RHEL 7 : Red Hat Gluster Storage (RHSA-2018:2607)

high Nessus Plugin ID 117317

Language:

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2607 advisory.

- glusterfs: Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code (CVE-2018-10904)

- glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows remote attackers to execute arbitrary code (CVE-2018-10907)

- glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory (CVE-2018-10911)

- glusterfs: Information Exposure in posix_get_file_contents function in posix-helpers.c (CVE-2018-10913)

- glusterfs: remote denial of service of gluster volumes via posix_get_file_contents function in posix- helpers.c (CVE-2018-10914)

- glusterfs: I/O to arbitrary devices on storage server (CVE-2018-10923)

- glusterfs: Device files can be created in arbitrary locations (CVE-2018-10926)

- glusterfs: File status information leak and denial of service (CVE-2018-10927)

- glusterfs: Improper resolution of symlinks allows for privilege escalation (CVE-2018-10928)

- glusterfs: Arbitrary file creation on storage server allows for execution of arbitrary code (CVE-2018-10929)

- glusterfs: Files can be renamed outside volume (CVE-2018-10930)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 117317

File Name: redhat-RHSA-2018-2607.nasl

Version: 1.7

Type: local

Agent: unix

Family: Red Hat Local Security Checks

Published: 9/6/2018

Updated: 4/27/2024

Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS Score Source: CVE-2018-10929

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:glusterfs, p-cpe:/a:redhat:enterprise_linux:glusterfs-api, p-cpe:/a:redhat:enterprise_linux:glusterfs-api-devel, p-cpe:/a:redhat:enterprise_linux:glusterfs-cli, p-cpe:/a:redhat:enterprise_linux:glusterfs-client-xlators, p-cpe:/a:redhat:enterprise_linux:glusterfs-devel, p-cpe:/a:redhat:enterprise_linux:glusterfs-events, p-cpe:/a:redhat:enterprise_linux:glusterfs-fuse, p-cpe:/a:redhat:enterprise_linux:glusterfs-ganesha, p-cpe:/a:redhat:enterprise_linux:glusterfs-geo-replication, p-cpe:/a:redhat:enterprise_linux:glusterfs-libs, p-cpe:/a:redhat:enterprise_linux:glusterfs-rdma, p-cpe:/a:redhat:enterprise_linux:glusterfs-resource-agents, p-cpe:/a:redhat:enterprise_linux:glusterfs-server, p-cpe:/a:redhat:enterprise_linux:python2-gluster, p-cpe:/a:redhat:enterprise_linux:redhat-release-server, p-cpe:/a:redhat:enterprise_linux:redhat-storage-server, cpe:/o:redhat:enterprise_linux:7

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Patch Publication Date: 1/7/2019

Vulnerability Publication Date: 9/4/2018

Reference Information

CVE: CVE-2018-10904, CVE-2018-10907, CVE-2018-10911, CVE-2018-10913, CVE-2018-10914, CVE-2018-10923, CVE-2018-10926, CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930

CWE: 121, 20, 200, 209, 426, 476, 59

RHSA: 2018:2607

Detections

Analytics