The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tmp/scala-devel/${USER:shared}/scalac-compile-server-port, which allows local users to write to arbitrary class files and consequently gain privileges.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak     permissions for private files in /tmp/scala-devel/${USER:shared}/scalac-compile-server-port, which allows     local users to write to arbitrary class files and consequently gain privileges. (CVE-2017-15288)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak
    permissions for private files in /tmp/scala-devel/${USER:shared}/scalac-compile-server-port, which allows
    local users to write to arbitrary class files and consequently gain privileges. (CVE-2017-15288)

The remote host is affected by the vulnerability described in GLSA-201812-08 (Scala: Privilege escalation)

    It was discovered that Scala&rsquo;s compilation daemon does not properly       manage permissions for private files.
  Impact :

    A local attacker could escalate privileges.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Type	Severity
258195	Linux Distros Unpatched Vulnerability : CVE-2017-15288	Nessus	Misc.	Local	high
423222	SCA: security update for org.scala-lang:scala-compiler (GHSA-qvxv-pmq9-4q7g)	Tenable Cloud Security	SCA Checks	Local	high
423222	SCA: security update for org.scala-lang:scala-compiler (GHSA-qvxv-pmq9-4q7g)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
119704	GLSA-201812-08 : Scala: Privilege escalation	Nessus	Gentoo Local Security Checks	Local	high

Detections

Analytics

CVE-2017-15288

high

Tenable Plugins

high

high

high

high