遠端主機受到 GLSA-202003-55 中所述的弱點影響 (Zsh：權限提升)

    據發現，取消設定 PRIVILEGED 選項時，Zsh 未以安全的方式刪除權限。
  影響：

    攻擊者可提升權限。
  因應措施：

    目前尚無已知的因應措施。

遠端 Redhat Enterprise Linux 8 主機上安裝的套件受到 RHSA-2020: 0978 公告中提及的一個弱點影響。

  - zsh：取消設定 PRIVILEGED 選項時，未以安全的方式刪除權限 (CVE-2019-20044)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2020:0903 advisory.

  - In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED     option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing     MODULE_PATH=/dir/with/module zmodload with a module that calls setuid(). (CVE-2019-20044)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2020:0903 advisory.

  - In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED     option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing     MODULE_PATH=/dir/with/module zmodload with a module that calls setuid(). (CVE-2019-20044)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0732-1 advisory.

  - In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED     option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing     MODULE_PATH=/dir/with/module zmodload with a module that calls setuid(). (CVE-2019-20044)

  - In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the     prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.
    (CVE-2021-45444)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0853 advisory.

    The zsh shell is a command interpreter usable as an interactive login shell and as a shell script command     processor. Zsh resembles the ksh shell (the Korn shell), but includes many enhancements. Zsh supports     command-line editing, built-in spelling correction, programmable command completion, shell functions (with     autoloading), a history mechanism, and more.

    Security Fix(es):

    * zsh: insecure dropping of privileges when unsetting PRIVILEGED option (CVE-2019-20044)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0892 advisory.

  - In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED     option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing     MODULE_PATH=/dir/with/module zmodload with a module that calls setuid(). (CVE-2019-20044)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-55 (Zsh: Privilege escalation)

    It was discovered that Zsh was insecure dropping privileges when       unsetting PRIVILEGED option.
  Impact :

    An attacker could escalate privileges.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0978 advisory.

    The zsh shell is a command interpreter usable as an interactive login shell and as a shell script command     processor. Zsh resembles the ksh shell (the Korn shell), but includes many enhancements. Zsh supports     command-line editing, built-in spelling correction, programmable command completion, shell functions (with     autoloading), a history mechanism, and more.

    Security Fix(es):

    * zsh: insecure dropping of privileges when unsetting PRIVILEGED option (CVE-2019-20044)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the zsh package has been released.

According to the version of the zsh package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In Zsh before 5.8, attackers able to execute commands     can regain privileges dropped by the --no-PRIVILEGED     option. Zsh fails to overwrite the saved uid, so the     original privileges can be restored by executing     MODULE_PATH=/dir/with/module zmodload with a module     that calls setuid().(CVE-2019-20044)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 4.05, has zsh packages installed that are affected by a vulnerability:

  - In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED     option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing     MODULE_PATH=/dir/with/module zmodload with a module that calls setuid(). (CVE-2019-20044)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
134930	GLSA-202003-55：Zsh：權限提升	Nessus	Gentoo Local Security Checks	3/26/2020	3/20/2024	high
134939	RHEL 8：zsh (RHSA-2020: 0978)	Nessus	Red Hat Local Security Checks	3/26/2020	11/7/2024	high
185061	Rocky Linux 8 : zsh (RLSA-2020:0903)	Nessus	Rocky Linux Local Security Checks	11/7/2023	11/7/2023	high
157578	AlmaLinux 8 : zsh (ALSA-2020:0903)	Nessus	Alma Linux Local Security Checks	2/9/2022	2/14/2022	high
158605	SUSE SLES15 Security Update : zsh (SUSE-SU-2022:0732-1)	Nessus	SuSE Local Security Checks	3/5/2022	7/14/2023	high
134672	RHEL 7 : zsh (RHSA-2020:0853)	Nessus	Red Hat Local Security Checks	3/18/2020	11/7/2024	high
134907	CentOS 6 : zsh (RHSA-2020:0892)	Nessus	CentOS Local Security Checks	3/26/2020	10/9/2024	high
134930	GLSA-202003-55 : Zsh: Privilege escalation	Nessus	Gentoo Local Security Checks	3/26/2020	3/20/2024	high
134939	RHEL 8 : zsh (RHSA-2020:0978)	Nessus	Red Hat Local Security Checks	3/26/2020	11/7/2024	high
135406	Photon OS 3.0: Zsh PHSA-2020-3.0-0073	Nessus	PhotonOS Local Security Checks	4/12/2020	8/22/2025	high
135870	Photon OS 2.0: Zsh PHSA-2020-2.0-0229	Nessus	PhotonOS Local Security Checks	4/22/2020	7/22/2024	high
140842	EulerOS 2.0 SP3 : zsh (EulerOS-SA-2020-2075)	Nessus	Huawei Local Security Checks	9/28/2020	2/19/2024	high
141407	NewStart CGSL MAIN 4.05 : zsh Vulnerability (NS-SA-2020-0051)	Nessus	NewStart CGSL Local Security Checks	10/13/2020	1/14/2021	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high

high

high