HylaFAX+ through 7.0.2 and HylaFAX Enterprise have scripts that execute binaries from directories writable by unprivileged users (e.g., locations under /var/spool/hylafax that are writable by the uucp account). This allows these users to execute code in the context of the user calling these binaries (often root).

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - HylaFAX+ through 7.0.2 and HylaFAX Enterprise have scripts that execute binaries from directories writable     by unprivileged users (e.g., locations under /var/spool/hylafax that are writable by the uucp account).
    This allows these users to execute code in the context of the user calling these binaries (often root).
    (CVE-2020-15397)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - In HylaFAX+ through 7.0.2 and HylaFAX Enterprise, the faxsetup utility calls chown on files in user-owned
    directories. By winning a race, a local attacker could use this to escalate his privileges to root.
    (CVE-2020-15396)

  - HylaFAX+ through 7.0.2 and HylaFAX Enterprise have scripts that execute binaries from directories writable
    by unprivileged users (e.g., locations under /var/spool/hylafax that are writable by the uucp account).
    This allows these users to execute code in the context of the user calling these binaries (often root).
    (CVE-2020-15397)

This update for hylafax+ fixes the following issues :

Hylafax was updated to upstream version 7.0.3.

Security issues fixed :

  - CVE-2020-15396: Secure temporary directory creation for     faxsetup, faxaddmodem, and probemodem (boo#1173521).

  - CVE-2020-15397: Sourcing of files into binaries from     user writeable directories (boo#1173519).

Non-security issues fixed :

  - add UseSSLFax feature in sendfax, sendfax.conf,     hyla.conf, and JobControl (31 Jul 2020)

  - be more resilient in listening for the Phase C carrier     (30 Jul 2020)

  - make sure to return to command mode if HDLC receive     times out (29 Jul 2020)

  - make faxmail ignore boundaries on parts other than     multiparts (29 Jul 2020)

  - don't attempt to write zero bytes of data to a TIFF (29     Jul 2020)

  - don't ever respond to CRP with CRP (28 Jul 2020)

  - reset frame counter when a sender retransmits PPS for a     previously confirmed ECM block (26 Jul 2020)

  - scrutinize PPM before concluding that the sender missed     our MCF (23 Jul 2020)

  - fix modem recovery after SSL Fax failure (22, 26 Jul     2020)

  - ignore echo of PPR, RTN, CRP (10, 13, 21 Jul 2020)

  - attempt to handle NSF/CSI/DIS in Class 1 sending Phase D     (6 Jul 2020)

  - run scripts directly rather than invoking them via a     shell for security hardening (3-5 Jul 2020)

  - add senderFumblesECM feature (3 Jul 2020)

  - add support for PIN/PIP/PRI-Q/PPS-PRI-Q signals, add     senderConfusesPIN feature, and utilize PIN for rare     conditions where it may be helpful (2, 6, 13-14 Jul     2020)

  - add senderConfusesRTN feature (25-26 Jun 2020)

  - add MissedPageHandling feature (24 Jun 2020)

  - use and handle CFR in Phase D to retransmit Phase C (16,     23 Jun 2020)

  - cope with hearing echo of RR, CTC during Class 1 sending     (15-17 Jun 2020)

  - fix listening for retransmission of MPS/EOP/EOM if it     was received corrupt on the first attempt (15 Jun 2020)

  - don't use CRP when receiving PPS/PPM as some senders     think we are sending MCF (12 Jun 2020)

  - add BR_SSLFAX to show SSL Fax in notify and faxinfo     output (1 Jun 2020)

  - have faxinfo put units on non-standard page dimensions     (28 May 2020)

  - improve error messages for JobHost connection errors (22     May 2020)

  - fix perpetual blocking of jobs when a job preparation     fails, attempt to fix similar blocking problems for bad     jobs in batches, and add 'unblock' faxconfig feature (21     May 2020)

  - ignore TCF if we're receiving an SSL Fax (31 Jan 2020)

  - fixes for build on FreeBSD 12.1 (31 Jan - 3 Feb 2020)

update to 7.0.3

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202007-06 (HylaFAX: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in HylaFAX. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
259878	Linux Distros Unpatched Vulnerability : CVE-2020-15397	Nessus	Misc.	high
404918	Alpine: multiple hylafaxplus packages: security update to 7.0.2-r2	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404918	Alpine: multiple hylafaxplus packages: security update to 7.0.2-r2	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
404917	Alpine: multiple hylafaxplus packages: security update to 7.0.1-r2	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404917	Alpine: multiple hylafaxplus packages: security update to 7.0.1-r2	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
404916	Alpine: multiple hylafaxplus packages: security update to 7.0.0-r4	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404916	Alpine: multiple hylafaxplus packages: security update to 7.0.0-r4	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
404915	Alpine: multiple hylafaxplus packages: security update to 7.0.0-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404915	Alpine: multiple hylafaxplus packages: security update to 7.0.0-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400353	Alpine: multiple hylafax packages: security update to 7.0.2-r1 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400353	Alpine: multiple hylafax packages: security update to 7.0.2-r1 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
139653	openSUSE Security Update : hylafax+ (openSUSE-2020-1210)	Nessus	SuSE Local Security Checks	high
139652	openSUSE Security Update : hylafax+ (openSUSE-2020-1209)	Nessus	SuSE Local Security Checks	high
139555	Fedora 31 : hylafax+ (2020-8aa8793d25)	Nessus	Fedora Local Security Checks	high
139554	Fedora 32 : hylafax+ (2020-01eb48bcce)	Nessus	Fedora Local Security Checks	high
138929	GLSA-202007-06 : HylaFAX: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2020-15397

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high