The allow_execstack plugin for setroubleshoot allows local users to execute arbitrary commands by triggering an execstack SELinux denial with a crafted filename, related to the commands.getoutput function.

According to the versions of the setroubleshoot, setroubleshoot-plugins packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The setroubleshoot packages provide tools to help     diagnose SELinux problems. When Access Vector Cache     (AVC) messages are returned, an alert can be generated     that provides information about the problem and helps     to track its resolution.

  - The setroubleshoot-plugins package provides a set of     analysis plugins for use with setroubleshoot. Each     plugin has the capacity to analyze SELinux AVC data and     system data to provide user friendly reports describing     how to interpret SELinux AVC denials.

  - Security Fix(es)i1/4s

  - Shell command injection flaws were found in the way the     setroubleshoot executed external commands. A local     attacker able to trigger certain SELinux denials could     use these flaws to execute arbitrary code with     privileges of the setroubleshoot user.(CVE-2016-4989)

  - Shell command injection flaws were found in the way the     setroubleshoot allow_execmod and allow_execstack     plugins executed external commands. A local attacker     able to trigger an execmod or execstack SELinux denial     could use these flaws to execute arbitrary code with     privileges of the setroubleshoot user.
    (CVE-2016-4444,CVE-2016-4446)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2016-4446

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The setroubleshoot-plugins package provides a set of analysis plugins for use with setroubleshoot. Each plugin has the capacity to analyze SELinux AVC data and system data to provide user friendly reports describing how to interpret SELinux AVC denials.

Security Fix(es) :

  - Shell command injection flaws were found in the way the     setroubleshoot executed external commands. A local     attacker able to trigger certain SELinux denials could     use these flaws to execute arbitrary code with     privileges of the setroubleshoot user. (CVE-2016-4989)

  - Shell command injection flaws were found in the way the     setroubleshoot allow_execmod and allow_execstack plugins     executed external commands. A local attacker able to     trigger an execmod or execstack SELinux denial could use     these flaws to execute arbitrary code with privileges of     the setroubleshoot user. (CVE-2016-4444, CVE-2016-4446)

The CVE-2016-4444 and CVE-2016-4446 issues were discovered by Milos Malik (Red Hat) and the CVE-2016-4989 issue was discovered by Red Hat Product Security.

Note: On Scientific Linux 7.0 and 7.1, the setroubleshoot is run with root privileges. Therefore, these issues could allow an attacker to execute arbitrary code with root privileges.

The setroubleshoot-plugins package provides a set of analysis plugins for use with setroubleshoot. Each plugin has the capacity to analyze SELinux AVC data and system data to provide user friendly reports describing how to interpret SELinux AVC denials.

Security Fix(es) :

  - Shell command injection flaws were found in the way the     setroubleshoot executed external commands. A local     attacker able to trigger certain SELinux denials could     use these flaws to execute arbitrary code with root     privileges. (CVE-2016-4445, CVE-2016-4989)

  - Shell command injection flaws were found in the way the     setroubleshoot allow_execmod and allow_execstack plugins     executed external commands. A local attacker able to     trigger an execmod or execstack SELinux denial could use     these flaws to execute arbitrary code with root     privileges. (CVE-2016-4444, CVE-2016-4446)

The CVE-2016-4444 and CVE-2016-4446 issues were discovered by Milos Malik (Red Hat) and the CVE-2016-4445 and CVE-2016-4989 issues were discovered by Red Hat Product Security.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1293 advisory.

    The setroubleshoot packages provide tools to help diagnose SELinux problems. When Access Vector Cache     (AVC) messages are returned, an alert can be generated that provides information about the problem and     helps to track its resolution.

    The setroubleshoot-plugins package provides a set of analysis plugins for use with setroubleshoot. Each     plugin has the capacity to analyze SELinux AVC data and system data to provide user friendly reports     describing how to interpret SELinux AVC denials.

    Security Fix(es):

    * Shell command injection flaws were found in the way the setroubleshoot executed external commands. A     local attacker able to trigger certain SELinux denials could use these flaws to execute arbitrary code     with privileges of the setroubleshoot user. (CVE-2016-4989)

    * Shell command injection flaws were found in the way the setroubleshoot allow_execmod and allow_execstack     plugins executed external commands. A local attacker able to trigger an execmod or execstack SELinux     denial could use these flaws to execute arbitrary code with privileges of the setroubleshoot user.
    (CVE-2016-4444, CVE-2016-4446)

    The CVE-2016-4444 and CVE-2016-4446 issues were discovered by Milos Malik (Red Hat) and the CVE-2016-4989     issue was discovered by Red Hat Product Security.

    Note: On Red Hat Enterprise Linux 7.0 and 7.1, the setroubleshoot is run with root privileges. Therefore,     these issues could allow an attacker to execute arbitrary code with root privileges.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-1293 advisory.

    setroubleshoot     [3.2.24-4.0.1]
    - Add setroubleshoot-oracle-enterprise.patch to change bug reporting       URL to linux.oracle.com

    [3.2.24-4]
    - Catch all subprocess module exceptions

    [3.2.24-3]
    - Use subprocess.check_output() with a sequence of program arguments

    [3.2.24-2]
    - Do not use dangerous shell=True

    setroubleshoot-plugins     [3.0.59-2.0.1]
    - Add setroubleshoot-plugins-oracle-config.patch to use oracle url
    - Add setroubleshoot-plugins-oracle-po.patch to use oracle url for po

    [3.0.59-2]
    - Don't use commands.get*output()     Resolves: CVE-2016-4444, CVE-2016-4446

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for setroubleshoot and setroubleshoot-plugins is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The setroubleshoot packages provide tools to help diagnose SELinux problems. When Access Vector Cache (AVC) messages are returned, an alert can be generated that provides information about the problem and helps to track its resolution.

The setroubleshoot-plugins package provides a set of analysis plugins for use with setroubleshoot. Each plugin has the capacity to analyze SELinux AVC data and system data to provide user friendly reports describing how to interpret SELinux AVC denials.

Security Fix(es) :

* Shell command injection flaws were found in the way the setroubleshoot executed external commands. A local attacker able to trigger certain SELinux denials could use these flaws to execute arbitrary code with privileges of the setroubleshoot user.
(CVE-2016-4989)

* Shell command injection flaws were found in the way the setroubleshoot allow_execmod and allow_execstack plugins executed external commands. A local attacker able to trigger an execmod or execstack SELinux denial could use these flaws to execute arbitrary code with privileges of the setroubleshoot user. (CVE-2016-4444, CVE-2016-4446)

The CVE-2016-4444 and CVE-2016-4446 issues were discovered by Milos Malik (Red Hat) and the CVE-2016-4989 issue was discovered by Red Hat Product Security.

Note: On Red Hat Enterprise Linux 7.0 and 7.1, the setroubleshoot is run with root privileges. Therefore, these issues could allow an attacker to execute arbitrary code with root privileges.

An update for setroubleshoot and setroubleshoot-plugins is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The setroubleshoot packages provide tools to help diagnose SELinux problems. When Access Vector Cache (AVC) messages are returned, an alert can be generated that provides information about the problem and helps to track its resolution.

The setroubleshoot-plugins package provides a set of analysis plugins for use with setroubleshoot. Each plugin has the capacity to analyze SELinux AVC data and system data to provide user friendly reports describing how to interpret SELinux AVC denials.

Security Fix(es) :

* Shell command injection flaws were found in the way the setroubleshoot executed external commands. A local attacker able to trigger certain SELinux denials could use these flaws to execute arbitrary code with root privileges. (CVE-2016-4445, CVE-2016-4989)

* Shell command injection flaws were found in the way the setroubleshoot allow_execmod and allow_execstack plugins executed external commands. A local attacker able to trigger an execmod or execstack SELinux denial could use these flaws to execute arbitrary code with root privileges. (CVE-2016-4444, CVE-2016-4446)

The CVE-2016-4444 and CVE-2016-4446 issues were discovered by Milos Malik (Red Hat) and the CVE-2016-4445 and CVE-2016-4989 issues were discovered by Red Hat Product Security.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-1267 advisory.

    - Don't use command.get*output()     Resolves: CVE-2016-4445

    setroubleshoot-plugins

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
99796	EulerOS 2.0 SP1 : setroubleshoot, setroubleshoot-plugins (EulerOS-SA-2016-1033)	Nessus	Huawei Local Security Checks	high
92304	Fedora 22 : setroubleshoot (2016-f597359bf2)	Nessus	Fedora Local Security Checks	high
92303	Fedora 23 : setroubleshoot (2016-f2493c754a)	Nessus	Fedora Local Security Checks	high
92286	Fedora 23 : setroubleshoot-plugins (2016-b68f69b086)	Nessus	Fedora Local Security Checks	high
92111	Fedora 24 : setroubleshoot-plugins (2016-75ca94dee3)	Nessus	Fedora Local Security Checks	high
92054	Fedora 24 : setroubleshoot (2016-047a86f5b1)	Nessus	Fedora Local Security Checks	high
91809	Scientific Linux Security Update : setroubleshoot and setroubleshoot-plugins on SL7.x x86_64 (20160623)	Nessus	Scientific Linux Local Security Checks	high
91806	Scientific Linux Security Update : setroubleshoot and setroubleshoot-plugins on SL6.x i386/x86_64 (20160621)	Nessus	Scientific Linux Local Security Checks	high
91803	RHEL 7 : setroubleshoot and setroubleshoot-plugins (RHSA-2016:1293)	Nessus	Red Hat Local Security Checks	high
91798	Oracle Linux 7 : setroubleshoot / and / setroubleshoot-plugins (ELSA-2016-1293)	Nessus	Oracle Linux Local Security Checks	high
91787	CentOS 7 : setroubleshoot / setroubleshoot-plugins (CESA-2016:1293)	Nessus	CentOS Local Security Checks	high
91757	RHEL 6 : setroubleshoot and setroubleshoot-plugins (RHSA-2016:1267)	Nessus	Red Hat Local Security Checks	high
91737	Oracle Linux 6 : setroubleshoot / and / setroubleshoot-plugins (ELSA-2016-1267)	Nessus	Oracle Linux Local Security Checks	high
91732	CentOS 6 : setroubleshoot / setroubleshoot-plugins (CESA-2016:1267)	Nessus	CentOS Local Security Checks	high

Detections

Analytics

CVE-2016-4446

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high