Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8153-1 advisory.

    Zach Malone discovered that Salt did not properly handle permissions to cache data. A local attacker could     possibly use this issue to obtain sensitive information. (CVE-2015-8034) Dylan Frese discovered that Salt     incorrectly allowed users to specify PAM service. An attacker could possibly use this issue to bypass     authentication. (CVE-2016-3176)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows
    attackers to bypass the configured authentication service by passing an alternate service with a command
    sent to LocalClient. (CVE-2016-3176)

SaltStack reports :

This issue affects all Salt versions prior to 2015.8.8/2015.5.10 when PAM external authentication is enabled. This issue involves passing an alternative PAM authentication service with a command that is sent to LocalClient, enabling the attacker to bypass the configured authentication service.

ID	Name	Product	Family	Severity
306098	Ubuntu 14.04 LTS : Salt vulnerabilities (USN-8153-1)	Nessus	Ubuntu Local Security Checks	medium
434932	SCA: security update for salt (GHSA-v2rp-9cpj-pfw2)	Tenable Cloud Security	SCA Checks	medium
434932	SCA: security update for salt (GHSA-v2rp-9cpj-pfw2)	Tenable Self-Hosted Container Security	SCA Checks	medium
90233	FreeBSD : salt -- Insecure configuration of PAM external authentication service (6d25c306-f3bb-11e5-92ce-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2016-3176

medium

Tenable Plugins

medium

medium

medium

medium