Test Kennung:	1.3.6.1.4.1.25623.1.0.891762
Kategorie:	Debian Local Security Checks
Titel:	Debian LTS: Security Advisory for systemd (DLA-1762-1)
Zusammenfassung:	The remote host is missing an update for the 'systemd'; package(s) announced via the DLA-1762-1 advisory.
Beschreibung:	Summary: The remote host is missing an update for the 'systemd' package(s) announced via the DLA-1762-1 advisory. Vulnerability Insight: Two vulnerabilities have been addressed in the systemd components systemd-tmpfiles and pam_systemd.so. CVE-2017-18078 systemd-tmpfiles in systemd attempted to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allowed local users to bypass intended access restrictions via vectors involving a hard link to a file for which the user lacked write access. CVE-2019-3842 It was discovered that pam_systemd did not properly sanitize the environment before using the XDG_SEAT variable. It was possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allowed for commands to be checked against polkit policies using the 'allow_active' element rather than 'allow_any'. Affected Software/OS: 'systemd' package(s) on Debian Linux. Solution: For Debian 8 'Jessie', these problems have been fixed in version 215-17+deb8u12. We recommend that you upgrade your systemd packages. CVSS Score: 4.6 CVSS Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2019-3842 https://www.exploit-db.com/exploits/46743/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/STR36RJE4ZZIORMDXRERVBHMPRNRTHAC/ http://packetstormsecurity.com/files/152610/systemd-Seat-Verification-Active-Session-Spoofing.html https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E https://lists.debian.org/debian-lts-announce/2019/04/msg00022.html SuSE Security Announcement: openSUSE-SU-2019:1450 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00062.html
Copyright	Copyright (C) 2019 Greenbone Networks GmbH

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.