NewStart CGSL MAIN 6.06 : systemd Multiple Vulnerabilities (NS-SA-2025-0220)

high Nessus Plugin ID 266232

Synopsis

The remote NewStart CGSL host is affected by multiple vulnerabilities.

Description

The remote NewStart CGSL host, running version MAIN 6.06, has systemd packages installed that are affected by multiple vulnerabilities:

- A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages. (CVE-2020-1712)

- systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors involving creation of a directory and a file under that directory, and later replacing that directory with a symlink. This occurs even if the fs.protected_symlinks sysctl is turned on. (CVE-2018-6954)

- systemd-resolved through 233 allows remote attackers to cause a denial of service (daemon crash) via a crafted DNS response with an empty question section. (CVE-2017-9217)

- In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it. (CVE-2017-9445)

- A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239.
(CVE-2018-15686)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the vulnerable CGSL systemd packages. Note that updated packages may not be available yet. Please contact ZTE for more information.

Plugin Details

Severity: High

ID: 266232

File Name: newstart_cgsl_NS-SA-2025-0220_systemd.nasl

Version: 1.1

Type: local

Family: NewStart CGSL Local Security Checks

Published: 9/30/2025

Updated: 9/30/2025

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2018-6954

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2020-1712

Vulnerability Information

CPE: p-cpe:/a:zte:cgsl_main:systemd-pam, p-cpe:/a:zte:cgsl_main:systemd-container, p-cpe:/a:zte:cgsl_main:systemd-libs, cpe:/o:zte:cgsl_main:6, p-cpe:/a:zte:cgsl_main:systemd-devel, p-cpe:/a:zte:cgsl_main:systemd-udev, p-cpe:/a:zte:cgsl_main:systemd

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/ZTE-CGSL/release, Host/ZTE-CGSL/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/30/2025

Vulnerability Publication Date: 5/24/2017

Reference Information

CVE: CVE-2017-9217, CVE-2017-9445, CVE-2018-15686, CVE-2018-6954, CVE-2020-1712

Detections

Analytics