The version of libguestfs-winsupport installed on the remote host is prior to 7.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1522 advisory.

    An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by     running /bin/ntfs-3g with specially crafted arguments from a specially crafted directory to cause a heap     buffer overflow, resulting in a crash or the ability to execute arbitrary code. In installations where     /bin/ntfs-3g is a setuid-root binary, this could lead to a local escalation of privileges. (CVE-2019-9755)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the libguestfs-winsupport package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - This optional package adds support for Windows guests     (NTFS) to the virt-v2v and virt-p2v programs.Security     Fix(es):An integer underflow issue exists in ntfs-3g     2017.3.23. A local attacker could potentially exploit     this by running /bin/ ntfs-3g with specially crafted     arguments from a specially crafted directory to cause a     heap buffer overflow, resulting in a crash or the     ability to execute arbitrary code. In installations     where /bin/ ntfs-3g is a setuid-root binary, this could     lead to a local escalation of     privileges.(CVE-2019-9755)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for libguestfs-winsupport is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The libguestfs-winsupport package adds support for Windows guests to libguestfs, a set of tools and libraries allowing users to access and modify virtual machine (VM) disk images.

Security Fix(es) :

* ntfs-3g: heap-based buffer overflow leads to local root privilege escalation (CVE-2019-9755)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

A heap-based buffer overflow was discovered in NTFS-3G, a read-write NTFS driver for FUSE. A local user can take advantage of this flaw for local root privilege escalation.

For Debian 8 'Jessie', this problem has been fixed in version 1:2014.2.15AR.2-1+deb8u4.

We recommend that you upgrade your ntfs-3g packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A heap-based buffer overflow was discovered in NTFS-3G, a read-write NTFS driver for FUSE. A local user can take advantage of this flaw for local root privilege escalation.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-3345 advisory.

  - tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an     snprintf call, leading to Information disclosure. (CVE-2019-9824)

  - interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.
    (CVE-2019-12155)

  - An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by     running /bin/ntfs-3g with specially crafted arguments from a specially crafted directory to cause a heap     buffer overflow, resulting in a crash or the ability to execute arbitrary code. In installations where     /bin/ntfs-3g is a setuid-root binary, this could lead to a local escalation of privileges. (CVE-2019-9755)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0074 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-12155:
    interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.

    CVE-2019-9755:
    An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by     running /bin/ntfs-3g with specially crafted arguments from a specially crafted directory to cause a heap     buffer overflow, resulting in a crash or the ability to execute arbitrary code. In installations where     /bin/ntfs-3g is a setuid-root binary, this could lead to a local escalation of privileges.

    CVE-2019-9824:
    tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an     snprintf call, leading to Information disclosure.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
141945	Amazon Linux 2 : libguestfs-winsupport (ALAS-2020-1522)	Nessus	Amazon Linux Local Security Checks	2020/10/27	2024/12/11	high
137464	EulerOS 2.0 SP2 : libguestfs-winsupport (EulerOS-SA-2020-1622)	Nessus	Huawei Local Security Checks	2020/6/17	2024/3/7	high
128389	CentOS 7 : libguestfs-winsupport (CESA-2019:2308)	Nessus	CentOS Local Security Checks	2019/8/30	2019/12/31	high
123018	Debian DLA-1724-1 : ntfs-3g security update	Nessus	Debian Local Security Checks	2019/3/25	2024/6/13	high
123023	Debian DSA-4413-1 : ntfs-3g - security update	Nessus	Debian Local Security Checks	2019/3/25	2024/6/13	high
180806	Oracle Linux 8 : virt:ol (ELSA-2019-3345)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/11/1	high
236501	Alibaba Cloud Linux 3 : 0074: virt:rhel (ALINUX3-SA-2022:0074)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high

検出

プラグインの検索

high

high

high

high

high

high

high