The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2016-1155:03 advisory.

    Sudo (superuser do) allows a system administrator to give certain     users (or groups of users) the ability to run some (or all) commands     as root while logging all commands and arguments. Sudo operates on a     per-command basis.  It is not a replacement for the shell.  Features     include: the ability to restrict what commands a user may run on a     per-host basis, copious logging of each command (providing a clear     audit trail of who did what), a configurable timeout of the sudo     command, and the ability to use the same configuration file (sudoers)     on many different machines.
    Security issues fixed with this release:
    CVE-2016-7032
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-7076
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2016-1156:02 advisory.

    Sudo (superuser do) allows a system administrator to give certain     users (or groups of users) the ability to run some (or all) commands     as root while logging all commands and arguments. Sudo operates on a     per-command basis.  It is not a replacement for the shell.  Features     include: the ability to restrict what commands a user may run on a     per-host basis, copious logging of each command (providing a clear     audit trail of who did what), a configurable timeout of the sudo     command, and the ability to use the same configuration file (sudoers)     on many different machines.
    Security issues fixed with this release:
    CVE-2016-7032
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-7076
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for sudo is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.

Security Fix(es) :

* It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed system(), popen(), or wordexp() C library functions with a user-supplied argument. A local user permitted to run such application via sudo with noexec restriction could use these flaws to execute arbitrary commands with elevated privileges. (CVE-2016-7032, CVE-2016-7076)

These issues were discovered by Florian Weimer (Red Hat).

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sudo fixes the following issues :

  - fix two security vulnerabilities that allowed users to     bypass sudo's NOEXEC functionality :

  - noexec bypass via system() and popen() [CVE-2016-7032,     bsc#1007766]

  - noexec bypass via wordexp() [CVE-2016-7076, bsc#1007501]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2872 advisory.

    [1.8.6p3-25]
    - Update noexec syscall blacklist
    - Fixes CVE-2016-7032 and CVE-2016-7076       Resolves: rhbz#1391937

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Update noexec syscall blacklist

  - Fixes (CVE-2016-7032, CVE-2016-7076) Resolves:
    rhbz#1391937

  - RHEL-6.8 erratum

  - fixed a bug causing that non-root users can list     privileges of other users Resolves: rhbz#1312481

  - RHEL-6.8 erratum

  - fixed handling of closefrom_override defaults option     Resolves: rhbz#1309976

  - RHEL-6.8 erratum

  - fixed potential getcwd failure, resulting in Null     pointer exception Resolves: rhbz#1284886

  - RHEL-6.8 erratum

  - fixed sssd's detection of user with zero rules Resolves:
    rhbz#1220480

  - RHEL-6.8 erratum

  - search also by user id when fetching rules from LDAP     Resolves: rhbz#1135531

  - RHEL-6.8 erratum

  - fixed ldap's and sssd's sudoOption value and remove     quotes

  - fixed ldap's and sssd's sudoOption whitespaces parse     problem Resolves: rhbz#1144422 Resolves: rhbz#1279447

  - RHEL-6.8 erratum

  - removed defaults option requiretty from /etc/sudoers

  - backported pam_service and pam_login_service defaults     options

  - implemented a new defaults option for changing netgroup     processing semantics

  - fixed visudo's quiet cli option Resolves: rhbz#1248695     Resolves: rhbz#1247231 Resolves: rhbz#1241896 Resolves:
    rhbz#1197885 Resolves: rhbz#1233205

  - added patch to re-introduce old group processing     behaviour Resolves: rhbz#1075836

It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed system() or popen() C library functions with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could use this flaw to execute arbitrary commands with elevated privileges. (CVE-2016-7032)

It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges.
(CVE-2016-7076)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fixes (CVE-2017-1000367) Resolves: rhbz#1455399

  - Update noexec syscall blacklist

  - Fixes (CVE-2016-7032, CVE-2016-7076) Resolves:
    rhbz#1391938

  - RHEL-6.9 erratum

  - Fix race condition when creating /var/log/sudo-io     direcotry Resolves: rhbz#1365156

ID	名前	製品	ファミリー	公開日	更新日	深刻度
289103	MiracleLinux 7 : sudo-1.8.6p7-21.el7 (AXSA:2016-1155:03)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
289613	MiracleLinux 4 : sudo-1.8.6p3-25.AXS4 (AXSA:2016-1156:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
101533	Virtuozzo 7 : sudo / sudo-devel (VZLSA-2016-2872)	Nessus	Virtuozzo Local Security Checks	2017/7/14	2025/12/11	high
95313	SUSE SLED12 / SLES12 Security Update : sudo (SUSE-SU-2016:2893-1)	Nessus	SuSE Local Security Checks	2016/11/25	2026/1/16	high
95598	Oracle Linux 6 / 7 : sudo (ELSA-2016-2872)	Nessus	Oracle Linux Local Security Checks	2016/12/7	2025/4/29	high
95599	OracleVM 3.3 / 3.4 : sudo (OVMSA-2016-0170)	Nessus	OracleVM Local Security Checks	2016/12/7	2026/1/15	high
96282	Amazon Linux AMI : sudo (ALAS-2017-780)	Nessus	Amazon Linux Local Security Checks	2017/1/5	2026/1/6	high
100530	OracleVM 3.3 / 3.4 : sudo (OVMSA-2017-0110)	Nessus	OracleVM Local Security Checks	2017/5/31	2025/12/17	high

検出

プラグインの検索

high

high

high

high

high

high

high

high