According to the versions of the sudo package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - selinux_edit_copy_tfiles in sudoedit in Sudo before     1.9.5 allows a local unprivileged user to gain file     ownership and escalate privileges by replacing a     temporary file with a symlink to an arbitrary file     target. This affects SELinux RBAC support in permissive     mode. Machines without SELinux are not     vulnerable.(CVE-2021-23240)

  - The sudoedit personality of Sudo before 1.9.5 may allow     a local unprivileged user to perform arbitrary     directory-existence tests by winning a sudo_edit.c race     condition in replacing a user-controlled directory by a     symlink to an arbitrary path.(CVE-2021-23239)

  - Sudo before 1.9.5p2 has a Heap-based Buffer Overflow,     allowing privilege escalation to root via 'sudoedit -s'     and a command-line argument that ends with a single     backslash character.(CVE-2021-3156)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the sudo package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - selinux_edit_copy_tfiles in sudoedit in Sudo before     1.9.5 allows a local unprivileged user to gain file     ownership and escalate privileges by replacing a     temporary file with a symlink to an arbitrary file     target. This affects SELinux RBAC support in permissive     mode. Machines without SELinux are not     vulnerable.(CVE-2021-23240)

  - A flaw was found in sudo. A heap-based buffer overflow     was found in the way sudo parses command line     arguments. This flaw is exploitable by any local user     who can execute the sudo command (by default, any local     user can execute sudo) without authentication.
    Successful exploitation of this flaw could lead to     privilege escalation. The highest threat from this     vulnerability is to data confidentiality and integrity     as well as system availability.(CVE-2021-3156)

  - sudo The sudoedit personality of Sudo before 1.9.5 may     allow a local unprivileged user to perform arbitrary     directory-existence tests by winning a sudo_edit.c race     condition in replacing a user-controlled directory by a     symlink to an arbitrary path.(CVE-2021-23239)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the sudo package has been released.

According to the versions of the sudo package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A race condition vulnerability was found in the     temporary file handling of sudoedit's SELinux RBAC     support. On systems where SELinux is enabled, this flaw     allows a malicious user with sudoedit permissions to     set the owner of an arbitrary file to the user ID of     the target user, potentially leading to local privilege     escalation. The highest threat from this vulnerability     is to confidentiality, integrity, as well as system     availability.(CVE-2021-23240)

  - A flaw was found in sudoedit. A race condition     vulnerability and improper symbolic link resolution     could be used by a local unprivileged user to test for     the existence of directories and files not normally     accessible to the user. This flaw cannot be used to     read the content or write to arbitrary files on the     file system. The highest threat from this vulnerability     is to data confidentiality.(CVE-2021-23239)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:1723 advisory.

    The sudo packages contain the sudo utility which allows system administrators to provide certain users     with the permission to execute privileged commands, which are used for system management purposes, without     having to log in as root.

    Security Fix(es):

    * sudo: symbolic link attack in SELinux-enabled sudoedit (CVE-2021-23240)

    * sudo: possible directory existence test due to race condition in sudoedit (CVE-2021-23239)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202101-33 (sudo: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in sudo. Please review the       CVE identifiers referenced below for details.
  Impact :

    Local users are able to gain unauthorized privileges on the system or       determine the existence of files.
  Workaround :

    There is no known workaround at this time.

This update for sudo fixes the following issues :

A Heap-based buffer overflow in sudo could be exploited to allow a user to gain root privileges [bsc#1181090,CVE-2021-3156]

It was possible for a user to test for the existence of a directory due to a Race Condition in `sudoedit` [bsc#1180684,CVE-2021-23239]

A Possible Symlink Attack vector existed in `sudoedit` if SELinux was running in permissive mode [bsc#1180685, CVE-2021-23240]

It was possible for a User to enable Debug Settings not Intended for them [bsc#1180687]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The sudoedit personality of Sudo before 1.9.5 may allow     a local unprivileged user to perform arbitrary     directory-existence tests by winning a sudo_edit.c race     condition in replacing a user-controlled directory by a     symlink to an arbitrary path.(CVE-2021-23239)

  - Sudo before 1.9.5p2 has a Heap-based Buffer Overflow,     allowing privilege escalation to root via 'sudoedit -s'     and a command-line argument that ends with a single     backslash character.(CVE-2021-3156)

  - selinux_edit_copy_tfiles in sudoedit in Sudo before     1.9.5 allows a local unprivileged user to gain file     ownership and escalate privileges by replacing a     temporary file with a symlink to an arbitrary file     target. This affects SELinux RBAC support in permissive     mode. Machines without SELinux are not     vulnerable.(CVE-2021-23240)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - selinux_edit_copy_tfiles in sudoedit in Sudo before     1.9.5 allows a local unprivileged user to gain file     ownership and escalate privileges by replacing a     temporary file with a symlink to an arbitrary file     target. This affects SELinux RBAC support in permissive     mode. Machines without SELinux are not     vulnerable.(CVE-2021-23240)

  - The sudoedit personality of Sudo before 1.9.5 may allow     a local unprivileged user to perform arbitrary     directory-existence tests by winning a sudo_edit.c race     condition in replacing a user-controlled directory by a     symlink to an arbitrary path.(CVE-2021-23239)

  - Sudo before 1.9.5p2 has a Heap-based Buffer Overflow,     allowing privilege escalation to root via 'sudoedit -s'     and a command-line argument that ends with a single     backslash character.(CVE-2021-3156)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0113 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-14287:
    In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy     blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user     ID. For example, this allows bypass of !root configuration, and USER= logging, for a sudo -u     \#$((0xffffffff)) command.

    CVE-2019-18634:
    In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer     overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS;
    however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an     administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.

    CVE-2019-19232:
    ** DISPUTED ** In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can     impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user.
    NOTE: The software maintainer believes that this is not a vulnerability because running a command via sudo     as a user not present in the local password database is an intentional feature. Because this behavior     surprised some users, sudo 1.8.30 introduced an option to enable/disable this behavior with the default     being disabled. However, this does not change the fact that sudo was behaving as intended, and as     documented, in earlier versions.

    CVE-2021-23239:
    The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary     directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory     by a symlink to an arbitrary path.

    CVE-2021-23240:
    selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file     ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file     target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable.

    CVE-2021-3156:
    Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which     allows privilege escalation to root via sudoedit -s and a command-line argument that ends with a single     backslash character.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
147107	EulerOS Virtualization 3.0.6.6 : sudo (EulerOS-SA-2021-1520)	Nessus	Huawei Local Security Checks	3/4/2021	1/18/2023	high
147471	EulerOS Virtualization for ARM 64 3.0.2.0 : sudo (EulerOS-SA-2021-1390)	Nessus	Huawei Local Security Checks	3/10/2021	1/18/2023	high
145419	Photon OS 1.0: Sudo PHSA-2021-1.0-0356	Nessus	PhotonOS Local Security Checks	1/26/2021	1/26/2024	high
148592	EulerOS Virtualization 2.9.0 : sudo (EulerOS-SA-2021-1757)	Nessus	Huawei Local Security Checks	4/15/2021	1/4/2024	high
149683	RHEL 8 : sudo (RHSA-2021:1723)	Nessus	Red Hat Local Security Checks	5/19/2021	11/7/2024	critical
145412	Photon OS 3.0: Sudo PHSA-2021-3.0-0186	Nessus	PhotonOS Local Security Checks	1/26/2021	8/22/2025	high
145477	GLSA-202101-33 : sudo: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	1/27/2021	1/12/2023	high
145479	SUSE SLES12 Security Update : sudo (SUSE-SU-2021:0225-1)	Nessus	SuSE Local Security Checks	1/27/2021	1/18/2023	high
146251	EulerOS 2.0 SP9 : sudo (EulerOS-SA-2021-1276)	Nessus	Huawei Local Security Checks	2/5/2021	1/18/2023	high
147547	EulerOS Virtualization 3.0.2.6 : sudo (EulerOS-SA-2021-1424)	Nessus	Huawei Local Security Checks	3/10/2021	1/18/2023	high
148081	EulerOS 2.0 SP5 : sudo (EulerOS-SA-2021-1707)	Nessus	Huawei Local Security Checks	3/24/2021	1/18/2023	high
236710	Alibaba Cloud Linux 3 : 0113: sudo (ALINUX3-SA-2022:0113)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	critical

Detections

Analytics

Plugins Search

high

high

high

high

critical

high

high

high

high

high

high

critical