Debian tmpreaper version 1.6.13+nmu1 has a race condition when doing a (bind) mount via rename() which could result in local privilege escalation. Mounting via rename() could potentially lead to a file being placed elsewhereon the filesystem hierarchy (e.g. /etc/cron.d/) if the directory being cleaned up was on the same physical filesystem. Fixed versions include 1.6.13+nmu1+deb9u1 and 1.6.14.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Debian tmpreaper version 1.6.13+nmu1 has a race condition when doing a (bind) mount via rename() which     could result in local privilege escalation. Mounting via rename() could potentially lead to a file being     placed elsewhereon the filesystem hierarchy (e.g. /etc/cron.d/) if the directory being cleaned up was on     the same physical filesystem. Fixed versions include 1.6.13+nmu1+deb9u1 and 1.6.14. (CVE-2019-3461)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4077-1 advisory.

    It was discovered that tmpreaper incorrectly handled certain mount operations. A local attacker could     possibly use this issue to create arbitrary files, leading to privilege escalation.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that tmpreaper, a program that cleans up files in directories based on their age, is vulnerable to a race condition.
This vulnerability might be exploited by local attackers to perform privilege escalation.

For Debian 8 'Jessie', this problem has been fixed in version 1.6.13+nmu1+deb8u1.

We recommend that you upgrade your tmpreaper packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Stephen Roettger discovered a race condition in tmpreaper, a program that cleans up files in directories based on their age, which could result in local privilege escalation.

ID	Name	Product	Family	Severity
254747	Linux Distros Unpatched Vulnerability : CVE-2019-3461	Nessus	Misc.	high
127793	Ubuntu 16.04 LTS / 18.04 LTS : tmpreaper vulnerability (USN-4077-1)	Nessus	Ubuntu Local Security Checks	high
121372	Debian DLA-1640-1 : tmpreaper security update	Nessus	Debian Local Security Checks	high
121134	Debian DSA-4365-1 : tmpreaper - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2019-3461

high

Tenable Plugins

high

high

high

high