EulerOS Virtualization 2.9.1 emacs vulnerabilit
Reporter | Title | Published | Views | Family All 121 |
---|---|---|---|---|
![]() | EulerOS Virtualization 2.9.0 : emacs (EulerOS-SA-2023-1669) | 27 Apr 202300:00 | – | nessus |
![]() | EulerOS 2.0 SP11 : emacs (EulerOS-SA-2023-1582) | 24 Mar 202300:00 | – | nessus |
![]() | Oracle Linux 9 : emacs (ELSA-2023-2366) | 15 May 202300:00 | – | nessus |
![]() | FreeBSD : emacs -- arbitary shell command execution vulnerability of ctags (76e2fcce-92d2-11ed-a635-080027f5fec9) | 13 Jan 202300:00 | – | nessus |
![]() | Slackware Linux 15.0 / current emacs Vulnerability (SSA:2022-342-01) | 9 Dec 202200:00 | – | nessus |
![]() | Debian DSA-5314-1 : emacs - security update | 12 Jan 202300:00 | – | nessus |
![]() | SUSE SLES12 Security Update : emacs (SUSE-SU-2022:4305-1) | 2 Dec 202200:00 | – | nessus |
![]() | Fedora 37 : emacs (2022-d69c7f95a4) | 14 Nov 202400:00 | – | nessus |
![]() | Amazon Linux 2 : emacs, emacs-common, emacs-devel (ALAS-2023-1928) | 6 Feb 202300:00 | – | nessus |
![]() | AlmaLinux 8 : emacs (ALSA-2023:3042) | 20 May 202300:00 | – | nessus |
Source | Link |
---|---|
cve | www.cve.mitre.org/cgi-bin/cvename.cgi |
nessus | www.nessus.org/u |
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
include('compat.inc');
if (description)
{
script_id(174865);
script_version("1.0");
script_set_attribute(attribute:"plugin_modification_date", value:"2023/04/27");
script_cve_id("CVE-2022-45939");
script_name(english:"EulerOS Virtualization 2.9.1 : emacs (EulerOS-SA-2023-1635)");
script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS Virtualization host is missing a security update.");
script_set_attribute(attribute:"description", value:
"According to the versions of the emacs package installed, the EulerOS Virtualization installation on the remote host is
affected by the following vulnerabilities :
- GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a
source-code file, because lib-src/etags.c uses the system C library function in its implementation of the
ctags program. For example, a victim may use the 'ctags *' command (suggested in the ctags documentation)
in a situation where the current working directory has contents that depend on untrusted input.
(CVE-2022-45939)
Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security
advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional
issues.");
# https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2023-1635
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1cb8cf2f");
script_set_attribute(attribute:"solution", value:
"Update the affected emacs packages.");
script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-45939");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"vuln_publication_date", value:"2022/11/28");
script_set_attribute(attribute:"patch_publication_date", value:"2023/04/27");
script_set_attribute(attribute:"plugin_publication_date", value:"2023/04/27");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:emacs-filesystem");
script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:uvp:2.9.1");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Huawei Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/uvp_version");
exit(0);
}
include("rpm.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (uvp != "2.9.1") audit(AUDIT_OS_NOT, "EulerOS Virtualization 2.9.1");
if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
var flag = 0;
var pkgs = [
"emacs-filesystem-26.1-13.h6.eulerosv2r9"
];
foreach (var pkg in pkgs)
if (rpm_check(release:"EulerOS-2.0", reference:pkg)) flag++;
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : rpm_report_get()
);
exit(0);
}
else
{
var tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, "emacs");
}
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo