Detections
Analytics

RHEL 6 : sudo (Unpatched Vulnerability)

high Nessus Plugin ID 195500

Synopsis

The remote Red Hat 6 host is affected by multiple vulnerabilities that will not be patched.

Description

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

 - sudo: by using ! character in the shadow file instead of a password hash can access to a run as all sudoer account (CVE-2019-19234)

 - sudo: symbolic link attack in SELinux-enabled sudoedit (CVE-2021-23240)

 - sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other Linux implementations preserves the value of INPUTRC which could lead to information disclosure. A local user with sudo access to a restricted program that uses readline could use this flaw to read content from specially formatted files with elevated privileges provided by sudo. (CVE-2016-7091)

 - In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user. NOTE: The software maintainer believes that this is not a vulnerability because running a command via sudo as a user not present in the local password database is an intentional feature. Because this behavior surprised some users, sudo 1.8.30 introduced an option to enable/disable this behavior with the default being disabled.
 However, this does not change the fact that sudo was behaving as intended, and as documented, in earlier versions (CVE-2019-19232)

 - The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path. (CVE-2021-23239)

 - Sudo before 1.9.13 does not escape control characters in log messages. (CVE-2023-28486)

 - Sudo before 1.9.13 does not escape control characters in sudoreplay output. (CVE-2023-28487)

 - Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (instead of equaling a success value), and because the values do not resist flips of a single bit. (CVE-2023-42465)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Solution

The vendor has acknowledged the vulnerabilities but no solution has been provided. Refer to the vendor for remediation guidance.

Plugin Details

Severity: High

ID: 195500

File Name: redhat_unpatched-sudo-rhel6.nasl

Version: 1.0

Type: local

Agent: unix

Published: 5/11/2024

Updated: 5/11/2024

Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2019-19234

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2021-23240

Vulnerability Information

CPE: cpe:/o:redhat:enterprise_linux:5, cpe:/o:redhat:enterprise_linux:7, p-cpe:/a:redhat:enterprise_linux:sudo, cpe:/o:redhat:enterprise_linux:6, p-cpe:/a:redhat:enterprise_linux:readline, p-cpe:/a:redhat:enterprise_linux:compat-readline5, p-cpe:/a:redhat:enterprise_linux:compat-readline43

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 8/24/2016

Reference Information

CVE: CVE-2016-7091, CVE-2019-19232, CVE-2019-19234, CVE-2021-23239, CVE-2021-23240, CVE-2023-28486, CVE-2023-28487, CVE-2023-42465

IAVA: 2021-A-0053