sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other Linux implementations preserves the value of INPUTRC which could lead to information disclosure. A local user with sudo access to a restricted program that uses readline could use this flaw to read content from specially formatted files with elevated privileges provided by sudo.

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2016-1113:02 advisory.

    Sudo (superuser do) allows a system administrator to give certain     users (or groups of users) the ability to run some (or all) commands     as root while logging all commands and arguments. Sudo operates on a     per-command basis.  It is not a replacement for the shell.  Features     include: the ability to restrict what commands a user may run on a     per-host basis, copious logging of each command (providing a clear     audit trail of who did what), a configurable timeout of the sudo     command, and the ability to use the same configuration file (sudoers)     on many different machines.
    Security issues fixed with this release:
    CVE-2016-7091
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    Additional Changes:

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other     Linux implementations preserves the value of INPUTRC which could lead to information disclosure. A local     user with sudo access to a restricted program that uses readline could use this flaw to read content from     specially formatted files with elevated privileges provided by sudo. (CVE-2016-7091)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the version of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It was discovered that the default sudo configuration     preserved the value of INPUTRC from the user's     environment, which could lead to information     disclosure. A local user with sudo access to a     restricted program that uses readline could use this     flaw to read content from specially formatted files     with elevated privileges provided by     sudo.(CVE-2016-7091)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - It was discovered that the default sudo configuration     preserved the value of INPUTRC from the user's     environment, which could lead to information disclosure.
    A local user with sudo access to a restricted program     that uses readline could use this flaw to read content     from specially formatted files with elevated privileges     provided by sudo. (CVE-2016-7091)

Note: With this update, INPUTRC was removed from the env_keep list in /etc/sudoers to avoid having sudo preserve the value of this variable when invoking privileged commands.

Additional Changes :

An update for sudo is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.

Security Fix(es) :

* It was discovered that the default sudo configuration preserved the value of INPUTRC from the user's environment, which could lead to information disclosure. A local user with sudo access to a restricted program that uses readline could use this flaw to read content from specially formatted files with elevated privileges provided by sudo.
(CVE-2016-7091)

Note: With this update, INPUTRC was removed from the env_keep list in /etc/ sudoers to avoid having sudo preserve the value of this variable when invoking privileged commands.

Red Hat would like to thank Grisha Levit for reporting this issue.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-2593 advisory.

    [1.8.6p7-20]
    - RHEL 7.3 erratum
      - fixed visudo's -q flag       Resolves: rhbz#1350828

    [1.8.6p7-19]
    - RHEL 7.3 erratum
      - removed INPUTRC from env_keep to prevent a potential info leak       Resolves: rhbz#1340700

    [1.8.6p7-18]
    - RHEL 7.3 erratum
      - removed requiretty flag from the default sudoers policy
      - backported pam_service and pam_login_service defaults options
      - implemented netgroup_tuple defaults option for changing netgroup         processing semantics
      - fixed user matching logic in the LDAP nss backend
      - don't allow visudo to accept an invalid sudoers file
      - fixed a bug causing that non-root users can list privileges of         other users
      - modified digest check documentation to mention the raciness of         the checking mechanism       Resolves: rhbz#1196451       Resolves: rhbz#1247230       Resolves: rhbz#1334331       Resolves: rhbz#1334360       Resolves: rhbz#1261998       Resolves: rhbz#1313364       Resolves: rhbz#1312486       Resolves: rhbz#1268958       Resolves: rhbz#1335039       Resolves: rhbz#1335042       Resolves: rhbz#1335045       Resolves: rhbz#1273243       Resolves: rhbz#1299883

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:2593 advisory.

    The sudo packages contain the sudo utility which allows system administrators to provide certain users     with the permission to execute privileged commands, which are used for system management purposes, without     having to log in as root.

    Security Fix(es):

    * It was discovered that the default sudo configuration preserved the value of INPUTRC from the user's     environment, which could lead to information disclosure. A local user with sudo access to a restricted     program that uses readline could use this flaw to read content from specially formatted files with     elevated privileges provided by sudo. (CVE-2016-7091)

    Note: With this update, INPUTRC was removed from the env_keep list in /etc/sudoers to avoid having sudo     preserve the value of this variable when invoking privileged commands.

    Red Hat would like to thank Grisha Levit for reporting this issue.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
289128	MiracleLinux 7 : sudo-1.8.6p7-20.el7 (AXSA:2016-1113:02)	Nessus	Miracle Linux Local Security Checks	medium
219992	Linux Distros Unpatched Vulnerability : CVE-2016-7091	Nessus	Misc.	medium
99817	EulerOS 2.0 SP1 : sudo (EulerOS-SA-2016-1055)	Nessus	Huawei Local Security Checks	medium
95861	Scientific Linux Security Update : sudo on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	medium
95339	CentOS 7 : sudo (CESA-2016:2593)	Nessus	CentOS Local Security Checks	medium
94713	Oracle Linux 7 : sudo (ELSA-2016-2593)	Nessus	Oracle Linux Local Security Checks	medium
94556	RHEL 7 : sudo (RHSA-2016:2593)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2016-7091

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium