The parse_dos_extended function in partitions/dos.c in the libblkid library in util-linux allows physically proximate attackers to cause a denial of service (memory consumption) via a crafted MSDOS partition table with an extended partition boot record at zero offset.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5478-1 advisory.

  - The parse_dos_extended function in partitions/dos.c in the libblkid library in util-linux allows     physically proximate attackers to cause a denial of service (memory consumption) via a crafted MSDOS     partition table with an extended partition boot record at zero offset. (CVE-2016-5011)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the util package has been released.

According to the version of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It was found that util-linux's libblkid library did not     properly handle Extended Boot Record (EBR) partitions     when reading MS-DOS partition tables. An attacker with     physical USB access to a protected machine could insert     a storage device with a specially crafted partition     table that could, for example, trigger an infinite loop     in systemd-udevd, resulting in a denial of service on     that machine.(CVE-2016-5011)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for util-linux fixes a number of bugs and two security issues. The following security bugs were fixed :

  - CVE-2016-5011: Infinite loop DoS in libblkid while     parsing DOS partition (bsc#988361)

  - CVE-2017-2616: In su with PAM support it was possible     for local users to send SIGKILL to selected other     processes with root privileges (bsc#1023041).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - It was found that util-linux's libblkid library did not     properly handle Extended Boot Record (EBR) partitions     when reading MS-DOS partition tables. An attacker with     physical USB access to a protected machine could insert     a storage device with a specially crafted partition     table that could, for example, trigger an infinite loop     in systemd-udevd, resulting in a denial of service on     that machine. (CVE-2016-5011)

Additional Changes :

This update for util-linux fixes the following issues :

  - Consider redundant slashes when comparing paths     (bsc#982331,     util-linux-libmount-ignore-redundant-slashes.patch,     affects backport of     util-linux-libmount-cifs-is_mounted.patch).

  - Use upstream compatibility patches for
    --show-pt-geometry with obsolescence and deprecation     warning (bsc#990531)

  - Replace cifs mount detection patch with upstream one     that covers all cases (bsc#987176).

  - Reuse existing loop device to prevent possible data     corruption when multiple -o loop are used to mount a     single file (bsc#947494)

  - Safe loop re-use in libmount, mount and losetup     (bsc#947494)

  - UPSTREAM DIVERGENCE!!! losetup -L continues to use SLE12     SP1 and SP2 specific meaning

    --logical-blocksize instead of upstream --nooverlap     (bsc#966891).

  - Make release-dependent conflict with old sysvinit-tools     SLE specific, as it is required only for SLE 11 upgrade,     and breaks openSUSE staging builds (bsc#994399).

  - Extended partition loop in MBR partition table leads to     DoS (bsc#988361, CVE-2016-5011)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for util-linux fixes the following issues :

  - Consider redundant slashes when comparing paths     (bsc#982331,     util-linux-libmount-ignore-redundant-slashes.patch,     affects backport of     util-linux-libmount-cifs-is_mounted.patch).

  - Use upstream compatibility patches for
    --show-pt-geometry with obsolescence and deprecation     warning (bsc#990531)

  - Replace cifs mount detection patch with upstream one     that covers all cases (bsc#987176).

  - Reuse existing loop device to prevent possible data     corruption when multiple -o loop are used to mount a     single file (bsc#947494)

  - Safe loop re-use in libmount, mount and losetup     (bsc#947494)

  - UPSTREAM DIVERGENCE!!! losetup -L continues to use SLE12     SP1 and SP2 specific meaning

    --logical-blocksize instead of upstream --nooverlap     (bsc#966891).

  - Make release-dependent conflict with old sysvinit-tools     SLE specific, as it is required only for SLE 11 upgrade,     and breaks openSUSE staging builds (bsc#994399).

  - Extended partition loop in MBR partition table leads to     DoS (bsc#988361, CVE-2016-5011)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for util-linux is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program.

Security Fix(es) :

* It was found that util-linux's libblkid library did not properly handle Extended Boot Record (EBR) partitions when reading MS-DOS partition tables. An attacker with physical USB access to a protected machine could insert a storage device with a specially crafted partition table that could, for example, trigger an infinite loop in systemd-udevd, resulting in a denial of service on that machine.
(CVE-2016-5011)

Red Hat would like to thank Michael Gruhn for reporting this issue.
Upstream acknowledges Christian Moch as the original reporter.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

This update for util-linux fixes a number of bugs and one minor security issue.

The following minor vulnerability was fixed :

  - CVE-2016-5011: Infinite loop DoS in libblkid while     parsing DOS partition (bsc#988361)

The following bugs were fixed :

  - bsc#987176: When mounting a subfolder of a CIFS share,     mount -a would show the mount as busy

  - bsc#947494: mount -a would fail to recognize btrfs     already mounted, address loop re-use in libmount

  - bsc#966891: Conflict in meaning of losetup -L. This     switch in SLE12 SP1 and SP2 continues to carry the     meaning of --logical-blocksize instead of upstream
    --nooverlap

  - bsc#994399: Package would trigger conflicts with     sysvinit-tools

  - bsc#983164: mount uid= and gid= would reject valid non     UID/GID values

  - bsc#978993: cfdisk would mangle some text output

  - bsc#982331: libmount: ignore redundant slashes

This update was imported from the SUSE:SLE-12-SP1:Update update project.

From Red Hat Security Advisory 2016:2605 :

An update for util-linux is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program.

Security Fix(es) :

* It was found that util-linux's libblkid library did not properly handle Extended Boot Record (EBR) partitions when reading MS-DOS partition tables. An attacker with physical USB access to a protected machine could insert a storage device with a specially crafted partition table that could, for example, trigger an infinite loop in systemd-udevd, resulting in a denial of service on that machine.
(CVE-2016-5011)

Red Hat would like to thank Michael Gruhn for reporting this issue.
Upstream acknowledges Christian Moch as the original reporter.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

This update for util-linux fixes a number of bugs and one minor security issue. The following minor vulnerability was fixed :

  - CVE-2016-5011: Infinite loop DoS in libblkid while     parsing DOS partition (bsc#988361) The following bugs     were fixed :

  - bsc#987176: When mounting a subfolder of a CIFS share,     mount -a would show the mount as busy

  - bsc#947494: mount -a would fail to recognize btrfs     already mounted, address loop re-use in libmount

  - bsc#966891: Conflict in meaning of losetup -L. This     switch in SLE12 SP1 and SP2 continues to carry the     meaning of --logical-blocksize instead of upstream
    --nooverlap

  - bsc#994399: Package would trigger conflicts with     sysvinit-tools

  - bsc#983164: mount uid= and gid= would reject valid non     UID/GID values

  - bsc#978993: cfdisk would mangle some text output

  - bsc#982331: libmount: ignore redundant slashes

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
162221	Ubuntu 16.04 ESM : util-linux vulnerability (USN-5478-1)	Nessus	Ubuntu Local Security Checks	medium
141440	Photon OS 1.0: Util PHSA-2020-1.0-0330	Nessus	PhotonOS Local Security Checks	medium
99830	EulerOS 2.0 SP1 : util-linux (EulerOS-SA-2016-1068)	Nessus	Huawei Local Security Checks	medium
97380	SUSE SLES12 Security Update : util-linux (SUSE-SU-2017:0553-1)	Nessus	SuSE Local Security Checks	medium
95864	Scientific Linux Security Update : util-linux on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	medium
95752	openSUSE Security Update : util-linux (openSUSE-2016-1446)	Nessus	SuSE Local Security Checks	medium
95424	SUSE SLED12 / SLES12 Security Update : util-linux (SUSE-SU-2016:2954-1)	Nessus	SuSE Local Security Checks	medium
95351	CentOS 7 : util-linux (CESA-2016:2605)	Nessus	CentOS Local Security Checks	medium
94951	openSUSE Security Update : util-linux (openSUSE-2016-1317)	Nessus	SuSE Local Security Checks	medium
94724	Oracle Linux 7 : util-linux (ELSA-2016-2605)	Nessus	Oracle Linux Local Security Checks	medium
94668	SUSE SLED12 / SLES12 Security Update : util-linux (SUSE-SU-2016:2764-1)	Nessus	SuSE Local Security Checks	medium
94568	RHEL 7 : util-linux (RHSA-2016:2605)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2016-5011

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium