Vulnerabilities > CVE-2017-7501 - Link Following vulnerability in RPM

047910
CVSS 7.8 - HIGH
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
local
low complexity
rpm
CWE-59
nessus
NVD
Published: 2017-11-22
Updated: 2023-11-07

Summary

It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.

Vulnerable Configurations

Part Description Count
Application
Rpm
156

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Symlink Attack
    An attacker positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name. The endpoint file may be either output or input. If the file is output, the result is that the endpoint is modified, instead of a file at the intended location. Modifications to the endpoint file may include appending, overwriting, corrupting, changing permissions, or other modifications. In some variants of this attack the attacker may be able to control the change to a file while in other cases they cannot. The former is especially damaging since the attacker may be able to grant themselves increased privileges or insert false information, but the latter can also be damaging as it can expose sensitive information or corrupt or destroy vital system or application files. Alternatively, the endpoint file may serve as input to the targeted application. This can be used to feed malformed input into the target or to cause the target to process different information, possibly allowing the attacker to control the actions of the target or to cause the target to expose information to the attacker. Moreover, the actions taken on the endpoint file are undertaken with the permissions of the targeted user or application, which may exceed the permissions that the attacker would normally have.
  • Accessing, Modifying or Executing Executable Files
    An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Manipulating Input to File System Calls
    An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.

Nessus

  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1616.NASL
    descriptionAccording to the version of the rpm packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - It was found that rpm uses temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.(CVE-2017-7501) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id125568
    published2019-05-30
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125568
    titleEulerOS Virtualization for ARM 64 3.0.2.0 : rpm (EulerOS-SA-2019-1616)
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(125568);
  script_version("1.4");
  script_cvs_date("Date: 2020/01/15");

  script_cve_id(
    "CVE-2017-7501"
  );

  script_name(english:"EulerOS Virtualization for ARM 64 3.0.2.0 : rpm (EulerOS-SA-2019-1616)");
  script_summary(english:"Checks the rpm output for the updated package.");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS Virtualization for ARM 64 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"According to the version of the rpm packages installed, the EulerOS
Virtualization for ARM 64 installation on the remote host is affected
by the following vulnerability :

  - It was found that rpm uses temporary files with
    predictable names when installing an RPM. An attacker
    with ability to write in a directory where files will
    be installed could create symbolic links to an
    arbitrary location and modify content, and possibly
    permissions to arbitrary files, which could be used for
    denial of service or possibly privilege
    escalation.(CVE-2017-7501)

Note that Tenable Network Security has extracted the preceding
description block directly from the EulerOS security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1616
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?86ec5b81");
  script_set_attribute(attribute:"solution", value:
"Update the affected rpm package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"patch_publication_date", value:"2019/05/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/05/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rpm");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rpm-build");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rpm-build-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rpm-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rpm-python");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:uvp:3.0.2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/uvp_version");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item("Host/EulerOS/release");
if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
uvp = get_kb_item("Host/EulerOS/uvp_version");
if (uvp != "3.0.2.0") audit(AUDIT_OS_NOT, "EulerOS Virtualization 3.0.2.0");
if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);

flag = 0;

pkgs = ["rpm-4.11.3-32.h6",
        "rpm-build-4.11.3-32.h6",
        "rpm-build-libs-4.11.3-32.h6",
        "rpm-libs-4.11.3-32.h6",
        "rpm-python-4.11.3-32.h6"];

foreach (pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "rpm");
}
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2018-3884-1.NASL
    descriptionThis update for rpm fixes the following issues : These security issues were fixed : CVE-2017-7500: rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination (bsc#943457). CVE-2017-7501: rpm used temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation (bsc#943457) This is a reissue of the above security fixes for SUSE Linux Enterprise 12 GA, SP1 and SP2 LTSS, they have already been released for SUSE Linux Enterprise Server 12 SP3. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id119145
    published2018-11-26
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119145
    titleSUSE SLED12 / SLES12 Security Update : rpm (SUSE-SU-2018:3884-1)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from SUSE update advisory SUSE-SU-2018:3884-1.
# The text itself is copyright (C) SUSE.
#

include("compat.inc");

if (description)
{
  script_id(119145);
  script_version("1.2");
  script_cvs_date("Date: 2019/09/10 13:51:49");

  script_cve_id("CVE-2017-7500", "CVE-2017-7501");

  script_name(english:"SUSE SLED12 / SLES12 Security Update : rpm (SUSE-SU-2018:3884-1)");
  script_summary(english:"Checks rpm output for the updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SUSE host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update for rpm fixes the following issues :

These security issues were fixed :

CVE-2017-7500: rpm did not properly handle RPM installations when a
destination path was a symbolic link to a directory, possibly changing
ownership and permissions of an arbitrary directory, and RPM files
being placed in an arbitrary destination (bsc#943457).

CVE-2017-7501: rpm used temporary files with predictable names when
installing an RPM. An attacker with ability to write in a directory
where files will be installed could create symbolic links to an
arbitrary location and modify content, and possibly permissions to
arbitrary files, which could be used for denial of service or possibly
privilege escalation (bsc#943457)

This is a reissue of the above security fixes for SUSE Linux
Enterprise 12 GA, SP1 and SP2 LTSS, they have already been released
for SUSE Linux Enterprise Server 12 SP3.

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=943457"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2017-7500/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2017-7501/"
  );
  # https://www.suse.com/support/update/announcement/2018/suse-su-20183884-1/
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?8139f1fd"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"To install this SUSE Security Update use the SUSE recommended
installation methods like YaST online_update or 'zypper patch'.

Alternatively you can run the command listed for your product :

SUSE OpenStack Cloud 7:zypper in -t patch
SUSE-OpenStack-Cloud-7-2018-2766=1

SUSE Linux Enterprise Software Development Kit 12-SP4:zypper in -t
patch SUSE-SLE-SDK-12-SP4-2018-2766=1

SUSE Linux Enterprise Software Development Kit 12-SP3:zypper in -t
patch SUSE-SLE-SDK-12-SP3-2018-2766=1

SUSE Linux Enterprise Server for SAP 12-SP2:zypper in -t patch
SUSE-SLE-SAP-12-SP2-2018-2766=1

SUSE Linux Enterprise Server 12-SP4:zypper in -t patch
SUSE-SLE-SERVER-12-SP4-2018-2766=1

SUSE Linux Enterprise Server 12-SP3:zypper in -t patch
SUSE-SLE-SERVER-12-SP3-2018-2766=1

SUSE Linux Enterprise Server 12-SP2-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-SP2-2018-2766=1

SUSE Linux Enterprise Server 12-SP2-BCL:zypper in -t patch
SUSE-SLE-SERVER-12-SP2-BCL-2018-2766=1

SUSE Linux Enterprise Server 12-SP1-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-SP1-2018-2766=1

SUSE Linux Enterprise Server 12-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-2018-2766=1

SUSE Linux Enterprise Desktop 12-SP4:zypper in -t patch
SUSE-SLE-DESKTOP-12-SP4-2018-2766=1

SUSE Linux Enterprise Desktop 12-SP3:zypper in -t patch
SUSE-SLE-DESKTOP-12-SP3-2018-2766=1

SUSE Enterprise Storage 4:zypper in -t patch
SUSE-Storage-4-2018-2766=1

SUSE CaaS Platform ALL :

To install this update, use the SUSE CaaS Platform Velum dashboard. It
will inform you if it detects new updates and let you then trigger
updating of the complete cluster in a controlled way.

SUSE CaaS Platform 3.0 :

To install this update, use the SUSE CaaS Platform Velum dashboard. It
will inform you if it detects new updates and let you then trigger
updating of the complete cluster in a controlled way.

OpenStack Cloud Magnum Orchestration 7:zypper in -t patch
SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2018-2766=1"
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python3-rpm");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python3-rpm-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python3-rpm-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:rpm");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:rpm-build");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:rpm-build-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:rpm-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:rpm-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:rpm-python");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:rpm-python-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:rpm-python-debugsource");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/11/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/11/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/11/26");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
os_ver = os_ver[1];
if (! preg(pattern:"^(SLED12|SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED12 / SLES12", "SUSE " + os_ver);

if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);

sp = get_kb_item("Host/SuSE/patchlevel");
if (isnull(sp)) sp = "0";
if (os_ver == "SLES12" && (! preg(pattern:"^(0|1|2|3|4)$", string:sp))) audit(AUDIT_OS_NOT, "SLES12 SP0/1/2/3/4", os_ver + " SP" + sp);
if (os_ver == "SLED12" && (! preg(pattern:"^(3|4)$", string:sp))) audit(AUDIT_OS_NOT, "SLED12 SP3/4", os_ver + " SP" + sp);


flag = 0;
if (rpm_check(release:"SLES12", sp:"1", reference:"python3-rpm-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"python3-rpm-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"python3-rpm-debugsource-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"rpm-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"rpm-build-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"rpm-build-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"rpm-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"rpm-debugsource-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"rpm-python-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"rpm-python-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"rpm-python-debugsource-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"rpm-32bit-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"rpm-debuginfo-32bit-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"python3-rpm-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"python3-rpm-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"python3-rpm-debugsource-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"rpm-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"rpm-build-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"rpm-build-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"rpm-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"rpm-debugsource-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"rpm-python-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"rpm-python-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"rpm-python-debugsource-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"rpm-32bit-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"rpm-debuginfo-32bit-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"python3-rpm-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"python3-rpm-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"python3-rpm-debugsource-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"rpm-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"rpm-build-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"rpm-build-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"rpm-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"rpm-debugsource-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"rpm-python-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"rpm-python-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"rpm-python-debugsource-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"rpm-32bit-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"rpm-debuginfo-32bit-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"python3-rpm-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"python3-rpm-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"python3-rpm-debugsource-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"rpm-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"rpm-build-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"rpm-build-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"rpm-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"rpm-debugsource-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"rpm-python-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"rpm-python-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"rpm-python-debugsource-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"rpm-32bit-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"rpm-debuginfo-32bit-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python3-rpm-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python3-rpm-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python3-rpm-debugsource-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"rpm-32bit-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"rpm-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"rpm-build-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"rpm-build-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"rpm-debuginfo-32bit-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"rpm-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"rpm-debugsource-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"rpm-python-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"rpm-python-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"rpm-python-debugsource-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"python3-rpm-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"python3-rpm-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"python3-rpm-debugsource-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"rpm-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"rpm-build-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"rpm-build-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"rpm-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"rpm-debugsource-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"rpm-python-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"rpm-python-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"rpm-python-debugsource-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"rpm-32bit-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"rpm-debuginfo-32bit-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python3-rpm-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python3-rpm-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python3-rpm-debugsource-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"rpm-32bit-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"rpm-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"rpm-build-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"rpm-build-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"rpm-debuginfo-32bit-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"rpm-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"rpm-debugsource-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"rpm-python-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"rpm-python-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"rpm-python-debugsource-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"rpm-32bit-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"rpm-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"rpm-build-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"rpm-build-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"rpm-debuginfo-32bit-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"rpm-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"rpm-debugsource-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"rpm-python-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"rpm-python-debuginfo-4.11.2-16.21.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"rpm-python-debugsource-4.11.2-16.21.1")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "rpm");
}
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2017-1_0-0095.NASL
    descriptionAn update of 'curl', 'docker', 'binutils', 'linux','rpm' packages of Photon OS has been released.
    last seen2019-02-21
    modified2019-02-07
    plugin id111904
    published2018-08-17
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=111904
    titlePhoton OS 1.0: Binutils / Curl / Docker / Linux / Rpm PHSA-2017-1.0-0095 (deprecated)
    code
    #
# (C) Tenable Network Security, Inc.
#
# @DEPRECATED@
#
# Disabled on 2/7/2019
#

# The descriptive text and package checks in this plugin were
# extracted from VMware Security Advisory PHSA-2017-1.0-0095. The text
# itself is copyright (C) VMware, Inc.

include("compat.inc");

if (description)
{
  script_id(111904);
  script_version("1.2");
  script_cvs_date("Date: 2019/02/07 18:59:50");

  script_cve_id(
    "CVE-2017-7501",
    "CVE-2017-8818",
    "CVE-2017-12190",
    "CVE-2017-14992",
    "CVE-2017-17121",
    "CVE-2017-17122",
    "CVE-2017-17124",
    "CVE-2017-17125",
    "CVE-2017-1000407"
  );

  script_name(english:"Photon OS 1.0: Binutils / Curl / Docker / Linux / Rpm PHSA-2017-1.0-0095 (deprecated)");
  script_summary(english:"Checks the rpm output for the updated packages.");

  script_set_attribute(attribute:"synopsis", value:
"This plugin has been deprecated.");
  script_set_attribute(attribute:"description", value:
"An update of 'curl', 'docker', 'binutils', 'linux','rpm' packages of
Photon OS has been released.");
  # https://github.com/vmware/photon/wiki/Security-Updates-1.0-95
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5e92d3f9");
  script_set_attribute(attribute:"solution", value:"n/a.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-8818");

  script_set_attribute(attribute:"patch_publication_date", value:"2017/12/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/08/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:vmware:photonos:binutils");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:vmware:photonos:curl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:vmware:photonos:docker");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:vmware:photonos:linux");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:vmware:photonos:rpm");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:photonos:1.0");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"PhotonOS Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/PhotonOS/release", "Host/PhotonOS/rpm-list");

  exit(0);
}

exit(0, "This plugin has been deprecated.");

include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item("Host/PhotonOS/release");
if (isnull(release) || release !~ "^VMware Photon") audit(AUDIT_OS_NOT, "PhotonOS");
if (release !~ "^VMware Photon (?:Linux|OS) 1\.0(\D|$)") audit(AUDIT_OS_NOT, "PhotonOS 1.0");

if (!get_kb_item("Host/PhotonOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "PhotonOS", cpu);

flag = 0;

pkgs = [
  "binutils-2.29.1-3.ph1",
  "binutils-debuginfo-2.29.1-3.ph1",
  "binutils-devel-2.29.1-3.ph1",
  "curl-7.56.1-2.ph1",
  "curl-debuginfo-7.56.1-2.ph1",
  "docker-17.06.0-2.ph1",
  "docker-doc-17.06.0-2.ph1",
  "linux-4.4.106-1.ph1",
  "linux-api-headers-4.4.106-1.ph1",
  "linux-debuginfo-4.4.106-1.ph1",
  "linux-dev-4.4.106-1.ph1",
  "linux-docs-4.4.106-1.ph1",
  "linux-drivers-gpu-4.4.106-1.ph1",
  "linux-esx-4.4.106-1.ph1",
  "linux-esx-debuginfo-4.4.106-1.ph1",
  "linux-esx-devel-4.4.106-1.ph1",
  "linux-esx-docs-4.4.106-1.ph1",
  "linux-oprofile-4.4.106-1.ph1",
  "linux-sound-4.4.106-1.ph1",
  "linux-tools-4.4.106-1.ph1",
  "rpm-4.13.0.1-4.ph1",
  "rpm-debuginfo-4.13.0.1-4.ph1"
];

foreach (pkg in pkgs)
  if (rpm_check(release:"PhotonOS-1.0", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "binutils / curl / docker / linux / rpm");
}
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1043.NASL
    descriptionAccording to the version of the rpm packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that rpm uses temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.(CVE-2017-7501) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2019-02-15
    plugin id122216
    published2019-02-15
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/122216
    titleEulerOS 2.0 SP3 : rpm (EulerOS-SA-2019-1043)
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(122216);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/04");

  script_cve_id(
    "CVE-2017-7501"
  );

  script_name(english:"EulerOS 2.0 SP3 : rpm (EulerOS-SA-2019-1043)");
  script_summary(english:"Checks the rpm output for the updated package.");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"According to the version of the rpm packages installed, the EulerOS
installation on the remote host is affected by the following
vulnerability :

  - It was found that rpm uses temporary files with
    predictable names when installing an RPM. An attacker
    with ability to write in a directory where files will
    be installed could create symbolic links to an
    arbitrary location and modify content, and possibly
    permissions to arbitrary files, which could be used for
    denial of service or possibly privilege
    escalation.(CVE-2017-7501)

Note that Tenable Network Security has extracted the preceding
description block directly from the EulerOS security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1043
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?72601959");
  script_set_attribute(attribute:"solution", value:
"Update the affected rpm package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"patch_publication_date", value:"2019/01/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/02/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rpm");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rpm-build");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rpm-build-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rpm-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rpm-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rpm-python");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rpm-sign");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item("Host/EulerOS/release");
if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");

sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(3)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP3");

uvp = get_kb_item("Host/EulerOS/uvp_version");
if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP3", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

flag = 0;

pkgs = ["rpm-4.11.3-21.h5",
        "rpm-build-4.11.3-21.h5",
        "rpm-build-libs-4.11.3-21.h5",
        "rpm-devel-4.11.3-21.h5",
        "rpm-libs-4.11.3-21.h5",
        "rpm-python-4.11.3-21.h5",
        "rpm-sign-4.11.3-21.h5"];

foreach (pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"3", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "rpm");
}
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2018-1353.NASL
    descriptionAccording to the version of the rpm packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that rpm uses temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.(CVE-2017-7501) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2018-11-06
    plugin id118736
    published2018-11-06
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/118736
    titleEulerOS 2.0 SP2 : rpm (EulerOS-SA-2018-1353)
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(118736);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/04");

  script_cve_id(
    "CVE-2017-7501"
  );

  script_name(english:"EulerOS 2.0 SP2 : rpm (EulerOS-SA-2018-1353)");
  script_summary(english:"Checks the rpm output for the updated package.");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"According to the version of the rpm packages installed, the EulerOS
installation on the remote host is affected by the following
vulnerability :

  - It was found that rpm uses temporary files with
    predictable names when installing an RPM. An attacker
    with ability to write in a directory where files will
    be installed could create symbolic links to an
    arbitrary location and modify content, and possibly
    permissions to arbitrary files, which could be used for
    denial of service or possibly privilege
    escalation.(CVE-2017-7501)

Note that Tenable Network Security has extracted the preceding
description block directly from the EulerOS security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2018-1353
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d33bee68");
  script_set_attribute(attribute:"solution", value:
"Update the affected rpm package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");

  script_set_attribute(attribute:"patch_publication_date", value:"2018/10/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/11/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rpm");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rpm-build");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rpm-build-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rpm-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rpm-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rpm-python");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rpm-sign");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item("Host/EulerOS/release");
if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");

sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(2)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP2");

uvp = get_kb_item("Host/EulerOS/uvp_version");
if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP2", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

flag = 0;

pkgs = ["rpm-4.11.3-17.h3",
        "rpm-build-4.11.3-17.h3",
        "rpm-build-libs-4.11.3-17.h3",
        "rpm-devel-4.11.3-17.h3",
        "rpm-libs-4.11.3-17.h3",
        "rpm-python-4.11.3-17.h3",
        "rpm-sign-4.11.3-17.h3"];

foreach (pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"2", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "rpm");
}
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2017-AB57A100F3.NASL
    descriptionThis latest stable release on rpm 4.13.x branch brings in several important bugfixes. For details see release notes at http://rpm.org/wiki/Releases/4.13.0.2. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2017-11-29
    plugin id104828
    published2017-11-29
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104828
    titleFedora 25 : rpm (2017-ab57a100f3)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1011.NASL
    descriptionAccording to the version of the rpm packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that rpm uses temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.(CVE-2017-7501) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2019-01-08
    plugin id120999
    published2019-01-08
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/120999
    titleEulerOS 2.0 SP5 : rpm (EulerOS-SA-2019-1011)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201811-22.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201811-22 (RPM: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in RPM. Please review the CVE identifiers referenced below for details. Impact : A remote attacker, by enticing the user to process a specially crafted RPM file, could escalate privileges, execute arbitrary code, or cause a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id119276
    published2018-11-29
    reporterThis script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119276
    titleGLSA-201811-22 : RPM: Multiple vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2018-3286-1.NASL
    descriptionThis update for rpm fixes the following issues : These security issues were fixed : CVE-2017-7500: rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination (bsc#943457). CVE-2017-7501: rpm used temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation (bsc#943457) The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id118319
    published2018-10-23
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/118319
    titleSUSE SLED12 / SLES12 Security Update : rpm (SUSE-SU-2018:3286-1)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1466.NASL
    descriptionAccording to the version of the rpm packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - It was found that rpm uses temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.(CVE-2017-7501) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id124969
    published2019-05-14
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124969
    titleEulerOS Virtualization 3.0.1.0 : rpm (EulerOS-SA-2019-1466)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1210.NASL
    descriptionAccording to the version of the rpm packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - It was found that rpm uses temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.i1/4^CVE-2017-7501i1/4%0 Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-19
    modified2019-04-09
    plugin id123896
    published2019-04-09
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/123896
    titleEulerOS Virtualization 2.5.4 : rpm (EulerOS-SA-2019-1210)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2018-1246.NASL
    descriptionThis update for rpm fixes the following issues : These security issues were fixed : - CVE-2017-7500: rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination (bsc#943457). - CVE-2017-7501: rpm used temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation (bsc#943457) This non-security issue was fixed : - Use ksym-provides tool [bsc#1077692] This update was imported from the SUSE:SLE-12:Update update project.
    last seen2020-06-05
    modified2018-10-25
    plugin id118382
    published2018-10-25
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/118382
    titleopenSUSE Security Update : rpm (openSUSE-2018-1246)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2017-9232EAC8E8.NASL
    descriptionThis latest stable release on rpm 4.13.x branch brings in several important bugfixes. For details see release notes at http://rpm.org/wiki/Releases/4.13.0.2. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2017-11-08
    plugin id104447
    published2017-11-08
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104447
    titleFedora 26 : rpm (2017-9232eac8e8)
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2017-1_0-0095_RPM.NASL
    descriptionAn update of the rpm package has been released.
    last seen2020-03-17
    modified2019-02-07
    plugin id121787
    published2019-02-07
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121787
    titlePhoton OS 1.0: Rpm PHSA-2017-1.0-0095

References