Supportutils, before version 3.1-5.7.1, wrote data to static file /tmp/supp_log, allowing local attackers to overwrite files on systems without symlink protection

This update for hostinfo, supportutils fixes the following issues:
&#9; Security issues fixed for supportutils :

  - CVE-2018-19640: Fixed an issue where users could kill     arbitrary processes (bsc#1118463).

  - CVE-2018-19638: Fixed an issue where users could     overwrite arbitrary log files (bsc#1118460).

  - CVE-2018-19639: Fixed a code execution if run with -v     (bsc#1118462).

  - CVE-2018-19637: Fixed an issue where static temporary     filename could allow overwriting of files (bsc#1117776).

  - CVE-2018-19636: Fixed a local root exploit via inclusion     of attacker controlled shell script (bsc#1117751).

Other issues fixed for supportutils :

  - Fixed invalid exit code commands (bsc#1125666)

  - SUSE separation in supportconfig (bsc#1125623)

  - Clarified supportconfig(8) -x option (bsc#1115245)

  - supportconfig: 3.0.127

  - btrfs filesystem usage

  - List products.d

  - Dump lsof errors

  - Added ha commands for corosync

  - Dumped find errors in ib_info

Issues fixed in hostinfo :

  - Removed extra kernel install dates (bsc#1099498)

  - Resolved network bond issue (bsc#1054979)

This update was imported from the SUSE:SLE-12:Update update project.

This update for supportutils fixes the following issues :

Security issues fixed :

  - CVE-2018-19640: Fixed an issue where users could kill     arbitrary processes (bsc#1118463).

  - CVE-2018-19638: Fixed an issue where users could     overwrite arbitrary log files (bsc#1118460).

  - CVE-2018-19639: Fixed a code execution if run with -v     (bsc#1118462).

  - CVE-2018-19637: Fixed an issue where static temporary     filename could allow overwriting of files (bsc#1117776).

Other issues fixed :

  - Fixed invalid exit code commands (bsc#1125666).

  - Included additional SUSE separation (bsc#1125609).

  - Merged added listing of locked packes by zypper.

  - Exclude pam.txt per GDPR by default (bsc#1112461).&#9; 

  - Clarified -x functionality in supportconfig(8)     (bsc#1115245).&#9; 

  - udev service and provide the whole journal content in     supportconfig (bsc#1051797).

  - supportconfig collects tuned profile settings     (bsc#1071545).

  - sfdisk -d no disk device specified (bsc#1043311).

  - Added vulnerabilites status check in basic-health.txt     (bsc#1105849).

  - Added only sched_domain from cpu0.

  - Blacklist sched_domain from proc.txt (bsc#1046681).

  - Added firewall-cmd info.

  - Add ls -lA --time-style=long-iso /etc/products.d/

  - Dump lsof errors.

  - Added corosync status to ha_info.

  - Dump find errors in ib_info.

This update was imported from the SUSE:SLE-15:Update update project.

ID	Name	Product	Family	Type	Severity
124712	openSUSE Security Update : hostinfo / supportutils (openSUSE-2019-1351)	Nessus	SuSE Local Security Checks	Local	high
122643	openSUSE Security Update : supportutils (openSUSE-2019-293)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2018-19637

medium

Tenable Plugins

high

high