AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE. An attacker can craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and/or tamper with the log output. A local user might exploit this to bypass the AIDE detection of malicious files. Additionally the output of extended attribute key names and symbolic links targets are also not properly neutralized. This issue has been patched in version 0.19.2. A workaround involves configuring AIDE to write the report output to a regular file, redirecting stdout to a regular file, or redirecting the log output written to stderr to a regular file.

redhat RHSA-2025:14980: RHSA-2025:14980: aide security update (Important)

redhat RHSA-2025:14981: RHSA-2025:14981: aide security update (Important)

redhat RHSA-2025:14982: RHSA-2025:14982: aide security update (Important)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:15039 advisory.

    Advanced Intrusion Detection Environment (AIDE) is a utility that creates a database of files on the     system, and then uses that database to ensure file integrity and detect system intrusions.

    Security Fix(es):

    * aide: improper output neutralization enables bypassing (CVE-2025-54389)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:15038 advisory.

    Advanced Intrusion Detection Environment (AIDE) is a utility that creates a database of files on the     system, and then uses that database to ensure file integrity and detect system intrusions.

    Security Fix(es):

    * aide: improper output neutralization enables bypassing (CVE-2025-54389)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:15058 advisory.

    Advanced Intrusion Detection Environment (AIDE) is a utility that creates a database of files on the     system, and then uses that database to ensure file integrity and detect system intrusions.

    Security Fix(es):

    * aide: improper output neutralization enables bypassing (CVE-2025-54389)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0148 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-54389:
    AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output     neutralization vulnerability in AIDE.  An attacker can craft a malicious filename by including terminal     escape sequences to hide the addition or removal of the file from the report and/or tamper with the log     output. A local user might exploit this to bypass the AIDE detection of malicious files. Additionally the     output of extended attribute key names and symbolic links targets are also not properly neutralized. This     issue has been patched in version 0.19.2. A workaround involves configuring AIDE to write the report     output to a regular file, redirecting stdout to a regular file, or redirecting the log output written to     stderr to a regular file.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output     neutralization vulnerability in AIDE. An attacker can craft a malicious filename by including terminal     escape sequences to hide the addition or removal of the file from the report and/or tamper with the log     output. A local user might exploit this to bypass the AIDE detection of malicious files. Additionally the     output of extended attribute key names and symbolic links targets are also not properly neutralized. This     issue has been patched in version 0.19.2. A workaround involves configuring AIDE to write the report     output to a regular file, redirecting stdout to a regular file, or redirecting the log output written to     stderr to a regular file. (CVE-2025-54389)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2025:14573 advisory.

    * aide: improper output neutralization enables bypassing (CVE-2025-54389)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2025:14493 advisory.

    * aide: improper output neutralization enables bypassing (CVE-2025-54389)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-14592 advisory.

    [0.18.6-8.2]
    - aide: improper output neutralization enables bypassing (CVE-2025-54389)     Resolves: rhbz#2388019

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-14573 advisory.

    [0.16.15.2]
    - CVE-2025-54389 aide: improper output neutralization enables bypassing       resolves: RHEL-109907

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:14573 advisory.

    Advanced Intrusion Detection Environment (AIDE) is a utility that creates a database of files on the     system, and then uses that database to ensure file integrity and detect system intrusions.

    Security Fix(es):

    * aide: improper output neutralization enables bypassing (CVE-2025-54389)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:14592 advisory.

    Advanced Intrusion Detection Environment (AIDE) is a utility that creates a database of files on the     system, and then uses that database to ensure file integrity and detect system intrusions.

    Security Fix(es):

    * aide: improper output neutralization enables bypassing (CVE-2025-54389)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-14493 advisory.

    [0.16-103.2]     RHEL 9.6.Z ERRATUM
    - CVE-2025-54389 aide: improper output neutralization enables bypassing     Resolves: RHEL-109910

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:14493 advisory.

    Advanced Intrusion Detection Environment (AIDE) is a utility that creates a database of files on the     system, and then uses that database to ensure file integrity and detect system intrusions.

    Security Fix(es):

    * aide: improper output neutralization enables bypassing (CVE-2025-54389)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7697-1 advisory.

    Rajesh Pangare discovered that AIDE incorrectly handled filenames. A local attacker could possibly use     this issue to bypass the detection of malicious files. (CVE-2025-54389)

    Rajesh Pangare discovered that AIDE incorrectly handled extended file attributes. A local attacker could     possibly use this issue to cause a denial of service. (CVE-2025-54409)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5977 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5977-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     August 14, 2025                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : aide     CVE ID         : CVE-2025-54389 CVE-2025-54409

    Rajesh Pangare discovered two vulnerabilities in aide, an advanced     intrusion detection system. A local attacker can take advantage of these     flaws to hide the addition or removal of a file from the the report,     tamper with the log output, or cause aide to crash during report     printing or database listing.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 0.18.3-1+deb12u4.

    For the stable distribution (trixie), these problems have been fixed in     version 0.19.1-2+deb13u1.

    We recommend that you upgrade your aide packages.

    For the detailed security status of aide please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/aide

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4272 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4272-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Thorsten Alteholz     August 14, 2025                               https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : aide     Version        : 0.17.3-4+deb11u3     CVE ID         : CVE-2025-54389 CVE-2025-54409


    Rajesh Pangare discovered two vulnerabilities in aide, an advanced     intrusion detection system. A local attacker can take advantage of these     flaws to hide the addition or removal of a file from the the report,     tamper with the log output, or cause aide to crash during report     printing or database listing.


    For Debian 11 bullseye, these problems have been fixed in version     0.17.3-4+deb11u3.

    We recommend that you upgrade your aide packages.

    For the detailed security status of aide please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/aide

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
260462	RHEL 9 : aide (RHSA-2025:15039)	Nessus	Red Hat Local Security Checks	medium
260459	RHEL 9 : aide (RHSA-2025:15038)	Nessus	Red Hat Local Security Checks	medium
260444	RHEL 8 : aide (RHSA-2025:15058)	Nessus	Red Hat Local Security Checks	medium
260182	Alibaba Cloud Linux 3 : 0148: aide (ALINUX3-SA-2025:0148)	Nessus	Alibaba Cloud Linux Local Security Checks	medium
260008	Linux Distros Unpatched Vulnerability : CVE-2025-54389	Nessus	Misc.	medium
258083	AlmaLinux 8 : aide (ALSA-2025:14573)	Nessus	Alma Linux Local Security Checks	medium
258040	AlmaLinux 9 : aide (ALSA-2025:14493)	Nessus	Alma Linux Local Security Checks	medium
255293	Oracle Linux 10 : aide (ELSA-2025-14592)	Nessus	Oracle Linux Local Security Checks	medium
255244	Oracle Linux 8 : aide (ELSA-2025-14573)	Nessus	Oracle Linux Local Security Checks	medium
255225	RHEL 8 : aide (RHSA-2025:14573)	Nessus	Red Hat Local Security Checks	medium
255221	RHEL 10 : aide (RHSA-2025:14592)	Nessus	Red Hat Local Security Checks	medium
255188	Oracle Linux 9 : aide (ELSA-2025-14493)	Nessus	Oracle Linux Local Security Checks	medium
254439	RHEL 9 : aide (RHSA-2025:14493)	Nessus	Red Hat Local Security Checks	medium
252279	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 : AIDE vulnerabilities (USN-7697-1)	Nessus	Ubuntu Local Security Checks	medium
249341	Debian dsa-5977 : aide - security update	Nessus	Debian Local Security Checks	medium
249340	Debian dla-4272 : aide - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2025-54389

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium