox command could use this flaw to execute arbitrary commands in the context of the parent shell, escaping the sandbox. (CVE-2016-7545)
    last seen2020-06-01
    modified2020-06-02
    plugin id94895
    published2016-11-15
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/94895
    titleOracle Linux 6 / 7 : policycoreutils (ELSA-2016-2702)
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2016-765.NASL
    descriptionIt was found that the sandbox tool provided in policycoreutils was vulnerable to a TIOCSTI ioctl attack. A specially crafted program executed via the sandbox command could use this flaw to execute arbitrary commands in the context of the parent bash, escaping the sandbox.
    last seen2020-06-01
    modified2020-06-02
    plugin id94685
    published2016-11-11
    reporterThis script is Copyright (C) 2016-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/94685
    titleAmazon Linux AMI : policycoreutils (ALAS-2016-765)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-0535.NASL
    descriptionAn update for policycoreutils is now available for Red Hat Enterprise Linux 7.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The policycoreutils packages contain the core policy utilities required to manage a SELinux environment. Security Fix(es) : * It was found that the sandbox tool provided in policycoreutils was vulnerable to a TIOCSTI ioctl attack. A specially crafted program executed via the sandbox command could use this flaw to execute arbitrary commands in the context of the parent shell, escaping the sandbox. (CVE-2016-7545)
    last seen2020-06-01
    modified2020-06-02
    plugin id97768
    published2017-03-16
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97768
    titleRHEL 7 : policycoreutils (RHSA-2017:0535)
  • NASL familyOracleVM Local Security Checks
    NASL idORACLEVM_OVMSA-2016-0157.NASL
    descriptionThe remote OracleVM system is missing necessary patches to address critical security updates : - Lazy unmount private, shared entry(Joe Jin)[orabug 12560705] - sandbox: create a new session for sandboxed processes Resolves: (CVE-2016-7545) - Update translations Resolves: rhbz#819794 - Fix sepolgen test cases Resolves: rhbz#1306550 - sandbox: Improve comments in sysconfig file Resolves: rhbz#1159336 - secon, newrole: fix inconsistence between --help and man page Resolves: rhbz#1278811, rhbz#1278913 - restorecond: treat root as a regular user Resolves: rhbz#1281877 - semanage: don
    last seen2020-06-01
    modified2020-06-02
    plugin id94909
    published2016-11-16
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/94909
    titleOracleVM 3.3 / 3.4 : policycoreutils (OVMSA-2016-0157)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-638.NASL
    descriptionIt was discovered that there was a sandbox escape via the
    last seen2020-03-17
    modified2016-09-26
    plugin id93691
    published2016-09-26
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/93691
    titleDebian DLA-638-1 : policycoreutils security update
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2016-2702.NASL
    descriptionAn update for policycoreutils is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The policycoreutils packages contain the core policy utilities required to manage a SELinux environment. Security Fix(es) : * It was found that the sandbox tool provided in policycoreutils was vulnerable to a TIOCSTI ioctl attack. A specially crafted program executed via the sandbox command could use this flaw to execute arbitrary commands in the context of the parent shell, escaping the sandbox. (CVE-2016-7545)
    last seen2020-06-01
    modified2020-06-02
    plugin id94978
    published2016-11-21
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/94978
    titleCentOS 6 / 7 : policycoreutils (CESA-2016:2702)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2017-0340-1.NASL
    descriptionThis update for policycoreutils fixes the following issues : - CVE-2016-7545: nonpriv session can escape to parent [bsc#1000998] Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id96925
    published2017-02-01
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96925
    titleSUSE SLES12 Security Update : policycoreutils (SUSE-SU-2017:0340-1)

Redhat

advisories
  • bugzilla
    id1378577
    titleCVE-2016-7545 policycoreutils: SELinux sandbox escape via TIOCSTI ioctl
    oval
    OR
    • commentRed Hat Enterprise Linux must be installed
      ovaloval:com.redhat.rhba:tst:20070304026
    • AND
      • commentRed Hat Enterprise Linux 6 is installed
        ovaloval:com.redhat.rhba:tst:20111656003
      • OR
        • AND
          • commentpolicycoreutils-python is earlier than 0:2.0.83-30.1.el6_8
            ovaloval:com.redhat.rhsa:tst:20162702001
          • commentpolicycoreutils-python is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110414018
        • AND
          • commentpolicycoreutils-sandbox is earlier than 0:2.0.83-30.1.el6_8
            ovaloval:com.redhat.rhsa:tst:20162702003
          • commentpolicycoreutils-sandbox is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110414014
        • AND
          • commentpolicycoreutils-newrole is earlier than 0:2.0.83-30.1.el6_8
            ovaloval:com.redhat.rhsa:tst:20162702005
          • commentpolicycoreutils-newrole is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110414016
        • AND
          • commentpolicycoreutils is earlier than 0:2.0.83-30.1.el6_8
            ovaloval:com.redhat.rhsa:tst:20162702007
          • commentpolicycoreutils is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110414020
        • AND
          • commentpolicycoreutils-gui is earlier than 0:2.0.83-30.1.el6_8
            ovaloval:com.redhat.rhsa:tst:20162702009
          • commentpolicycoreutils-gui is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110414012
    • AND
      • commentRed Hat Enterprise Linux 7 is installed
        ovaloval:com.redhat.rhba:tst:20150364027
      • OR
        • AND
          • commentpolicycoreutils-restorecond is earlier than 0:2.5-9.el7
            ovaloval:com.redhat.rhsa:tst:20162702012
          • commentpolicycoreutils-restorecond is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20162702013
        • AND
          • commentpolicycoreutils-sandbox is earlier than 0:2.5-9.el7
            ovaloval:com.redhat.rhsa:tst:20162702014
          • commentpolicycoreutils-sandbox is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110414014
        • AND
          • commentpolicycoreutils-devel is earlier than 0:2.5-9.el7
            ovaloval:com.redhat.rhsa:tst:20162702015
          • commentpolicycoreutils-devel is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20162702016
        • AND
          • commentpolicycoreutils-gui is earlier than 0:2.5-9.el7
            ovaloval:com.redhat.rhsa:tst:20162702017
          • commentpolicycoreutils-gui is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110414012
        • AND
          • commentpolicycoreutils is earlier than 0:2.5-9.el7
            ovaloval:com.redhat.rhsa:tst:20162702018
          • commentpolicycoreutils is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110414020
        • AND
          • commentpolicycoreutils-newrole is earlier than 0:2.5-9.el7
            ovaloval:com.redhat.rhsa:tst:20162702019
          • commentpolicycoreutils-newrole is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110414016
        • AND
          • commentpolicycoreutils-python is earlier than 0:2.5-9.el7
            ovaloval:com.redhat.rhsa:tst:20162702020
          • commentpolicycoreutils-python is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110414018
    rhsa
    idRHSA-2016:2702
    released2016-11-14
    severityImportant
    titleRHSA-2016:2702: policycoreutils security update (Important)
  • rhsa
    idRHSA-2017:0535
  • rhsa
    idRHSA-2017:0536
rpms
  • policycoreutils-0:2.0.83-30.1.el6_8
  • policycoreutils-0:2.5-9.el7
  • policycoreutils-debuginfo-0:2.0.83-30.1.el6_8
  • policycoreutils-debuginfo-0:2.5-9.el7
  • policycoreutils-devel-0:2.5-9.el7
  • policycoreutils-gui-0:2.0.83-30.1.el6_8
  • policycoreutils-gui-0:2.5-9.el7
  • policycoreutils-newrole-0:2.0.83-30.1.el6_8
  • policycoreutils-newrole-0:2.5-9.el7
  • policycoreutils-python-0:2.0.83-30.1.el6_8
  • policycoreutils-python-0:2.5-9.el7
  • policycoreutils-restorecond-0:2.5-9.el7
  • policycoreutils-sandbox-0:2.0.83-30.1.el6_8
  • policycoreutils-sandbox-0:2.5-9.el7
  • policycoreutils-0:2.2.5-21.el7_2
  • policycoreutils-debuginfo-0:2.2.5-21.el7_2
  • policycoreutils-devel-0:2.2.5-21.el7_2
  • policycoreutils-gui-0:2.2.5-21.el7_2
  • policycoreutils-newrole-0:2.2.5-21.el7_2
  • policycoreutils-python-0:2.2.5-21.el7_2
  • policycoreutils-restorecond-0:2.2.5-21.el7_2
  • policycoreutils-sandbox-0:2.2.5-21.el7_2
  • policycoreutils-0:2.2.5-16.ael7b_1
  • policycoreutils-0:2.2.5-16.el7_1
  • policycoreutils-debuginfo-0:2.2.5-16.ael7b_1
  • policycoreutils-debuginfo-0:2.2.5-16.el7_1
  • policycoreutils-devel-0:2.2.5-16.ael7b_1
  • policycoreutils-devel-0:2.2.5-16.el7_1
  • policycoreutils-gui-0:2.2.5-16.ael7b_1
  • policycoreutils-gui-0:2.2.5-16.el7_1
  • policycoreutils-newrole-0:2.2.5-16.ael7b_1
  • policycoreutils-newrole-0:2.2.5-16.el7_1
  • policycoreutils-python-0:2.2.5-16.ael7b_1
  • policycoreutils-python-0:2.2.5-16.el7_1
  • policycoreutils-restorecond-0:2.2.5-16.ael7b_1
  • policycoreutils-restorecond-0:2.2.5-16.el7_1
  • policycoreutils-sandbox-0:2.2.5-16.ael7b_1
  • policycoreutils-sandbox-0:2.2.5-16.el7_1

References