CentOS 6 / 7 : policycoreutils (CESA-2016:2702)
High Nessus Plugin ID 94978
SynopsisThe remote CentOS host is missing one or more security updates.
DescriptionAn update for policycoreutils is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
The policycoreutils packages contain the core policy utilities required to manage a SELinux environment.
Security Fix(es) :
* It was found that the sandbox tool provided in policycoreutils was vulnerable to a TIOCSTI ioctl attack. A specially crafted program executed via the sandbox command could use this flaw to execute arbitrary commands in the context of the parent shell, escaping the sandbox. (CVE-2016-7545)
SolutionUpdate the affected policycoreutils packages.