libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-1189 advisory.

  - libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses     predictable filenames (under /dev/shm and /tmp) without O_EXCL. (CVE-2019-12779)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3610 advisory.

  - libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses     predictable filenames (under /dev/shm and /tmp) without O_EXCL. (CVE-2019-12779)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202107-03 (libqb: Insecure temporary file)

    It was discovered that libqb used predictable filenames (under /dev/shm       and /tmp) without O_EXCL.
  Impact :

    A local attacker could perform symlink attacks to overwrite arbitrary       files with the privileges of the user running the application linked       against libqb.
  Workaround :

    There is no known workaround at this time.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3610 advisory.

  - libqb: Insecure treatment of IPC (temporary) files (CVE-2019-12779)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has libqb packages installed that are affected by a vulnerability:

  - libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses     predictable filenames (under /dev/shm and /tmp) without O_EXCL. (CVE-2019-12779)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libqb packages installed that are affected by a vulnerability:

  - libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses     predictable filenames (under /dev/shm and /tmp) without O_EXCL. (CVE-2019-12779)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the libqb packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - libqb before 1.0.5 allows local users to overwrite     arbitrary files via a symlink attack, because it uses     predictable filenames (under /dev/shm and /tmp) without     O_EXCL.(CVE-2019-12779)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

* libqb: Insecure treatment of IPC (temporary) files

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1189 advisory.

  - libqb: Insecure treatment of IPC (temporary) files     (CVE-2019-12779)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1189 advisory.

  - libqb: Insecure treatment of IPC (temporary) files (CVE-2019-12779)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3610 advisory.

  - libqb: Insecure treatment of IPC (temporary) files (CVE-2019-12779)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for libqb fixes the following issue :

Security issue fixed:&#9; 

  - CVE-2019-12779: Fixed an insecure treatment of IPC     temporary files which could have allowed a local     attacker to overwrite privileged system files     (bsc#1137835).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for libqb fixes the following issues :

Security issue fixed :

  - CVE-2019-12779: Fixed an issue where a local attacker     could overwrite privileged system files (bsc#1137835).

This update was imported from the SUSE:SLE-15:Update update project.

This update for libqb fixes the following issues :

Security issue fixed :

CVE-2019-12779: Fixed an issue where a local attacker could overwrite privileged system files (bsc#1137835).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libqb fixes the following issue :

Security issue fixed :

CVE-2019-12779: Fixed an insecure treatment of IPC temporary files which could have allowed a local attacker to overwrite privileged system files (bsc#1137835).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
180711	Oracle Linux 7 : libqb (ELSA-2020-1189)	Nessus	Oracle Linux Local Security Checks	high
180662	Oracle Linux 8 : libqb (ELSA-2019-3610)	Nessus	Oracle Linux Local Security Checks	high
157028	GLSA-202107-03 : libqb: Insecure temporary file	Nessus	Gentoo Local Security Checks	high
145619	CentOS 8 : libqb (CESA-2019:3610)	Nessus	CentOS Local Security Checks	high
143958	NewStart CGSL CORE 5.05 / MAIN 5.05 : libqb Vulnerability (NS-SA-2020-0088)	Nessus	NewStart CGSL Local Security Checks	high
143916	NewStart CGSL CORE 5.04 / MAIN 5.04 : libqb Vulnerability (NS-SA-2020-0057)	Nessus	NewStart CGSL Local Security Checks	high
139966	EulerOS 2.0 SP8 : libqb (EulerOS-SA-2020-1863)	Nessus	Huawei Local Security Checks	high
135816	Scientific Linux Security Update : libqb on SL7.x x86_64 (20200407)	Nessus	Scientific Linux Local Security Checks	high
135357	CentOS 7 : libqb (CESA-2020:1189)	Nessus	CentOS Local Security Checks	high
135067	RHEL 7 : libqb (RHSA-2020:1189)	Nessus	Red Hat Local Security Checks	high
130559	RHEL 8 : libqb (RHSA-2019:3610)	Nessus	Red Hat Local Security Checks	high
126893	openSUSE Security Update : libqb (openSUSE-2019-1752)	Nessus	SuSE Local Security Checks	high
126885	openSUSE Security Update : libqb (openSUSE-2019-1718)	Nessus	SuSE Local Security Checks	high
126619	SUSE SLED15 / SLES15 Security Update : libqb (SUSE-SU-2019:1812-1)	Nessus	SuSE Local Security Checks	high
126597	SUSE SLED15 / SLES15 Security Update : libqb (SUSE-SU-2019:1791-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2019-12779

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high