In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

The remote NewStart CGSL host, running version MAIN 6.06 (SP), has coreutils packages installed that are affected by multiple vulnerabilities:

  - Gnulib before 2017-04-26 has a heap-based buffer overflow with the TZ environment variable. The error is     in the save_abbr function in time_rz.c. (CVE-2017-7476)

  - The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a     size calculation without considering the number of bytes occupied by multibyte characters, which allows     attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have     unspecified other impact via long UTF-8 strings. (CVE-2015-4041)

  - Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 might allow     attackers to cause a denial of service (application crash) or possibly have unspecified other impact via     long strings. (CVE-2015-4042)

  - In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain     file with a symlink during use of the POSIX -R -L options, which allows local users to modify the     ownership of arbitrary files by leveraging a race condition. (CVE-2017-18018)

  - The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer     overflow because memory is not allocated for a trailing '\0' character during %f processing.
    (CVE-2018-17942)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06, has coreutils packages installed that are affected by multiple vulnerabilities:

  - Gnulib before 2017-04-26 has a heap-based buffer overflow with the TZ environment variable. The error is     in the save_abbr function in time_rz.c. (CVE-2017-7476)

  - The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a     size calculation without considering the number of bytes occupied by multibyte characters, which allows     attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have     unspecified other impact via long UTF-8 strings. (CVE-2015-4041)

  - Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 might allow     attackers to cause a denial of service (application crash) or possibly have unspecified other impact via     long strings. (CVE-2015-4042)

  - In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain     file with a symlink during use of the POSIX -R -L options, which allows local users to modify the     ownership of arbitrary files by leveraging a race condition. (CVE-2017-18018)

  - The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer     overflow because memory is not allocated for a trailing '\0' character during %f processing.
    (CVE-2018-17942)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain
    file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the
    ownership of arbitrary files by leveraging a race condition. (CVE-2017-18018)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain     file with a symlink during use of the POSIX -R -L options, which allows local users to modify the     ownership of arbitrary files by leveraging a race condition. (CVE-2017-18018)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the version of the coreutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - In GNU Coreutils through 8.29, chown-core.c in chown     and chgrp does not prevent replacement of a plain file     with a symlink during use of the POSIX '-R -L' options,     which allows local users to modify the ownership of     arbitrary files by leveraging a race     condition.(CVE-2017-18018)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the coreutils package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - In GNU Coreutils through 8.29, chown-core.c in chown     and chgrp does not prevent replacement of a plain file     with a symlink during use of the POSIX '-R -L' options,     which allows local users to modify the ownership of     arbitrary files by leveraging a race     condition.(CVE-2017-18018)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the coreutils package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In GNU Coreutils through 8.29, chown-core.c in chown     and chgrp does not prevent replacement of a plain file     with a symlink during use of the POSIX '-R -L' options,     which allows local users to modify the ownership of     arbitrary files by leveraging a race     condition.(CVE-2017-18018)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the coreutils packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - In GNU Coreutils through 8.29, chown-core.c in chown     and chgrp does not prevent replacement of a plain file     with a symlink during use of the POSIX '-R -L' options,     which allows local users to modify the ownership of     arbitrary files by leveraging a race     condition.(CVE-2017-18018)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- doc: warn about following symlinks recursively in     chown/chgrp (CVE-2017-18018)

  - mv -n: do not overwrite the destination

  - mv -n: provide more reliable diagnostic messages

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
301213	NewStart CGSL MAIN 6.06 (SP) : coreutils Multiple Vulnerabilities (NS-SA-2026-0014)	Nessus	NewStart CGSL Local Security Checks	critical
266248	NewStart CGSL MAIN 6.06 : coreutils Multiple Vulnerabilities (NS-SA-2025-0228)	Nessus	NewStart CGSL Local Security Checks	critical
423760	Alpine: multiple coreutils packages: security update to 8.30-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
423760	Alpine: multiple coreutils packages: security update to 8.30-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
221095	Linux Distros Unpatched Vulnerability : CVE-2017-18018	Nessus	Misc.	medium
403906	Alpine: coreutils: security update to 8.29-r2	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
403906	Alpine: coreutils: security update to 8.29-r2	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
403905	Alpine: coreutils: security update to 8.28-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
403905	Alpine: coreutils: security update to 8.28-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
135646	EulerOS Virtualization 3.0.2.2 : coreutils (EulerOS-SA-2020-1484)	Nessus	Huawei Local Security Checks	medium
134483	EulerOS Virtualization for ARM 64 3.0.2.0 : coreutils (EulerOS-SA-2020-1194)	Nessus	Huawei Local Security Checks	medium
132280	EulerOS 2.0 SP3 : coreutils (EulerOS-SA-2019-2563)	Nessus	Huawei Local Security Checks	medium
131909	EulerOS 2.0 SP2 : coreutils (EulerOS-SA-2019-2417)	Nessus	Huawei Local Security Checks	medium
131498	EulerOS Virtualization for ARM 64 3.0.3.0 : coreutils (EulerOS-SA-2019-2333)	Nessus	Huawei Local Security Checks	medium
130843	EulerOS 2.0 SP5 : coreutils (EulerOS-SA-2019-2134)	Nessus	Huawei Local Security Checks	medium
106514	Fedora 27 : coreutils (2018-669520d2ba)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2017-18018

medium

Tenable Plugins

critical

critical

medium

medium

medium

critical

critical

critical

critical

medium

medium

medium

medium

medium

medium

medium