Vulnerabilities > CVE-2018-16866 - Out-of-bounds Read vulnerability in multiple products

047910
CVSS 3.3 - LOW
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
LOW
Integrity impact
NONE
Availability impact
NONE

Summary

An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable.

Vulnerable Configurations

Part Description Count
Application
Systemd_Project
19
Application
Netapp
2
OS
Debian
1
OS
Canonical
3
OS
Redhat
20

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Overread Buffers
    An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4367.NASL
    descriptionThe Qualys Research Labs discovered multiple vulnerabilities in systemd-journald. Two memory corruption flaws, via attacker-controlled allocations using the alloca function (CVE-2018-16864, CVE-2018-16865 ) and an out-of-bounds read flaw leading to an information leak (CVE-2018-16866 ), could allow an attacker to cause a denial of service or the execution of arbitrary code. Further details in the Qualys Security Advisory at https://www.qualys.com/2019/01/09/system-down/system-down.txt
    last seen2020-06-01
    modified2020-06-02
    plugin id121136
    published2019-01-14
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121136
    titleDebian DSA-4367-1 : systemd - security update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-4367. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(121136);
      script_version("1.4");
      script_cvs_date("Date: 2019/05/17  9:44:17");
    
      script_cve_id("CVE-2018-16864", "CVE-2018-16865", "CVE-2018-16866");
      script_xref(name:"DSA", value:"4367");
    
      script_name(english:"Debian DSA-4367-1 : systemd - security update");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The Qualys Research Labs discovered multiple vulnerabilities in
    systemd-journald. Two memory corruption flaws, via attacker-controlled
    allocations using the alloca function (CVE-2018-16864, CVE-2018-16865
    ) and an out-of-bounds read flaw leading to an information leak
    (CVE-2018-16866 ), could allow an attacker to cause a denial of
    service or the execution of arbitrary code.
    
    Further details in the Qualys Security Advisory at
    https://www.qualys.com/2019/01/09/system-down/system-down.txt"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=918841"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=918848"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2018-16864"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2018-16865"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2018-16866"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.qualys.com/2019/01/09/system-down/system-down.txt"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/source-package/systemd"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/stretch/systemd"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2019/dsa-4367"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the systemd packages.
    
    For the stable distribution (stretch), these problems have been fixed
    in version 232-25+deb9u7."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:systemd");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:9.0");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/11");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/01/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/01/14");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"9.0", prefix:"libnss-myhostname", reference:"232-25+deb9u7")) flag++;
    if (deb_check(release:"9.0", prefix:"libnss-mymachines", reference:"232-25+deb9u7")) flag++;
    if (deb_check(release:"9.0", prefix:"libnss-resolve", reference:"232-25+deb9u7")) flag++;
    if (deb_check(release:"9.0", prefix:"libnss-systemd", reference:"232-25+deb9u7")) flag++;
    if (deb_check(release:"9.0", prefix:"libpam-systemd", reference:"232-25+deb9u7")) flag++;
    if (deb_check(release:"9.0", prefix:"libsystemd-dev", reference:"232-25+deb9u7")) flag++;
    if (deb_check(release:"9.0", prefix:"libsystemd0", reference:"232-25+deb9u7")) flag++;
    if (deb_check(release:"9.0", prefix:"libudev-dev", reference:"232-25+deb9u7")) flag++;
    if (deb_check(release:"9.0", prefix:"libudev1", reference:"232-25+deb9u7")) flag++;
    if (deb_check(release:"9.0", prefix:"libudev1-udeb", reference:"232-25+deb9u7")) flag++;
    if (deb_check(release:"9.0", prefix:"systemd", reference:"232-25+deb9u7")) flag++;
    if (deb_check(release:"9.0", prefix:"systemd-container", reference:"232-25+deb9u7")) flag++;
    if (deb_check(release:"9.0", prefix:"systemd-coredump", reference:"232-25+deb9u7")) flag++;
    if (deb_check(release:"9.0", prefix:"systemd-journal-remote", reference:"232-25+deb9u7")) flag++;
    if (deb_check(release:"9.0", prefix:"systemd-sysv", reference:"232-25+deb9u7")) flag++;
    if (deb_check(release:"9.0", prefix:"udev", reference:"232-25+deb9u7")) flag++;
    if (deb_check(release:"9.0", prefix:"udev-udeb", reference:"232-25+deb9u7")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2019-3222.NASL
    descriptionAn update for systemd is now available for Red Hat Enterprise Linux 7.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit. Security Fix(es) : * systemd: line splitting via fgets() allows for state injection during daemon-reexec (CVE-2018-15686) * systemd: out-of-bounds read when parsing a crafted syslog message (CVE-2018-16866) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es) : * Layered slices are left in a
    last seen2020-06-01
    modified2020-06-02
    plugin id130377
    published2019-10-30
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130377
    titleRHEL 7 : systemd (RHSA-2019:3222)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2019:3222. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(130377);
      script_version("1.3");
      script_cvs_date("Date: 2020/01/15");
    
      script_cve_id("CVE-2018-15686", "CVE-2018-16866");
      script_xref(name:"RHSA", value:"2019:3222");
    
      script_name(english:"RHEL 7 : systemd (RHSA-2019:3222)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An update for systemd is now available for Red Hat Enterprise Linux
    7.6 Extended Update Support.
    
    Red Hat Product Security has rated this update as having a security
    impact of Moderate. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    The systemd packages contain systemd, a system and service manager for
    Linux, compatible with the SysV and LSB init scripts. It provides
    aggressive parallelism capabilities, uses socket and D-Bus activation
    for starting services, offers on-demand starting of daemons, and keeps
    track of processes using Linux cgroups. In addition, it supports
    snapshotting and restoring of the system state, maintains mount and
    automount points, and implements an elaborate transactional
    dependency-based service control logic. It can also work as a drop-in
    replacement for sysvinit.
    
    Security Fix(es) :
    
    * systemd: line splitting via fgets() allows for state injection
    during daemon-reexec (CVE-2018-15686)
    
    * systemd: out-of-bounds read when parsing a crafted syslog message
    (CVE-2018-16866)
    
    For more details about the security issue(s), including the impact, a
    CVSS score, acknowledgments, and other related information, refer to
    the CVE page(s) listed in the References section.
    
    Bug Fix(es) :
    
    * Layered slices are left in a 'dead' state if slices are stopped that
    have child slices underneath (BZ#1729227)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2019:3222"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-15686"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-16866"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libgudev1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libgudev1-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:systemd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:systemd-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:systemd-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:systemd-journal-gateway");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:systemd-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:systemd-networkd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:systemd-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:systemd-resolved");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:systemd-sysv");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.6");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/10/26");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/10/29");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/10/30");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 7.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2019:3222";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL7", sp:"6", reference:"libgudev1-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390", reference:"libgudev1-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"libgudev1-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", sp:"6", reference:"libgudev1-devel-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390", reference:"libgudev1-devel-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"libgudev1-devel-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"systemd-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", sp:"6", cpu:"x86_64", reference:"systemd-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", sp:"6", reference:"systemd-debuginfo-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390", reference:"systemd-debuginfo-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"systemd-debuginfo-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", sp:"6", reference:"systemd-devel-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390", reference:"systemd-devel-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"systemd-devel-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"systemd-journal-gateway-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", sp:"6", cpu:"x86_64", reference:"systemd-journal-gateway-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", sp:"6", reference:"systemd-libs-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390", reference:"systemd-libs-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"systemd-libs-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"systemd-networkd-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", sp:"6", cpu:"x86_64", reference:"systemd-networkd-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"systemd-python-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", sp:"6", cpu:"x86_64", reference:"systemd-python-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", sp:"6", reference:"systemd-resolved-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390", reference:"systemd-resolved-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"systemd-resolved-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"systemd-sysv-219-62.el7_6.11")) flag++;
    
      if (rpm_check(release:"RHEL7", sp:"6", cpu:"x86_64", reference:"systemd-sysv-219-62.el7_6.11")) flag++;
    
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libgudev1 / libgudev1-devel / systemd / systemd-debuginfo / etc");
      }
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-0135-1.NASL
    descriptionThis update for systemd provides the following fixes : Security issues fixed : CVE-2018-16864, CVE-2018-16865: Fixed two memory corruptions through attacker-controlled alloca()s (bsc#1120323) CVE-2018-16866: Fixed an information leak in journald (bsc#1120323) Fixed an issue during system startup in relation to encrypted swap disks (bsc#1119971) Non-security issues fixed: core: Queue loading transient units after setting their properties. (bsc#1115518) logind: Stop managing VT switches if no sessions are registered on that VT. (bsc#1101591) terminal-util: introduce vt_release() and vt_restore() helpers. terminal: Unify code for resetting kbd utf8 mode a bit. terminal Reset should honour default_utf8 kernel setting. logind: Make session_restore_vt() static. udev: Downgrade message when settting inotify watch up fails. (bsc#1005023) log: Never log into foreign fd #2 in PID 1 or its pre-execve() children. (bsc#1114981) udev: Ignore the exit code of systemd-detect-virt for memory hot-add. In SLE-12-SP3, 80-hotplug-cpu-mem.rules has a memory hot-add rule that uses systemd-detect-virt to detect non-zvm environment. The systemd-detect-virt returns exit failure code when it detected _none_ state. The exit failure code causes that the hot-add memory block can not be set to online. (bsc#1076696) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id121303
    published2019-01-22
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121303
    titleSUSE SLED12 / SLES12 Security Update : systemd (SUSE-SU-2019:0135-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from SUSE update advisory SUSE-SU-2019:0135-1.
    # The text itself is copyright (C) SUSE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(121303);
      script_version("1.5");
      script_cvs_date("Date: 2019/09/10 13:51:50");
    
      script_cve_id("CVE-2018-16864", "CVE-2018-16865", "CVE-2018-16866");
    
      script_name(english:"SUSE SLED12 / SLES12 Security Update : systemd (SUSE-SU-2019:0135-1)");
      script_summary(english:"Checks rpm output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SUSE host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update for systemd provides the following fixes :
    
    Security issues fixed :
    
    CVE-2018-16864, CVE-2018-16865: Fixed two memory corruptions through
    attacker-controlled alloca()s (bsc#1120323)
    
    CVE-2018-16866: Fixed an information leak in journald (bsc#1120323)
    
    Fixed an issue during system startup in relation to encrypted swap
    disks (bsc#1119971)
    
    Non-security issues fixed: core: Queue loading transient units after
    setting their properties. (bsc#1115518)
    
    logind: Stop managing VT switches if no sessions are registered on
    that VT. (bsc#1101591)
    
    terminal-util: introduce vt_release() and vt_restore() helpers.
    
    terminal: Unify code for resetting kbd utf8 mode a bit.
    
    terminal Reset should honour default_utf8 kernel setting.
    
    logind: Make session_restore_vt() static.
    
    udev: Downgrade message when settting inotify watch up fails.
    (bsc#1005023)
    
    log: Never log into foreign fd #2 in PID 1 or its pre-execve()
    children. (bsc#1114981)
    
    udev: Ignore the exit code of systemd-detect-virt for memory hot-add.
    In SLE-12-SP3, 80-hotplug-cpu-mem.rules has a memory hot-add rule that
    uses systemd-detect-virt to detect non-zvm environment. The
    systemd-detect-virt returns exit failure code when it detected _none_
    state. The exit failure code causes that the hot-add memory block can
    not be set to online. (bsc#1076696)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the SUSE security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1005023"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1076696"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1101591"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1114981"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1115518"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1119971"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1120323"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-16864/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-16865/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-16866/"
      );
      # https://www.suse.com/support/update/announcement/2019/suse-su-20190135-1/
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?26e98101"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "To install this SUSE Security Update use the SUSE recommended
    installation methods like YaST online_update or 'zypper patch'.
    
    Alternatively you can run the command listed for your product :
    
    SUSE OpenStack Cloud 7:zypper in -t patch
    SUSE-OpenStack-Cloud-7-2019-135=1
    
    SUSE Linux Enterprise Software Development Kit 12-SP4:zypper in -t
    patch SUSE-SLE-SDK-12-SP4-2019-135=1
    
    SUSE Linux Enterprise Software Development Kit 12-SP3:zypper in -t
    patch SUSE-SLE-SDK-12-SP3-2019-135=1
    
    SUSE Linux Enterprise Server for SAP 12-SP2:zypper in -t patch
    SUSE-SLE-SAP-12-SP2-2019-135=1
    
    SUSE Linux Enterprise Server 12-SP4:zypper in -t patch
    SUSE-SLE-SERVER-12-SP4-2019-135=1
    
    SUSE Linux Enterprise Server 12-SP3:zypper in -t patch
    SUSE-SLE-SERVER-12-SP3-2019-135=1
    
    SUSE Linux Enterprise Server 12-SP2-LTSS:zypper in -t patch
    SUSE-SLE-SERVER-12-SP2-2019-135=1
    
    SUSE Linux Enterprise Server 12-SP2-BCL:zypper in -t patch
    SUSE-SLE-SERVER-12-SP2-BCL-2019-135=1
    
    SUSE Linux Enterprise Desktop 12-SP4:zypper in -t patch
    SUSE-SLE-DESKTOP-12-SP4-2019-135=1
    
    SUSE Linux Enterprise Desktop 12-SP3:zypper in -t patch
    SUSE-SLE-DESKTOP-12-SP3-2019-135=1
    
    SUSE Enterprise Storage 4:zypper in -t patch SUSE-Storage-4-2019-135=1
    
    SUSE CaaS Platform ALL :
    
    To install this update, use the SUSE CaaS Platform Velum dashboard. It
    will inform you if it detects new updates and let you then trigger
    updating of the complete cluster in a controlled way.
    
    SUSE CaaS Platform 3.0 :
    
    To install this update, use the SUSE CaaS Platform Velum dashboard. It
    will inform you if it detects new updates and let you then trigger
    updating of the complete cluster in a controlled way.
    
    OpenStack Cloud Magnum Orchestration 7:zypper in -t patch
    SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2019-135=1"
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libsystemd0");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libsystemd0-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libsystemd0-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libsystemd0-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libudev1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libudev1-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libudev1-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libudev1-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd-sysvinit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:udev");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:udev-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/11");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/01/21");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/01/22");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
    os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(SLED12|SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED12 / SLES12", "SUSE " + os_ver);
    
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);
    
    sp = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(sp)) sp = "0";
    if (os_ver == "SLES12" && (! preg(pattern:"^(2|3|4)$", string:sp))) audit(AUDIT_OS_NOT, "SLES12 SP2/3/4", os_ver + " SP" + sp);
    if (os_ver == "SLED12" && (! preg(pattern:"^(3|4)$", string:sp))) audit(AUDIT_OS_NOT, "SLED12 SP3/4", os_ver + " SP" + sp);
    
    
    flag = 0;
    if (rpm_check(release:"SLES12", sp:"4", reference:"libsystemd0-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"libsystemd0-debuginfo-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"libudev1-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"libudev1-debuginfo-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"systemd-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"systemd-debuginfo-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"systemd-debugsource-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"systemd-sysvinit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"udev-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"udev-debuginfo-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"libsystemd0-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"libsystemd0-debuginfo-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"libudev1-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"libudev1-debuginfo-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"systemd-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"systemd-debuginfo-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"libsystemd0-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"libsystemd0-debuginfo-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"libudev1-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"libudev1-debuginfo-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"systemd-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"systemd-debuginfo-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"systemd-debugsource-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"systemd-sysvinit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"udev-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"udev-debuginfo-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"libsystemd0-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"libsystemd0-debuginfo-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"libudev1-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"libudev1-debuginfo-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"systemd-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"systemd-debuginfo-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libsystemd0-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libsystemd0-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libsystemd0-debuginfo-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libsystemd0-debuginfo-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libudev1-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libudev1-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libudev1-debuginfo-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libudev1-debuginfo-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"systemd-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"systemd-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"systemd-debuginfo-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"systemd-debuginfo-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"systemd-debugsource-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"systemd-sysvinit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"udev-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"udev-debuginfo-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", reference:"libsystemd0-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", reference:"libsystemd0-debuginfo-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", reference:"libudev1-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", reference:"libudev1-debuginfo-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", reference:"systemd-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", reference:"systemd-debuginfo-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", reference:"systemd-debugsource-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", reference:"systemd-sysvinit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", reference:"udev-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", reference:"udev-debuginfo-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", reference:"libsystemd0-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", reference:"libsystemd0-debuginfo-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", reference:"libudev1-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", reference:"libudev1-debuginfo-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", reference:"systemd-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", reference:"systemd-debuginfo-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libsystemd0-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libsystemd0-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libsystemd0-debuginfo-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libsystemd0-debuginfo-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libudev1-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libudev1-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libudev1-debuginfo-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libudev1-debuginfo-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"systemd-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"systemd-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"systemd-debuginfo-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"systemd-debuginfo-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"systemd-debugsource-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"systemd-sysvinit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"udev-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"udev-debuginfo-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libsystemd0-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libsystemd0-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libsystemd0-debuginfo-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libsystemd0-debuginfo-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libudev1-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libudev1-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libudev1-debuginfo-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libudev1-debuginfo-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"systemd-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"systemd-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"systemd-debuginfo-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"systemd-debuginfo-32bit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"systemd-debugsource-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"systemd-sysvinit-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"udev-228-150.58.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"udev-debuginfo-228-150.58.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "systemd");
    }
    
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0196_SYSTEMD.NASL
    descriptionThe remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has systemd packages installed that are affected by multiple vulnerabilities: - A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re- execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239. (CVE-2018-15686) - It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable. (CVE-2018-16888) - An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon
    last seen2020-06-01
    modified2020-06-02
    plugin id129929
    published2019-10-15
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129929
    titleNewStart CGSL CORE 5.04 / MAIN 5.04 : systemd Multiple Vulnerabilities (NS-SA-2019-0196)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    # The descriptive text and package checks in this plugin were
    # extracted from ZTE advisory NS-SA-2019-0196. The text
    # itself is copyright (C) ZTE, Inc.
    
    include("compat.inc");
    
    if (description)
    {
      script_id(129929);
      script_version("1.2");
      script_cvs_date("Date: 2019/10/17 14:31:05");
    
      script_cve_id("CVE-2018-15686", "CVE-2018-16866", "CVE-2018-16888");
    
      script_name(english:"NewStart CGSL CORE 5.04 / MAIN 5.04 : systemd Multiple Vulnerabilities (NS-SA-2019-0196)");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote machine is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has systemd packages installed that are affected
    by multiple vulnerabilities:
    
      - A vulnerability in unit_deserialize of systemd allows an
        attacker to supply arbitrary state across systemd re-
        execution via NotifyAccess. This can be used to
        improperly influence systemd execution and possibly lead
        to root privilege escalation. Affected releases are
        systemd versions up to and including 239.
        (CVE-2018-15686)
    
      - It was discovered systemd does not correctly check the
        content of PIDFile files before using it to kill
        processes. When a service is run from an unprivileged
        user (e.g. User field set in the service file), a local
        attacker who is able to write to the PIDFile of the
        mentioned service may use this flaw to trick systemd
        into killing other services and/or privileged processes.
        Versions before v237 are vulnerable. (CVE-2018-16888)
    
      - An out of bounds read was discovered in systemd-journald
        in the way it parses log messages that terminate with a
        colon ':'. A local attacker can use this flaw to
        disclose process memory data. Versions from v221 to v239
        are vulnerable. (CVE-2018-16866)
    
    Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
    number.");
      script_set_attribute(attribute:"see_also", value:"http://security.gd-linux.com/notice/NS-SA-2019-0196");
      script_set_attribute(attribute:"solution", value:
    "Upgrade the vulnerable CGSL systemd packages. Note that updated packages may not be available yet. Please contact ZTE
    for more information.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-15686");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/10/26");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/10/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/10/15");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"NewStart CGSL Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/ZTE-CGSL/release", "Host/ZTE-CGSL/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/ZTE-CGSL/release");
    if (isnull(release) || release !~ "^CGSL (MAIN|CORE)") audit(AUDIT_OS_NOT, "NewStart Carrier Grade Server Linux");
    
    if (release !~ "CGSL CORE 5.04" &&
        release !~ "CGSL MAIN 5.04")
      audit(AUDIT_OS_NOT, 'NewStart CGSL CORE 5.04 / NewStart CGSL MAIN 5.04');
    
    if (!get_kb_item("Host/ZTE-CGSL/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "NewStart Carrier Grade Server Linux", cpu);
    
    flag = 0;
    
    pkgs = {
      "CGSL CORE 5.04": [
        "libgudev1-219-67.el7.cgslv5.0.14.g2212dcb.lite",
        "libgudev1-devel-219-67.el7.cgslv5.0.14.g2212dcb.lite",
        "systemd-219-67.el7.cgslv5.0.14.g2212dcb.lite",
        "systemd-debuginfo-219-67.el7.cgslv5.0.14.g2212dcb.lite",
        "systemd-devel-219-67.el7.cgslv5.0.14.g2212dcb.lite",
        "systemd-journal-gateway-219-67.el7.cgslv5.0.14.g2212dcb.lite",
        "systemd-libs-219-67.el7.cgslv5.0.14.g2212dcb.lite",
        "systemd-networkd-219-67.el7.cgslv5.0.14.g2212dcb.lite",
        "systemd-python-219-67.el7.cgslv5.0.14.g2212dcb.lite",
        "systemd-resolved-219-67.el7.cgslv5.0.14.g2212dcb.lite",
        "systemd-sysv-219-67.el7.cgslv5.0.14.g2212dcb.lite"
      ],
      "CGSL MAIN 5.04": [
        "libgudev1-219-67.el7.cgslv5.0.10.gf4ec716",
        "libgudev1-devel-219-67.el7.cgslv5.0.10.gf4ec716",
        "systemd-219-67.el7.cgslv5.0.10.gf4ec716",
        "systemd-debuginfo-219-67.el7.cgslv5.0.10.gf4ec716",
        "systemd-devel-219-67.el7.cgslv5.0.10.gf4ec716",
        "systemd-journal-gateway-219-67.el7.cgslv5.0.10.gf4ec716",
        "systemd-libs-219-67.el7.cgslv5.0.10.gf4ec716",
        "systemd-networkd-219-67.el7.cgslv5.0.10.gf4ec716",
        "systemd-python-219-67.el7.cgslv5.0.10.gf4ec716",
        "systemd-resolved-219-67.el7.cgslv5.0.10.gf4ec716",
        "systemd-sysv-219-67.el7.cgslv5.0.10.gf4ec716"
      ]
    };
    pkg_list = pkgs[release];
    
    foreach (pkg in pkg_list)
      if (rpm_check(release:"ZTE " + release, reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "systemd");
    }
    
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2019-2091.NASL
    descriptionAn update for systemd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit. Security Fix(es) : * systemd: line splitting via fgets() allows for state injection during daemon-reexec (CVE-2018-15686) * systemd: out-of-bounds read when parsing a crafted syslog message (CVE-2018-16866) * systemd: kills privileged process if unprivileged PIDFile was tampered (CVE-2018-16888) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id128350
    published2019-08-30
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128350
    titleCentOS 7 : systemd (CESA-2019:2091)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2019:2091 and 
    # CentOS Errata and Security Advisory 2019:2091 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(128350);
      script_version("1.4");
      script_cvs_date("Date: 2019/12/31");
    
      script_cve_id("CVE-2018-15686", "CVE-2018-16866", "CVE-2018-16888");
      script_xref(name:"RHSA", value:"2019:2091");
    
      script_name(english:"CentOS 7 : systemd (CESA-2019:2091)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote CentOS host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An update for systemd is now available for Red Hat Enterprise Linux 7.
    
    Red Hat Product Security has rated this update as having a security
    impact of Moderate. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    The systemd packages contain systemd, a system and service manager for
    Linux, compatible with the SysV and LSB init scripts. It provides
    aggressive parallelism capabilities, uses socket and D-Bus activation
    for starting services, offers on-demand starting of daemons, and keeps
    track of processes using Linux cgroups. In addition, it supports
    snapshotting and restoring of the system state, maintains mount and
    automount points, and implements an elaborate transactional
    dependency-based service control logic. It can also work as a drop-in
    replacement for sysvinit.
    
    Security Fix(es) :
    
    * systemd: line splitting via fgets() allows for state injection
    during daemon-reexec (CVE-2018-15686)
    
    * systemd: out-of-bounds read when parsing a crafted syslog message
    (CVE-2018-16866)
    
    * systemd: kills privileged process if unprivileged PIDFile was
    tampered (CVE-2018-16888)
    
    For more details about the security issue(s), including the impact, a
    CVSS score, acknowledgments, and other related information, refer to
    the CVE page(s) listed in the References section.
    
    Additional Changes :
    
    For detailed information on changes in this release, see the Red Hat
    Enterprise Linux 7.7 Release Notes linked from the References section."
      );
      # https://lists.centos.org/pipermail/centos-cr-announce/2019-August/006149.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?95148342"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected systemd packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-15686");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libgudev1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libgudev1-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:systemd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:systemd-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:systemd-journal-gateway");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:systemd-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:systemd-networkd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:systemd-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:systemd-resolved");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:systemd-sysv");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:7");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/10/26");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/08/29");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/08/30");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"CentOS Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/CentOS/release");
    if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS");
    os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS");
    os_ver = os_ver[1];
    if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 7.x", "CentOS " + os_ver);
    
    if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libgudev1-219-67.el7")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libgudev1-devel-219-67.el7")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"systemd-219-67.el7")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"systemd-devel-219-67.el7")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"systemd-journal-gateway-219-67.el7")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"systemd-libs-219-67.el7")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"systemd-networkd-219-67.el7")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"systemd-python-219-67.el7")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"systemd-resolved-219-67.el7")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"systemd-sysv-219-67.el7")) flag++;
    
    
    if (flag)
    {
      cr_plugin_caveat = '\n' +
        'NOTE: The security advisory associated with this vulnerability has a\n' +
        'fixed package version that may only be available in the continuous\n' +
        'release (CR) repository for CentOS, until it is present in the next\n' +
        'point release of CentOS.\n\n' +
    
        'If an equal or higher package level does not exist in the baseline\n' +
        'repository for your major version of CentOS, then updates from the CR\n' +
        'repository will need to be applied in order to address the\n' +
        'vulnerability.\n';
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get() + cr_plugin_caveat
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libgudev1 / libgudev1-devel / systemd / systemd-devel / etc");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-0137-1.NASL
    descriptionThis update for systemd provides the following fixes : Security issues fixed : CVE-2018-16864, CVE-2018-16865: Fixed two memory corruptions through attacker-controlled alloca()s (bsc#1120323) CVE-2018-16866: Fixed an information leak in journald (bsc#1120323) CVE-2018-6954: Fix mishandling of symlinks present in non-terminal path components (bsc#1080919) Fixed an issue during system startup in relation to encrypted swap disks (bsc#1119971) Non-security issues fixed: pam_systemd: Fix
    last seen2020-06-01
    modified2020-06-02
    plugin id121304
    published2019-01-22
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121304
    titleSUSE SLED15 / SLES15 Security Update : systemd (SUSE-SU-2019:0137-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from SUSE update advisory SUSE-SU-2019:0137-1.
    # The text itself is copyright (C) SUSE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(121304);
      script_version("1.3");
      script_cvs_date("Date: 2019/09/10 13:51:50");
    
      script_cve_id("CVE-2018-16864", "CVE-2018-16865", "CVE-2018-16866", "CVE-2018-6954");
    
      script_name(english:"SUSE SLED15 / SLES15 Security Update : systemd (SUSE-SU-2019:0137-1)");
      script_summary(english:"Checks rpm output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SUSE host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update for systemd provides the following fixes :
    
    Security issues fixed :
    
    CVE-2018-16864, CVE-2018-16865: Fixed two memory corruptions through
    attacker-controlled alloca()s (bsc#1120323)
    
    CVE-2018-16866: Fixed an information leak in journald (bsc#1120323)
    
    CVE-2018-6954: Fix mishandling of symlinks present in non-terminal
    path components (bsc#1080919)
    
    Fixed an issue during system startup in relation to encrypted swap
    disks (bsc#1119971)
    
    Non-security issues fixed: pam_systemd: Fix 'Cannot create session:
    Already running in a session' (bsc#1111498)
    
    systemd-vconsole-setup: vconsole setup fails, fonts will not be copied
    to tty (bsc#1114933)
    
    systemd-tmpfiles-setup: symlinked /tmp to /var/tmp breaking multiple
    units (bsc#1045723)
    
    Fixed installation issue with /etc/machine-id during update
    (bsc#1117063)
    
    btrfs: qgroups are assigned to parent qgroups after reboot
    (bsc#1093753)
    
    logind: Stop managing VT switches if no sessions are registered on
    that VT. (bsc#1101591)
    
    udev: Downgrade message when settting inotify watch up fails.
    (bsc#1005023)
    
    udev: Ignore the exit code of systemd-detect-virt for memory hot-add.
    In SLE-12-SP3, 80-hotplug-cpu-mem.rules has a memory hot-add rule that
    uses systemd-detect-virt to detect non-zvm environment. The
    systemd-detect-virt returns exit failure code when it detected _none_
    state. The exit failure code causes that the hot-add memory block can
    not be set to online. (bsc#1076696)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the SUSE security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1005023"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1045723"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1076696"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1080919"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1093753"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1101591"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1111498"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1114933"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1117063"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1119971"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1120323"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-16864/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-16865/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-16866/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-6954/"
      );
      # https://www.suse.com/support/update/announcement/2019/suse-su-20190137-1/
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?f97bddbc"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "To install this SUSE Security Update use the SUSE recommended
    installation methods like YaST online_update or 'zypper patch'.
    
    Alternatively you can run the command listed for your product :
    
    SUSE Linux Enterprise Module for Open Buildservice Development Tools
    15:zypper in -t patch
    SUSE-SLE-Module-Development-Tools-OBS-15-2019-137=1
    
    SUSE Linux Enterprise Module for Basesystem 15:zypper in -t patch
    SUSE-SLE-Module-Basesystem-15-2019-137=1"
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libsystemd0");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libsystemd0-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libsystemd0-32bit-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libsystemd0-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libsystemd0-mini");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libsystemd0-mini-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libudev-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libudev-mini-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libudev-mini1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libudev-mini1-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libudev1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libudev1-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libudev1-32bit-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libudev1-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:nss-myhostname");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:nss-myhostname-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:nss-mymachines");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:nss-mymachines-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:nss-systemd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:nss-systemd-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd-32bit-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd-container");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd-container-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd-coredump");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd-coredump-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd-logger");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd-mini");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd-mini-container-mini");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd-mini-container-mini-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd-mini-coredump-mini");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd-mini-coredump-mini-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd-mini-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd-mini-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd-mini-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd-mini-sysvinit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:systemd-sysvinit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:udev");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:udev-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:udev-mini");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:udev-mini-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:15");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/02/13");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/01/21");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/01/22");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
    os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(SLED15|SLES15)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED15 / SLES15", "SUSE " + os_ver);
    
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);
    
    sp = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(sp)) sp = "0";
    if (os_ver == "SLES15" && (! preg(pattern:"^(0)$", string:sp))) audit(AUDIT_OS_NOT, "SLES15 SP0", os_ver + " SP" + sp);
    if (os_ver == "SLED15" && (! preg(pattern:"^(0)$", string:sp))) audit(AUDIT_OS_NOT, "SLED15 SP0", os_ver + " SP" + sp);
    
    
    flag = 0;
    if (rpm_check(release:"SLES15", sp:"0", cpu:"x86_64", reference:"libsystemd0-32bit-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", cpu:"x86_64", reference:"libsystemd0-32bit-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", cpu:"x86_64", reference:"libudev1-32bit-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", cpu:"x86_64", reference:"libudev1-32bit-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", cpu:"x86_64", reference:"systemd-32bit-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", cpu:"x86_64", reference:"systemd-32bit-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"libsystemd0-mini-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"libsystemd0-mini-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"libudev-mini-devel-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"libudev-mini1-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"libudev-mini1-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"nss-myhostname-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"nss-myhostname-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"nss-mymachines-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"nss-mymachines-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"nss-systemd-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"nss-systemd-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"systemd-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"systemd-debugsource-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"systemd-logger-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"systemd-mini-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"systemd-mini-container-mini-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"systemd-mini-container-mini-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"systemd-mini-coredump-mini-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"systemd-mini-coredump-mini-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"systemd-mini-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"systemd-mini-debugsource-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"systemd-mini-devel-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"systemd-mini-sysvinit-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"udev-mini-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"udev-mini-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"libsystemd0-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"libsystemd0-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"libudev-devel-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"libudev1-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"libudev1-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"systemd-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"systemd-container-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"systemd-container-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"systemd-coredump-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"systemd-coredump-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"systemd-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"systemd-debugsource-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"systemd-devel-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"systemd-sysvinit-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"udev-234-24.20.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"udev-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", cpu:"x86_64", reference:"libsystemd0-32bit-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", cpu:"x86_64", reference:"libsystemd0-32bit-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", cpu:"x86_64", reference:"libudev1-32bit-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", cpu:"x86_64", reference:"libudev1-32bit-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", cpu:"x86_64", reference:"systemd-32bit-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", cpu:"x86_64", reference:"systemd-32bit-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"libsystemd0-mini-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"libsystemd0-mini-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"libudev-mini-devel-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"libudev-mini1-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"libudev-mini1-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"nss-myhostname-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"nss-myhostname-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"nss-mymachines-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"nss-mymachines-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"nss-systemd-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"nss-systemd-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"systemd-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"systemd-debugsource-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"systemd-logger-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"systemd-mini-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"systemd-mini-container-mini-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"systemd-mini-container-mini-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"systemd-mini-coredump-mini-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"systemd-mini-coredump-mini-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"systemd-mini-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"systemd-mini-debugsource-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"systemd-mini-devel-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"systemd-mini-sysvinit-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"udev-mini-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"udev-mini-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"libsystemd0-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"libsystemd0-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"libudev-devel-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"libudev1-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"libudev1-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"systemd-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"systemd-container-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"systemd-container-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"systemd-coredump-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"systemd-coredump-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"systemd-debuginfo-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"systemd-debugsource-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"systemd-devel-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"systemd-sysvinit-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"udev-234-24.20.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"udev-debuginfo-234-24.20.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "systemd");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-98.NASL
    descriptionThis update for systemd provides the following fixes : Security issues fixed : - CVE-2018-16864, CVE-2018-16865: Fixed two memory corruptions through attacker-controlled alloca()s (bsc#1120323) - CVE-2018-16866: Fixed an information leak in journald (bsc#1120323) - CVE-2018-6954: Fix mishandling of symlinks present in non-terminal path components (bsc#1080919) - Fixed an issue during system startup in relation to encrypted swap disks (bsc#1119971) Non-security issues fixed : - pam_systemd: Fix
    last seen2020-06-01
    modified2020-06-02
    plugin id121464
    published2019-01-30
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121464
    titleopenSUSE Security Update : systemd (openSUSE-2019-98)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2019-98.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(121464);
      script_version("1.2");
      script_cvs_date("Date: 2019/05/17  9:44:17");
    
      script_cve_id("CVE-2018-16864", "CVE-2018-16865", "CVE-2018-16866", "CVE-2018-6954");
    
      script_name(english:"openSUSE Security Update : systemd (openSUSE-2019-98)");
      script_summary(english:"Check for the openSUSE-2019-98 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update for systemd provides the following fixes :
    
    Security issues fixed :
    
      - CVE-2018-16864, CVE-2018-16865: Fixed two memory
        corruptions through attacker-controlled alloca()s
        (bsc#1120323)
    
      - CVE-2018-16866: Fixed an information leak in journald
        (bsc#1120323)
    
      - CVE-2018-6954: Fix mishandling of symlinks present in
        non-terminal path components (bsc#1080919)
    
      - Fixed an issue during system startup in relation to
        encrypted swap disks (bsc#1119971)
    
    Non-security issues fixed :
    
      - pam_systemd: Fix 'Cannot create session: Already running
        in a session' (bsc#1111498)
    
      - systemd-vconsole-setup: vconsole setup fails, fonts will
        not be copied to tty (bsc#1114933)
    
      - systemd-tmpfiles-setup: symlinked /tmp to /var/tmp
        breaking multiple units (bsc#1045723)
    
      - Fixed installation issue with /etc/machine-id during
        update (bsc#1117063)
    
      - btrfs: qgroups are assigned to parent qgroups after
        reboot (bsc#1093753)
    
      - logind: Stop managing VT switches if no sessions are
        registered on that VT. (bsc#1101591)
    
      - udev: Downgrade message when settting inotify watch up
        fails. (bsc#1005023)
    
      - udev: Ignore the exit code of systemd-detect-virt for
        memory hot-add. In SLE-12-SP3, 80-hotplug-cpu-mem.rules
        has a memory hot-add rule that uses systemd-detect-virt
        to detect non-zvm environment. The systemd-detect-virt
        returns exit failure code when it detected _none_ state.
        The exit failure code causes that the hot-add memory
        block can not be set to online. (bsc#1076696) This
        update was imported from the SUSE:SLE-15:Update update
        project."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1005023"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1045723"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1076696"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1080919"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1093753"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1101591"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1111498"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1114933"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1117063"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1119971"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1120323"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected systemd packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libsystemd0");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libsystemd0-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libsystemd0-32bit-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libsystemd0-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libsystemd0-mini");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libsystemd0-mini-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libudev-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libudev-devel-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libudev-mini-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libudev-mini1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libudev-mini1-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libudev1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libudev1-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libudev1-32bit-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libudev1-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:nss-myhostname");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:nss-myhostname-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:nss-myhostname-32bit-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:nss-myhostname-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:nss-mymachines");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:nss-mymachines-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:nss-mymachines-32bit-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:nss-mymachines-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:nss-systemd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:nss-systemd-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:systemd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:systemd-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:systemd-32bit-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:systemd-bash-completion");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:systemd-container");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:systemd-container-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:systemd-coredump");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:systemd-coredump-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:systemd-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:systemd-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:systemd-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:systemd-logger");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:systemd-mini");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:systemd-mini-bash-completion");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:systemd-mini-container-mini");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:systemd-mini-container-mini-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:systemd-mini-coredump-mini");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:systemd-mini-coredump-mini-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:systemd-mini-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:systemd-mini-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:systemd-mini-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:systemd-mini-sysvinit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:systemd-sysvinit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:udev");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:udev-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:udev-mini");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:udev-mini-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:15.0");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/02/13");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/03/23");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/01/30");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE15\.0)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "15.0", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE15.0", reference:"libsystemd0-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libsystemd0-debuginfo-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libsystemd0-mini-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libsystemd0-mini-debuginfo-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libudev-devel-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libudev-mini-devel-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libudev-mini1-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libudev-mini1-debuginfo-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libudev1-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libudev1-debuginfo-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"nss-myhostname-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"nss-myhostname-debuginfo-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"nss-mymachines-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"nss-mymachines-debuginfo-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"nss-systemd-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"nss-systemd-debuginfo-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"systemd-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"systemd-bash-completion-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"systemd-container-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"systemd-container-debuginfo-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"systemd-coredump-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"systemd-coredump-debuginfo-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"systemd-debuginfo-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"systemd-debugsource-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"systemd-devel-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"systemd-logger-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"systemd-mini-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"systemd-mini-bash-completion-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"systemd-mini-container-mini-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"systemd-mini-container-mini-debuginfo-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"systemd-mini-coredump-mini-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"systemd-mini-coredump-mini-debuginfo-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"systemd-mini-debuginfo-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"systemd-mini-debugsource-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"systemd-mini-devel-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"systemd-mini-sysvinit-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"systemd-sysvinit-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"udev-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"udev-debuginfo-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"udev-mini-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"udev-mini-debuginfo-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"libsystemd0-32bit-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"libsystemd0-32bit-debuginfo-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"libudev-devel-32bit-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"libudev1-32bit-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"libudev1-32bit-debuginfo-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"nss-myhostname-32bit-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"nss-myhostname-32bit-debuginfo-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"nss-mymachines-32bit-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"nss-mymachines-32bit-debuginfo-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"systemd-32bit-234-lp150.20.12.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"systemd-32bit-debuginfo-234-lp150.20.12.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libsystemd0-mini / libsystemd0-mini-debuginfo / libudev-mini-devel / etc");
    }
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2232.NASL
    descriptionAccording to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable.(CVE-2018-16888) - A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239.(CVE-2018-15686) - An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon
    last seen2020-05-08
    modified2019-11-08
    plugin id130694
    published2019-11-08
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130694
    titleEulerOS 2.0 SP5 : systemd (EulerOS-SA-2019-2232)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(130694);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/07");
    
      script_cve_id(
        "CVE-2018-15686",
        "CVE-2018-16866",
        "CVE-2018-16888"
      );
    
      script_name(english:"EulerOS 2.0 SP5 : systemd (EulerOS-SA-2019-2232)");
      script_summary(english:"Checks the rpm output for the updated packages.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote EulerOS host is missing multiple security updates.");
      script_set_attribute(attribute:"description", value:
    "According to the versions of the systemd packages installed, the
    EulerOS installation on the remote host is affected by the following
    vulnerabilities :
    
      - It was discovered systemd does not correctly check the
        content of PIDFile files before using it to kill
        processes. When a service is run from an unprivileged
        user (e.g. User field set in the service file), a local
        attacker who is able to write to the PIDFile of the
        mentioned service may use this flaw to trick systemd
        into killing other services and/or privileged
        processes. Versions before v237 are
        vulnerable.(CVE-2018-16888)
    
      - A vulnerability in unit_deserialize of systemd allows
        an attacker to supply arbitrary state across systemd
        re-execution via NotifyAccess. This can be used to
        improperly influence systemd execution and possibly
        lead to root privilege escalation. Affected releases
        are systemd versions up to and including
        239.(CVE-2018-15686)
    
      - An out of bounds read was discovered in
        systemd-journald in the way it parses log messages that
        terminate with a colon ':'. A local attacker can use
        this flaw to disclose process memory data. Versions
        from v221 to v239 are vulnerable.(CVE-2018-16866)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the EulerOS security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues.");
      # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-2232
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e74c558d");
      script_set_attribute(attribute:"solution", value:
    "Update the affected systemd packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2019/10/29");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/11/08");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libgudev1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libgudev1-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:systemd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:systemd-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:systemd-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:systemd-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:systemd-sysv");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:systemd-udev-compat");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Huawei Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
      script_exclude_keys("Host/EulerOS/uvp_version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/EulerOS/release");
    if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
    if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");
    
    sp = get_kb_item("Host/EulerOS/sp");
    if (isnull(sp) || sp !~ "^(5)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP5");
    
    uvp = get_kb_item("Host/EulerOS/uvp_version");
    if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP5", "EulerOS UVP " + uvp);
    
    if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);
    
    flag = 0;
    
    pkgs = ["libgudev1-219-62.5.h109.eulerosv2r7",
            "libgudev1-devel-219-62.5.h109.eulerosv2r7",
            "systemd-219-62.5.h109.eulerosv2r7",
            "systemd-devel-219-62.5.h109.eulerosv2r7",
            "systemd-libs-219-62.5.h109.eulerosv2r7",
            "systemd-python-219-62.5.h109.eulerosv2r7",
            "systemd-sysv-219-62.5.h109.eulerosv2r7",
            "systemd-udev-compat-219-62.5.h109.eulerosv2r7"];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"EulerOS-2.0", sp:"5", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "systemd");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-1264.NASL
    descriptionThe remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1264 advisory. - systemd: line splitting via fgets() allows for state injection during daemon-reexec (CVE-2018-15686) - systemd: out-of-bounds read when parsing a crafted syslog message (CVE-2018-16866) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-04-23
    modified2020-04-01
    plugin id135087
    published2020-04-01
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135087
    titleRHEL 7 : systemd (RHSA-2020:1264)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    # The descriptive text and package checks in this plugin were
    # extracted from Red Hat Security Advisory RHSA-2020:1264. The text
    # itself is copyright (C) Red Hat, Inc.
    #
    
    
    include('compat.inc');
    
    if (description)
    {
      script_id(135087);
      script_version("1.2");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/21");
    
      script_cve_id("CVE-2018-15686", "CVE-2018-16866");
      script_bugtraq_id(105747, 106527);
      script_xref(name:"RHSA", value:"2020:1264");
    
      script_name(english:"RHEL 7 : systemd (RHSA-2020:1264)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Red Hat host is missing one or more security updates.");
      script_set_attribute(attribute:"description", value:
    "The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as
    referenced in the RHSA-2020:1264 advisory.
    
      - systemd: line splitting via fgets() allows for state
        injection during daemon-reexec (CVE-2018-15686)
    
      - systemd: out-of-bounds read when parsing a crafted
        syslog message (CVE-2018-16866)
    
    Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
    number.");
      script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/20.html");
      script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/125.html");
      script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/200.html");
      script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2020:1264");
      script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2018-15686");
      script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2018-16866");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/1798160");
      script_set_attribute(attribute:"solution", value:
    "Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-15686");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_cwe_id(20, 125, 200);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/10/26");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/04/01");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/04/01");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.5");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:rhel_eus:7.5");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:rhel_eus:7.5::computenode");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:rhel_eus:7.5::server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libgudev1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libgudev1-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:systemd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:systemd-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:systemd-journal-gateway");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:systemd-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:systemd-networkd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:systemd-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:systemd-resolved");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:systemd-sysv");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Red Hat Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include('audit.inc');
    include('global_settings.inc');
    include('misc_func.inc');
    include('rpm.inc');
    
    if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item('Host/RedHat/release');
    if (isnull(release) || 'Red Hat' >!< release) audit(AUDIT_OS_NOT, 'Red Hat');
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');
    os_ver = os_ver[1];
    if (! preg(pattern:"^7\.5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, 'Red Hat 7.5', 'Red Hat ' + os_ver);
    
    if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item('Host/cpu');
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);
    
    pkgs = [
        {'reference':'libgudev1-219-57.el7_5.9', 'sp':'5', 'cpu':'i686', 'release':'7'},
        {'reference':'libgudev1-219-57.el7_5.9', 'sp':'5', 'cpu':'s390', 'release':'7'},
        {'reference':'libgudev1-219-57.el7_5.9', 'sp':'5', 'cpu':'s390x', 'release':'7'},
        {'reference':'libgudev1-219-57.el7_5.9', 'sp':'5', 'cpu':'x86_64', 'release':'7'},
        {'reference':'libgudev1-devel-219-57.el7_5.9', 'sp':'5', 'cpu':'i686', 'release':'7'},
        {'reference':'libgudev1-devel-219-57.el7_5.9', 'sp':'5', 'cpu':'s390', 'release':'7'},
        {'reference':'libgudev1-devel-219-57.el7_5.9', 'sp':'5', 'cpu':'s390x', 'release':'7'},
        {'reference':'libgudev1-devel-219-57.el7_5.9', 'sp':'5', 'cpu':'x86_64', 'release':'7'},
        {'reference':'systemd-devel-219-57.el7_5.9', 'sp':'5', 'cpu':'i686', 'release':'7'},
        {'reference':'systemd-devel-219-57.el7_5.9', 'sp':'5', 'cpu':'s390', 'release':'7'},
        {'reference':'systemd-devel-219-57.el7_5.9', 'sp':'5', 'cpu':'s390x', 'release':'7'},
        {'reference':'systemd-devel-219-57.el7_5.9', 'sp':'5', 'cpu':'x86_64', 'release':'7'},
        {'reference':'systemd-libs-219-57.el7_5.9', 'sp':'5', 'cpu':'i686', 'release':'7'},
        {'reference':'systemd-libs-219-57.el7_5.9', 'sp':'5', 'cpu':'s390', 'release':'7'},
        {'reference':'systemd-libs-219-57.el7_5.9', 'sp':'5', 'cpu':'s390x', 'release':'7'},
        {'reference':'systemd-libs-219-57.el7_5.9', 'sp':'5', 'cpu':'x86_64', 'release':'7'},
        {'reference':'systemd-resolved-219-57.el7_5.9', 'sp':'5', 'cpu':'i686', 'release':'7'},
        {'reference':'systemd-resolved-219-57.el7_5.9', 'sp':'5', 'cpu':'s390', 'release':'7'},
        {'reference':'systemd-resolved-219-57.el7_5.9', 'sp':'5', 'cpu':'s390x', 'release':'7'},
        {'reference':'systemd-resolved-219-57.el7_5.9', 'sp':'5', 'cpu':'x86_64', 'release':'7'}
    ];
    
    flag = 0;
    foreach package_array ( pkgs ) {
      reference = NULL;
      release = NULL;
      sp = NULL;
      cpu = NULL;
      el_string = NULL;
      rpm_spec_vers_cmp = NULL;
      epoch = NULL;
      if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
      if (!empty_or_null(package_array['release'])) release = 'RHEL' + package_array['release'];
      if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
      if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];
      if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
      if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
      if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
      if (reference && release) {
        if (rpm_spec_vers_cmp) {
          if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:TRUE)) flag++;
        }
        else
        {
          if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch)) flag++;
        }
      }
    }
    
    if (flag)
    {
      security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libgudev1 / libgudev1-devel / systemd-devel / etc');
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2019-2091.NASL
    descriptionAn update for systemd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit. Security Fix(es) : * systemd: line splitting via fgets() allows for state injection during daemon-reexec (CVE-2018-15686) * systemd: out-of-bounds read when parsing a crafted syslog message (CVE-2018-16866) * systemd: kills privileged process if unprivileged PIDFile was tampered (CVE-2018-16888) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id127669
    published2019-08-12
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127669
    titleRHEL 7 : systemd (RHSA-2019:2091)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1998.NASL
    descriptionAccording to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It has been discovered that systemd-tmpfiles mishandles symbolic links present in non-terminal path components. In some configurations a local user could use this vulnerability to get access to arbitrary files when the systemd-tmpfiles command is run.(CVE-2018-6954) - An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon
    last seen2020-05-08
    modified2019-09-24
    plugin id129191
    published2019-09-24
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129191
    titleEulerOS 2.0 SP3 : systemd (EulerOS-SA-2019-1998)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2020-1451.NASL
    descriptionAccording to the versions of the systemd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable.(CVE-2018-16888) - An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon
    last seen2020-04-30
    modified2020-04-16
    plugin id135613
    published2020-04-16
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135613
    titleEulerOS Virtualization 3.0.2.2 : systemd (EulerOS-SA-2020-1451)
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0242_SYSTEMD.NASL
    descriptionThe remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has systemd packages installed that are affected by multiple vulnerabilities: - A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re- execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239. (CVE-2018-15686) - It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable. (CVE-2018-16888) - An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon
    last seen2020-06-01
    modified2020-06-02
    plugin id132460
    published2019-12-31
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132460
    titleNewStart CGSL CORE 5.05 / MAIN 5.05 : systemd Multiple Vulnerabilities (NS-SA-2019-0242)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-0593.NASL
    descriptionAn update for systemd is now available for Red Hat Enterprise Linux 7.4 Advanced Update Support, Red Hat Enterprise Linux 7.4 Telco Extended Update Support, and Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit. Security Fix(es) : * systemd: line splitting via fgets() allows for state injection during daemon-reexec (CVE-2018-15686) * systemd: out-of-bounds read when parsing a crafted syslog message (CVE-2018-16866) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-03-18
    modified2020-02-26
    plugin id134065
    published2020-02-26
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134065
    titleRHEL 7 : systemd (RHSA-2020:0593)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-97.NASL
    descriptionThis update for systemd provides the following fixes : Security issues fixed : - CVE-2018-16864, CVE-2018-16865: Fixed two memory corruptions through attacker-controlled alloca()s (bsc#1120323) - CVE-2018-16866: Fixed an information leak in journald (bsc#1120323) - Fixed an issue during system startup in relation to encrypted swap disks (bsc#1119971) Non-security issues fixed : - core: Queue loading transient units after setting their properties. (bsc#1115518) - logind: Stop managing VT switches if no sessions are registered on that VT. (bsc#1101591) - terminal-util: introduce vt_release() and vt_restore() helpers. - terminal: Unify code for resetting kbd utf8 mode a bit. - terminal Reset should honour default_utf8 kernel setting. - logind: Make session_restore_vt() static. - udev: Downgrade message when settting inotify watch up fails. (bsc#1005023) - log: Never log into foreign fd #2 in PID 1 or its pre-execve() children. (bsc#1114981) - udev: Ignore the exit code of systemd-detect-virt for memory hot-add. In SLE-12-SP3, 80-hotplug-cpu-mem.rules has a memory hot-add rule that uses systemd-detect-virt to detect non-zvm environment. The systemd-detect-virt returns exit failure code when it detected _none_ state. The exit failure code causes that the hot-add memory block can not be set to online. (bsc#1076696) This update was imported from the SUSE:SLE-12-SP2:Update update project.
    last seen2020-06-01
    modified2020-06-02
    plugin id121463
    published2019-01-30
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121463
    titleopenSUSE Security Update : systemd (openSUSE-2019-97)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2020-1216.NASL
    descriptionAccording to the versions of the systemd packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable.(CVE-2018-16888) - An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon
    last seen2020-03-19
    modified2020-03-13
    plugin id134505
    published2020-03-13
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134505
    titleEulerOS Virtualization for ARM 64 3.0.2.0 : systemd (EulerOS-SA-2020-1216)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1748.NASL
    descriptionAccording to the version of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon
    last seen2020-05-06
    modified2019-07-22
    plugin id126875
    published2019-07-22
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126875
    titleEulerOS 2.0 SP2 : systemd (EulerOS-SA-2019-1748)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20190806_SYSTEMD_ON_SL7_X.NASL
    descriptionSecurity Fix(es) : - systemd: line splitting via fgets() allows for state injection during daemon-reexec (CVE-2018-15686) - systemd: out-of-bounds read when parsing a crafted syslog message (CVE-2018-16866) - systemd: kills privileged process if unprivileged PIDFile was tampered (CVE-2018-16888)
    last seen2020-03-18
    modified2019-08-27
    plugin id128265
    published2019-08-27
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128265
    titleScientific Linux Security Update : systemd on SL7.x x86_64 (20190806)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201903-07.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201903-07 (systemd: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in systemd. Please review the CVE identifiers referenced below for details. Impact : An attacker could cause a Denial of Service condition or possibly execute arbitrary code. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id122735
    published2019-03-11
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/122735
    titleGLSA-201903-07 : systemd: Multiple vulnerabilities
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3855-1.NASL
    descriptionIt was discovered that systemd-journald allocated variable-length buffers for certain message fields on the stack. A local attacker could potentially exploit this to cause a denial of service, or execute arbitrary code. (CVE-2018-16864) It was discovered that systemd-journald allocated variable-length arrays of objects representing message fields on the stack. A local attacker could potentially exploit this to cause a denial of service, or execute arbitrary code. (CVE-2018-16865) An out-of-bounds read was discovered in systemd-journald. A local attacker could potentially exploit this to obtain sensitive information and bypass ASLR protections. (CVE-2018-16866). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id121161
    published2019-01-14
    reporterUbuntu Security Notice (C) 2019 Canonical, Inc. / NASL script (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121161
    titleUbuntu 16.04 LTS / 18.04 LTS / 18.10 : systemd vulnerabilities (USN-3855-1)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-18B3A10C7F.NASL
    description - systemd-journald and systemd-journal-remote reject entries which contain too many fields (CVE-2018-16865, #1664973) and set limits on the process
    last seen2020-06-01
    modified2020-06-02
    plugin id121138
    published2019-01-14
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121138
    titleFedora 29 : systemd (2019-18b3a10c7f)
  • NASL familyAmazon Linux Local Security Checks
    NASL idAL2_ALAS-2019-1141.NASL
    descriptionLarge syslogd messages sent to journald can cause stack corruption, causing journald to crash. The version of systemd on Amazon Linux 2 is not vulnerable to privilege escalation in this case. (CVE-2018-16864) Large native messages to journald can cause stack corruption, leading to possible local privilege escalation.(CVE-2018-16865) Please note, if you have systemd-journald-remote configured over http, then you could be open to remote escalation on previous versions of the systemd package. The systemd-journald-remote service is not installed by default on Amazon Linux 2, and when installed and enabled, the default configuration is to use https. (CVE-2018-16865) An out-of-bounds read in journald, triggered by a specially crafted message, can be used to leak information through the journal file (CVE-2018-16866)
    last seen2020-06-01
    modified2020-06-02
    plugin id121050
    published2019-01-10
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121050
    titleAmazon Linux 2 : systemd (ALAS-2019-1141)

Redhat

advisories
  • rhsa
    idRHSA-2019:2091
  • rhsa
    idRHSA-2019:3222
  • rhsa
    idRHSA-2020:0593
rpms
  • libgudev1-0:219-67.el7
  • libgudev1-devel-0:219-67.el7
  • systemd-0:219-67.el7
  • systemd-debuginfo-0:219-67.el7
  • systemd-devel-0:219-67.el7
  • systemd-journal-gateway-0:219-67.el7
  • systemd-libs-0:219-67.el7
  • systemd-networkd-0:219-67.el7
  • systemd-python-0:219-67.el7
  • systemd-resolved-0:219-67.el7
  • systemd-sysv-0:219-67.el7
  • libgudev1-0:219-62.el7_6.11
  • libgudev1-devel-0:219-62.el7_6.11
  • systemd-0:219-62.el7_6.11
  • systemd-debuginfo-0:219-62.el7_6.11
  • systemd-devel-0:219-62.el7_6.11
  • systemd-journal-gateway-0:219-62.el7_6.11
  • systemd-libs-0:219-62.el7_6.11
  • systemd-networkd-0:219-62.el7_6.11
  • systemd-python-0:219-62.el7_6.11
  • systemd-resolved-0:219-62.el7_6.11
  • systemd-sysv-0:219-62.el7_6.11
  • libgudev1-0:219-42.el7_4.20
  • libgudev1-devel-0:219-42.el7_4.20
  • systemd-0:219-42.el7_4.20
  • systemd-debuginfo-0:219-42.el7_4.20
  • systemd-devel-0:219-42.el7_4.20
  • systemd-journal-gateway-0:219-42.el7_4.20
  • systemd-libs-0:219-42.el7_4.20
  • systemd-networkd-0:219-42.el7_4.20
  • systemd-python-0:219-42.el7_4.20
  • systemd-resolved-0:219-42.el7_4.20
  • systemd-sysv-0:219-42.el7_4.20
  • libgudev1-0:219-57.el7_5.9
  • libgudev1-devel-0:219-57.el7_5.9
  • systemd-0:219-57.el7_5.9
  • systemd-debuginfo-0:219-57.el7_5.9
  • systemd-devel-0:219-57.el7_5.9
  • systemd-journal-gateway-0:219-57.el7_5.9
  • systemd-libs-0:219-57.el7_5.9
  • systemd-networkd-0:219-57.el7_5.9
  • systemd-python-0:219-57.el7_5.9
  • systemd-resolved-0:219-57.el7_5.9
  • systemd-sysv-0:219-57.el7_5.9

The Hacker News

idTHN:68B5B8B7434409E6670CCBAC8FDD8ABE
last seen2019-01-10
modified2019-01-10
published2019-01-10
reporterThe Hacker News
sourcehttps://thehackernews.com/2019/01/linux-systemd-exploit.html
titleNew Systemd Privilege Escalation Flaws Affect Most Linux Distributions