systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1611 advisory.

  - In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment     before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to     set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using     the allow_active element rather than allow_any. (CVE-2019-3842)

  - systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed     by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were     intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082. (CVE-2020-13776)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of systemd installed on the remote host is prior to 219-78. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1854 advisory.

  - In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment     before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to     set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using     the allow_active element rather than allow_any. (CVE-2019-3842)

  - An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW     packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An     attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server. (CVE-2020-13529)

  - systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed     by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were     intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082. (CVE-2020-13776)

  - A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function     and dns_stream_complete() function in 'resolved-dns-stream.c' not incrementing the reference counting for     the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream     object, causing the use-after-free when the reference is still used later. (CVE-2022-2526)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has systemd packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the     udevadm trigger command, a memory leak may occur. (CVE-2019-20386)

  - In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment     before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to     set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using     the allow_active element rather than allow_any. (CVE-2019-3842)

  - systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed     by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were     intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082. (CVE-2020-13776)

  - basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an     Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that     results in an operating system crash. (CVE-2021-33910)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:1611 advisory.

  - In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment     before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to     set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using     the allow_active element rather than allow_any. (CVE-2019-3842)

  - systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed     by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were     intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082. (CVE-2020-13776)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3900 advisory.

  - systemd: Spoofing of XDG_SEAT allows for actions to be checked against allow_active instead of     allow_any (CVE-2019-3842)

  - systemd: Mishandles numerical usernames beginning with decimal digits or 0x followed by hexadecimal digits     (CVE-2020-13776)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-1611 advisory.

  - In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment     before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to     set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using     the allow_active element rather than allow_any. (CVE-2019-3842)

  - systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed     by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were     intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082. (CVE-2020-13776)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1611 advisory.

  - systemd: Spoofing of XDG_SEAT allows for actions to be checked against allow_active instead of     allow_any (CVE-2019-3842)

  - systemd: Mishandles numerical usernames beginning with decimal digits or 0x followed by hexadecimal digits     (CVE-2020-13776)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1611 advisory.

  - systemd: Spoofing of XDG_SEAT allows for actions to be checked against allow_active instead of     allow_any (CVE-2019-3842)

  - systemd: Mishandles numerical usernames beginning with decimal digits or 0x followed by hexadecimal digits     (CVE-2020-13776)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the systemd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A flaw was found in systemd, where it mishandles     numerical usernames beginning with decimal digits, or     '0x' followed by hexadecimal digits. When the usernames     are used by systemd, for example in service units, an     unexpected user may be used instead. In some particular     configurations, this flaw allows local attackers to     elevate their privileges.(CVE-2020-13776)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the systemd packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - systemd through v245 mishandles numerical usernames     such as ones composed of decimal digits or 0x followed     by hex digits, as demonstrated by use of root     privileges when privileges of the 0x0 user account were     intended. NOTE: this issue exists because of an     incomplete fix for CVE-2017-1000082.(CVE-2020-13776)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - systemd through v245 mishandles numerical usernames     such as ones composed of decimal digits or 0x followed     by hex digits, as demonstrated by use of root     privileges when privileges of the 0x0 user account were     intended. NOTE: this issue exists because of an     incomplete fix for CVE-2017-1000082.(CVE-2020-13776)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Contains a bunch of patches for the assorted linked bugzillas.
Handling of user names that resemble numerical uids is tightened (CVE-2020-13776). The hardware database is updated to the upstream version.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the systemd package has been released.

ID	Name	Product	Family	Severity
184771	Rocky Linux 8 : systemd (RLSA-2021:1611)	Nessus	Rocky Linux Local Security Checks	high
165993	Amazon Linux 2 : systemd (ALAS-2022-1854)	Nessus	Amazon Linux Local Security Checks	critical
160827	NewStart CGSL MAIN 6.02 : systemd Multiple Vulnerabilities (NS-SA-2022-0055)	Nessus	NewStart CGSL Local Security Checks	high
157711	AlmaLinux 8 : systemd (ALSA-2021:1611)	Nessus	Alma Linux Local Security Checks	high
154260	RHEL 8 : systemd (RHSA-2021:3900)	Nessus	Red Hat Local Security Checks	high
149954	Oracle Linux 8 : systemd (ELSA-2021-1611)	Nessus	Oracle Linux Local Security Checks	high
149774	CentOS 8 : systemd (CESA-2021:1611)	Nessus	CentOS Local Security Checks	high
149692	RHEL 8 : systemd (RHSA-2021:1611)	Nessus	Red Hat Local Security Checks	high
148605	EulerOS Virtualization 2.9.1 : systemd (EulerOS-SA-2021-1724)	Nessus	Huawei Local Security Checks	medium
148595	EulerOS Virtualization 2.9.0 : systemd (EulerOS-SA-2021-1738)	Nessus	Huawei Local Security Checks	medium
147069	EulerOS Virtualization for ARM 64 3.0.6.0 : systemd (EulerOS-SA-2021-1534)	Nessus	Huawei Local Security Checks	medium
146257	EulerOS 2.0 SP9 : systemd (EulerOS-SA-2021-1277)	Nessus	Huawei Local Security Checks	medium
146219	EulerOS 2.0 SP9 : systemd (EulerOS-SA-2021-1258)	Nessus	Huawei Local Security Checks	medium
145717	EulerOS 2.0 SP8 : systemd (EulerOS-SA-2021-1174)	Nessus	Huawei Local Security Checks	medium
139212	Fedora 32 : systemd (2020-2faf839786)	Nessus	Fedora Local Security Checks	medium
137725	Photon OS 3.0: Systemd PHSA-2020-3.0-0103	Nessus	PhotonOS Local Security Checks	medium
137642	Photon OS 1.0: Systemd PHSA-2020-1.0-0301	Nessus	PhotonOS Local Security Checks	high
137303	Photon OS 2.0: Systemd PHSA-2020-2.0-0252	Nessus	PhotonOS Local Security Checks	medium

Detections

Analytics

CVE-2020-13776

medium

Tenable Plugins

high

critical

high

high

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

high

medium