This update for systemd fixes the following issues :

Security issues fixed :

  - CVE-2018-6954: Fixed a vulnerability in the symlink     handling of systemd-tmpfiles which allowed a local user     to obtain ownership of arbitrary files (bsc#1080919).

  - CVE-2019-3842: Fixed a vulnerability in pam_systemd     which allowed a local user to escalate privileges     (bsc#1132348).

  - CVE-2019-6454: Fixed a denial of service caused by long     dbus messages (bsc#1125352).

Non-security issues fixed :

  - systemd-coredump: generate a stack trace of all core     dumps (jsc#SLE-5933)

  - udevd: notify when max number value of children is     reached only once per batch of events (bsc#1132400)

  - sd-bus: bump message queue size again (bsc#1132721)

  - core: only watch processes when it's really necessary     (bsc#955942 bsc#1128657)

  - rules: load drivers only on 'add' events (bsc#1126056)

  - sysctl: Don't pass null directive argument to '%s'     (bsc#1121563)

  - Do not automatically online memory on s390x     (bsc#1127557)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3891-1 advisory.

    It was discovered that systemd incorrectly handled certain D-Bus messages. A local unprivileged attacker     could exploit this in order to crash the init process, resulting in a system denial-of-service (kernel     panic).

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-0368 advisory.

    [219-62.0.4]
    - do not create utmp update symlinks for reboot and poweroff [Orabug: 27854896]
    - OL7 udev rule for virtio net standby interface [Orabug: 28826743]
    - fix _netdev is missing for iscsi entry in /etc/fstab [Orabug: 25897792] (tony.l.lam@oracle.com)
    - set 'RemoveIPC=no' in logind.conf as default for OL7.2 [22224874]
    - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
    - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475]

    [219-62.5]
    - sd-bus: if we receive an invalid dbus message, ignore and proceeed (#1667871)

    [219-62.4]
    - Refuse dbus message paths longer than BUS_PATH_SIZE_MAX limit. (#1667870)
    - Allocate temporary strings to hold dbus paths on the heap (#1667870)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for systemd fixes the following issues :

Security vulnerability fixed :

CVE-2019-6454: Fixed a crash of PID1 by sending specially crafted D-BUS message on the system bus by an unprivileged user (bsc#1125352)

Other bug fixes and changes: journal-remote: set a limit on the number of fields in a message

journal-remote: verify entry length from header

journald: set a limit on the number of fields (1k)

journald: do not store the iovec entry for process commandline on stack

core: include Found state in device dumps

device: fix serialization and deserialization of DeviceFound

fix path in btrfs rule (#6844)

assemble multidevice btrfs volumes without external tools (#6607) (bsc#1117025)

Update systemd-system.conf.xml (bsc#1122000)

units: inform user that the default target is started after exiting from rescue or emergency mode

manager: don't skip sigchld handler for main and control pid for services (#3738)

core: Add helper functions unit_{main, control}_pid

manager: Fixing a debug printf formatting mistake (#3640)

manager: Only invoke a single sigchld per unit within a cleanup cycle (bsc#1117382)

core: update invoke_sigchld_event() to handle NULL ->sigchld_event()

sd-event: expose the event loop iteration counter via sd_event_get_iteration() (#3631)

unit: rework a bit how we keep the service fdstore from being destroyed during service restart (bsc#1122344)

core: when restarting services, don't close fds

cryptsetup: Add dependency on loopback setup to generated units

journal-gateway: use localStorage['cursor'] only when it has valid value

journal-gateway: explicitly declare local variables

analyze: actually select longest activated-time of services

sd-bus: fix implicit downcast of bitfield reported by LGTM

core: free lines after reading them (bsc#1123892)

pam_systemd: reword message about not creating a session (bsc#1111498)

pam_systemd: suppress LOG_DEBUG log messages if debugging is off (bsc#1111498)

main: improve RLIMIT_NOFILE handling (#5795) (bsc#1120658)

sd-bus: if we receive an invalid dbus message, ignore and proceeed

automount: don't pass non-blocking pipe to kernel.

units: make sure initrd-cleanup.service terminates before switching to rootfs (bsc#1123333)

units: add Wants=initrd-cleanup.service to initrd-switch-root.target (#4345) (bsc#1123333)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - systemd: Insufficient input validation in     bus_process_object() resulting in PID 1 crash     (CVE-2019-6454)

This update for systemd fixes the following issues :

Security vulnerability fixed :

  - CVE-2019-6454: Fixed a crash of PID1 by sending     specially crafted D-BUS message on the system bus by an     unprivileged user (bsc#1125352)

Other bug fixes and changes :

  - journal-remote: set a limit on the number of fields in a     message

  - journal-remote: verify entry length from header

  - journald: set a limit on the number of fields (1k)

  - journald: do not store the iovec entry for process     commandline on stack

  - core: include Found state in device dumps

  - device: fix serialization and deserialization of     DeviceFound

  - fix path in btrfs rule (#6844)

  - assemble multidevice btrfs volumes without external     tools (#6607) (bsc#1117025)

  - Update systemd-system.conf.xml (bsc#1122000)

  - units: inform user that the default target is started     after exiting from rescue or emergency mode

  - manager: don't skip sigchld handler for main and control     pid for services (#3738)

  - core: Add helper functions unit_(main, control)_pid

  - manager: Fixing a debug printf formatting mistake     (#3640)

  - manager: Only invoke a single sigchld per unit within a     cleanup cycle (bsc#1117382)

  - core: update invoke_sigchld_event() to handle NULL
    ->sigchld_event()

  - sd-event: expose the event loop iteration counter via     sd_event_get_iteration() (#3631)

  - unit: rework a bit how we keep the service fdstore from     being destroyed during service restart (bsc#1122344)

  - core: when restarting services, don't close fds

  - cryptsetup: Add dependency on loopback setup to     generated units

  - journal-gateway: use localStorage['cursor'] only when it     has valid value

  - journal-gateway: explicitly declare local variables

  - analyze: actually select longest activated-time of     services

  - sd-bus: fix implicit downcast of bitfield reported by     LGTM

  - core: free lines after reading them (bsc#1123892)

  - pam_systemd: reword message about not creating a session     (bsc#1111498)

  - pam_systemd: suppress LOG_DEBUG log messages if     debugging is off (bsc#1111498)

  - main: improve RLIMIT_NOFILE handling (#5795)     (bsc#1120658)

  - sd-bus: if we receive an invalid dbus message, ignore     and proceeed

  - automount: don't pass non-blocking pipe to kernel.

  - units: make sure initrd-cleanup.service terminates     before switching to rootfs (bsc#1123333)

  - units: add Wants=initrd-cleanup.service to     initrd-switch-root.target (#4345) (bsc#1123333)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

- Properly validate dbus paths received over dbus     (#1678394, CVE-2019-6454)

  - systemd-networkd fixes: keep bond slave up if already     attached, keep existing ip addresses and routes

No need to log out or reboot.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:0461 advisory.

    The RHV-M Virtual Appliance automates the process of installing and configuring the Red Hat Virtualization     Manager. The appliance is available to download as an OVA file from the Customer Portal.

    The following packages have been upgraded to a later upstream version: rhvm-appliance (4.2). (BZ#1679415)

    Security Fix(es):

    * systemd: Insufficient input validation in bus_process_object() resulting in PID 1 crash (CVE-2019-6454)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the systemd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - It was discovered that systemd allocates a buffer large     enough to store the path field of a dbus message     without performing enough checks. A local attacker may     trigger this flaw by sending a dbus message to systemd     with a large path making systemd crash or possibly     elevating his privileges.i1/4^CVE-2019-6454i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0990 advisory.

    The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and     LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for     starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups.
    In addition, it supports snapshotting and restoring of the system state, maintains mount and automount     points, and implements an elaborate transactional dependency-based service control logic. It can also work     as a drop-in replacement for sysvinit.

    Security Fix(es):

    * systemd: Insufficient input validation in bus_process_object() resulting in PID 1 crash (CVE-2019-6454)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * [PATCH] bus-socket: Fix line_begins() to accept word matching full (BZ#1693578)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1322 advisory.

    The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and     LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for     starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups.
    In addition, it supports snapshotting and restoring of the system state, maintains mount and automount     points, and implements an elaborate transactional dependency-based service control logic. It can also work     as a drop-in replacement for sysvinit.

    Security Fix(es):

    * systemd: Insufficient input validation in bus_process_object() resulting in PID 1 crash (CVE-2019-6454)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * systemd segfaults running test case https://github.com/systemd/systemd-fedora-ci/tree/master/issue-1981     (BZ#1711872)

    * Race between systemctl start (and likely others) vs systemctl daemon-reload (BZ#1711875)

    * systemd doesn't delete stub unit files created for session scopes (BZ#1711876)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-0990 advisory.

    [239-13.0.1.3]
    - fix _netdev is missing for iscsi entry in /etc/fstab (tony.l.lam@oracle.com) [Orabug: 25897792]
    - set RemoveIPC=no in logind.conf as default for OL7.2 [Orabug: 22224874]
    - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
    - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475]

    [239-13.3]
    - rebuilt

    [239-13.2]
    - Refuse dbus message paths longer than BUS_PATH_SIZE_MAX limit. (#1678641)
    - Allocate temporary strings to hold dbus paths on the heap (#1678641)
    - sd-bus: if we receive an invalid dbus message, ignore and proceeed (#1678641)

    [239-13.1]
    - bus-socket: Fix line_begins() to accept word matching full string (#1692991)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
125453	openSUSE Security Update : systemd (openSUSE-2019-1450)	Nessus	SuSE Local Security Checks	2019/5/28	2024/5/20	high
122314	Ubuntu 16.04 LTS / 18.04 LTS : systemd vulnerability (USN-3891-1)	Nessus	Ubuntu Local Security Checks	2019/2/19	2024/8/27	medium
122325	Oracle Linux 7 : systemd (ELSA-2019-0368)	Nessus	Oracle Linux Local Security Checks	2019/2/20	2024/11/1	medium
122340	SUSE SLED12 / SLES12 Security Update : systemd (SUSE-SU-2019:0428-1)	Nessus	SuSE Local Security Checks	2019/2/20	2024/6/19	medium
122392	Scientific Linux Security Update : systemd on SL7.x x86_64 (20190221)	Nessus	Scientific Linux Local Security Checks	2019/2/22	2024/6/18	medium
122529	openSUSE Security Update : systemd (openSUSE-2019-268)	Nessus	SuSE Local Security Checks	2019/3/1	2024/6/18	medium
122725	Fedora 28 : systemd (2019-2dab60e288)	Nessus	Fedora Local Security Checks	2019/3/11	2024/6/14	medium
122739	RHEL 7 : rhvm-appliance (RHSA-2019:0461)	Nessus	Red Hat Local Security Checks	2019/3/11	2024/11/6	medium
123724	EulerOS Virtualization 2.5.3 : systemd (EulerOS-SA-2019-1256)	Nessus	Huawei Local Security Checks	2019/4/4	2024/6/5	medium
124672	RHEL 8 : systemd (RHSA-2019:0990)	Nessus	Red Hat Local Security Checks	2019/5/7	2024/11/6	medium
125712	RHEL 7 : systemd (RHSA-2019:1322)	Nessus	Red Hat Local Security Checks	2019/6/5	2024/11/6	medium
127575	Oracle Linux 8 : systemd (ELSA-2019-0990)	Nessus	Oracle Linux Local Security Checks	2019/8/12	2024/11/1	medium

検出

プラグインの検索

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium