An elevation of privilege vulnerability in libnl could enable a local malicious application to execute arbitrary code within the context of the Wi-Fi service. This issue is rated as Moderate because it first requires compromising a privileged process and is mitigated by current platform configurations. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32342065. NOTE: this issue also exists in the upstream libnl before 3.3.0 library.

According to the version of the libnl package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - An elevation of privilege vulnerability in libnl could     enable a local malicious application to execute     arbitrary code within the context of the Wi-Fi service.
    This issue is rated as Moderate because it first     requires compromising a privileged process and is     mitigated by current platform configurations. Product:
    Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0,     7.1.1. Android ID: A-32342065. NOTE: this issue also     exists in the upstream libnl before 3.3.0     library.(CVE-2017-0553)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libnl package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - An integer overflow leading to a heap-buffer overflow     was found in the libnl library. An attacker could use     this flaw to cause an application compiled with libnl     to crash or possibly execute arbitrary code in the     context of the user running such an     application.(CVE-2017-0553)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libnl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An elevation of privilege vulnerability in libnl could     enable a local malicious application to execute     arbitrary code within the context of the Wi-Fi service.
    This issue is rated as Moderate because it first     requires compromising a privileged process and is     mitigated by current platform configurations. Product:
    Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0,     7.1.1. Android ID: A-32342065. NOTE: this issue also     exists in the upstream libnl before 3.3.0     library.(CVE-2017-0553)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libnl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An integer overflow leading to a heap-buffer overflow     was found in the libnl library. An attacker could use     this flaw to cause an application compiled with libnl     to crash or possibly execute arbitrary code in the     context of the user running such an application.
    (CVE-2017-0553)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libnl3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An integer overflow leading to a heap-buffer overflow     was found in the libnl library. An attacker could use     this flaw to cause an application compiled with libnl     to crash or possibly execute arbitrary code in the     context of the user running such an application.
    (CVE-2017-0553)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Integer overflow in nlmsg_reserve() :

An integer overflow leading to a heap-buffer overflow was found in the libnl library. An attacker could use this flaw to cause an application compiled with libnl to crash or possibly execute arbitrary code in the context of the user running such an application. (CVE-2017-0553)

An update for NetworkManager, NetworkManager-libreswan, libnl3, and network-manager-applet is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services.

The libnl3 packages contain a convenience library that simplifies using the Linux kernel's Netlink sockets interface for network manipulation.

The following packages have been upgraded to a later upstream version:
NetworkManager (1.8.0), network-manager-applet (1.8.0). (BZ#1413312, BZ# 1414103, BZ#1441621)

Security Fix(es) in the libnl3 component :

* An integer overflow leading to a heap-buffer overflow was found in the libnl library. An attacker could use this flaw to cause an application compiled with libnl to crash or possibly execute arbitrary code in the context of the user running such an application.
(CVE-2017-0553)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

The libnl3 packages contain a convenience library that simplifies using the Linux kernel's Netlink sockets interface for network manipulation.

The following packages have been upgraded to a later upstream version:
NetworkManager (1.8.0), network-manager-applet (1.8.0).

Security Fix(es) in the libnl3 component :

  - An integer overflow leading to a heap-buffer overflow     was found in the libnl library. An attacker could use     this flaw to cause an application compiled with libnl to     crash or possibly execute arbitrary code in the context     of the user running such an application. (CVE-2017-0553)

From Red Hat Security Advisory 2017:2299 :

An update for NetworkManager, NetworkManager-libreswan, libnl3, and network-manager-applet is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services.

The libnl3 packages contain a convenience library that simplifies using the Linux kernel's Netlink sockets interface for network manipulation.

The following packages have been upgraded to a later upstream version:
NetworkManager (1.8.0), network-manager-applet (1.8.0). (BZ#1413312, BZ# 1414103, BZ#1441621)

Security Fix(es) in the libnl3 component :

* An integer overflow leading to a heap-buffer overflow was found in the libnl library. An attacker could use this flaw to cause an application compiled with libnl to crash or possibly execute arbitrary code in the context of the user running such an application.
(CVE-2017-0553)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

USN-3311-1 fixed a vulnerability in libnl. This update provides the corresponding update for Ubuntu 12.04 ESM.

It was discovered that libnl incorrectly handled memory when performing certain operations. A local attacker could possibly use this issue to cause libnl to crash, resulting in a denial of service, or execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that libnl incorrectly handled memory when performing certain operations. A local attacker could possibly use this issue to cause libnl to crash, resulting in a denial of service, or execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

lib: check for integer overflow in nlmsg_reserve() (rh#1440788, rh#1440789, CVE-2017-0553)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

lib: check for integer overflow in nlmsg_reserve() (rh#1440789, CVE-2017-0553)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was an integer overflow in libnl3, a library for dealing with netlink sockets.

A missing check in nlmsg_reserve() could have allowed a malicious application to execute arbitrary code within the context of the WiFi service.

For Debian 7 'Wheezy', this issue has been fixed in libnl3 version 3.2.7-4+deb7u1.

We recommend that you upgrade your libnl3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was a FIXME in libnl, a FIXME...

For Debian 7 'Wheezy', this issue has been fixed in libnl version 1.1-7+deb7u1.

We recommend that you upgrade your libnl packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
135652	EulerOS Virtualization 3.0.2.2 : libnl (EulerOS-SA-2020-1490)	Nessus	Huawei Local Security Checks	high
134547	EulerOS Virtualization for ARM 64 3.0.2.0 : libnl (EulerOS-SA-2020-1258)	Nessus	Huawei Local Security Checks	high
130877	EulerOS 2.0 SP5 : libnl (EulerOS-SA-2019-2168)	Nessus	Huawei Local Security Checks	high
129244	EulerOS 2.0 SP3 : libnl (EulerOS-SA-2019-2051)	Nessus	Huawei Local Security Checks	high
128905	EulerOS 2.0 SP2 : libnl (EulerOS-SA-2019-1853)	Nessus	Huawei Local Security Checks	high
103000	EulerOS 2.0 SP2 : libnl3 (EulerOS-SA-2017-1162)	Nessus	Huawei Local Security Checks	high
102999	EulerOS 2.0 SP1 : libnl3 (EulerOS-SA-2017-1161)	Nessus	Huawei Local Security Checks	high
102864	Amazon Linux AMI : libnl3 (ALAS-2017-876)	Nessus	Amazon Linux Local Security Checks	high
102760	CentOS 7 : NetworkManager / NetworkManager-libreswan / libnl3 / network-manager-applet (CESA-2017:2299)	Nessus	CentOS Local Security Checks	high
102635	Scientific Linux Security Update : NetworkManager and libnl3 on SL7.x x86_64 (20170801)	Nessus	Scientific Linux Local Security Checks	high
102341	Oracle Linux 7 : NetworkManager / libnl3 (ELSA-2017-2299)	Nessus	Oracle Linux Local Security Checks	high
102155	RHEL 7 : NetworkManager and libnl3 (RHSA-2017:2299)	Nessus	Red Hat Local Security Checks	high
100919	Ubuntu 12.04 LTS : libnl3 vulnerability (USN-3311-2)	Nessus	Ubuntu Local Security Checks	high
100663	Ubuntu 14.04 LTS / 16.04 LTS : libnl vulnerability (USN-3311-1)	Nessus	Ubuntu Local Security Checks	high
99989	Fedora 24 : libnl3 (2017-7a5363b41d)	Nessus	Fedora Local Security Checks	high
99608	Fedora 25 : libnl3 (2017-34f6e70fdd)	Nessus	Fedora Local Security Checks	high
99270	Debian DLA-892-1 : libnl3 security update	Nessus	Debian Local Security Checks	high
99269	Debian DLA-891-1 : libnl security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-0553

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high