The fix_lookup_id function in sealert in setroubleshoot before 3.2.23 allows local users to execute arbitrary commands as root by triggering an SELinux denial with a crafted file name, related to executing external commands with the commands.getstatusoutput function.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-543:01 advisory.

    setroubleshoot     setroubleshoot GUI. Application that allows you to view setroubleshoot-server     messages.
    Provides tools to help diagnose SELinux problems. When AVC messages     are generated an alert can be generated that will give information     about the problem and help track its resolution. Alerts can be configured     to user preference. The same tools can be run on existing log files.
    setroubleshoot-plugins     This package provides a set of analysis plugins for use with     setroubleshoot. Each plugin has the capacity to analyze SELinux AVC     data and system data to provide user friendly reports describing how     to interpret SELinux AVC denials.
    Security issues fixed with this release:
    CVE-2016-4444
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-4445
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-4446
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-4989
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The setroubleshoot-plugins package provides a set of analysis plugins for use with setroubleshoot. Each plugin has the capacity to analyze SELinux AVC data and system data to provide user friendly reports describing how to interpret SELinux AVC denials.

Security Fix(es) :

  - Shell command injection flaws were found in the way the     setroubleshoot executed external commands. A local     attacker able to trigger certain SELinux denials could     use these flaws to execute arbitrary code with root     privileges. (CVE-2016-4445, CVE-2016-4989)

  - Shell command injection flaws were found in the way the     setroubleshoot allow_execmod and allow_execstack plugins     executed external commands. A local attacker able to     trigger an execmod or execstack SELinux denial could use     these flaws to execute arbitrary code with root     privileges. (CVE-2016-4444, CVE-2016-4446)

The CVE-2016-4444 and CVE-2016-4446 issues were discovered by Milos Malik (Red Hat) and the CVE-2016-4445 and CVE-2016-4989 issues were discovered by Red Hat Product Security.

An update for setroubleshoot and setroubleshoot-plugins is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The setroubleshoot packages provide tools to help diagnose SELinux problems. When Access Vector Cache (AVC) messages are returned, an alert can be generated that provides information about the problem and helps to track its resolution.

The setroubleshoot-plugins package provides a set of analysis plugins for use with setroubleshoot. Each plugin has the capacity to analyze SELinux AVC data and system data to provide user friendly reports describing how to interpret SELinux AVC denials.

Security Fix(es) :

* Shell command injection flaws were found in the way the setroubleshoot executed external commands. A local attacker able to trigger certain SELinux denials could use these flaws to execute arbitrary code with root privileges. (CVE-2016-4445, CVE-2016-4989)

* Shell command injection flaws were found in the way the setroubleshoot allow_execmod and allow_execstack plugins executed external commands. A local attacker able to trigger an execmod or execstack SELinux denial could use these flaws to execute arbitrary code with root privileges. (CVE-2016-4444, CVE-2016-4446)

The CVE-2016-4444 and CVE-2016-4446 issues were discovered by Milos Malik (Red Hat) and the CVE-2016-4445 and CVE-2016-4989 issues were discovered by Red Hat Product Security.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-1267 advisory.

    - Don't use command.get*output()     Resolves: CVE-2016-4445

    setroubleshoot-plugins

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
289818	MiracleLinux 4 : setroubleshoot-plugins-3.0.40-3.1.0.1.AXS4, setroubleshoot-3.0.47-12.0.1.AXS4 (AXSA:2016-543:01)	Nessus	Miracle Linux Local Security Checks	high
91806	Scientific Linux Security Update : setroubleshoot and setroubleshoot-plugins on SL6.x i386/x86_64 (20160621)	Nessus	Scientific Linux Local Security Checks	high
91757	RHEL 6 : setroubleshoot and setroubleshoot-plugins (RHSA-2016:1267)	Nessus	Red Hat Local Security Checks	high
91737	Oracle Linux 6 : setroubleshoot / and / setroubleshoot-plugins (ELSA-2016-1267)	Nessus	Oracle Linux Local Security Checks	high
91732	CentOS 6 : setroubleshoot / setroubleshoot-plugins (CESA-2016:1267)	Nessus	CentOS Local Security Checks	high

Detections

Analytics

CVE-2016-4445

high

Tenable Plugins

high

high

high

high

high