Huawei EulerOS 'sysstat' package version 12.5.4 on 32 bit systems prior to 12.7.1 allows for a size_t overflow, leading to Remote Code Execution (RCE) (CVE-2022-39377)
Reporter | Title | Published | Views | Family All 150 |
---|---|---|---|---|
OSV | Moderate: sysstat security and bug fix update | 9 May 202300:00 | – | osv |
OSV | sysstat vulnerability | 22 Nov 202221:04 | – | osv |
OSV | CVE-2022-39377 | 8 Nov 202220:15 | – | osv |
OSV | Red Hat Security Advisory: sysstat security and bug fix update | 16 Sep 202409:44 | – | osv |
OSV | sysstat vulnerability | 29 Nov 202215:16 | – | osv |
OSV | Moderate: sysstat security and bug fix update | 16 May 202300:00 | – | osv |
OSV | Red Hat Security Advisory: sysstat security and bug fix update | 16 Sep 202409:44 | – | osv |
OSV | sysstat vulnerabilities | 7 Jun 202313:37 | – | osv |
OSV | CVE-2023-33204 | 18 May 202308:15 | – | osv |
OSV | sysstat - security update | 14 Nov 202200:00 | – | osv |
Source | Link |
---|---|
developer | www.developer.huaweicloud.com/intl/en-us/euleros/securitydetail.html |
# SPDX-FileCopyrightText: 2023 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only
if(description)
{
script_oid("1.3.6.1.4.1.25623.1.1.2.2023.2100");
script_cve_id("CVE-2022-39377");
script_tag(name:"creation_date", value:"2023-06-07 04:14:30 +0000 (Wed, 07 Jun 2023)");
script_version("2024-02-05T14:36:57+0000");
script_tag(name:"last_modification", value:"2024-02-05 14:36:57 +0000 (Mon, 05 Feb 2024)");
script_tag(name:"cvss_base", value:"7.2");
script_tag(name:"cvss_base_vector", value:"AV:L/AC:L/Au:N/C:C/I:C/A:C");
script_tag(name:"severity_vector", value:"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
script_tag(name:"severity_origin", value:"NVD");
script_tag(name:"severity_date", value:"2023-02-01 19:15:58 +0000 (Wed, 01 Feb 2023)");
script_name("Huawei EulerOS: Security Advisory for sysstat (EulerOS-SA-2023-2100)");
script_category(ACT_GATHER_INFO);
script_copyright("Copyright (C) 2023 Greenbone AG");
script_family("Huawei EulerOS Local Security Checks");
script_dependencies("gb_huawei_euleros_consolidation.nasl");
script_mandatory_keys("ssh/login/euleros", "ssh/login/rpms", re:"ssh/login/release=EULEROSVIRT\-2\.11\.0");
script_xref(name:"Advisory-ID", value:"EulerOS-SA-2023-2100");
script_xref(name:"URL", value:"https://developer.huaweicloud.com/intl/en-us/euleros/securitydetail.html?secId=EulerOS-SA-2023-2100");
script_tag(name:"summary", value:"The remote host is missing an update for the Huawei EulerOS 'sysstat' package(s) announced via the EulerOS-SA-2023-2100 advisory.");
script_tag(name:"vuldetect", value:"Checks if a vulnerable package version is present on the target host.");
script_tag(name:"insight", value:"sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocate_structures contains a size_t overflow in sa_common.c. The allocate_structures function insufficiently checks bounds before arithmetic multiplication, allowing for an overflow in the size allocated for the buffer representing system activities. This issue may lead to Remote Code Execution (RCE). This issue has been patched in version 12.7.1.(CVE-2022-39377)");
script_tag(name:"affected", value:"'sysstat' package(s) on Huawei EulerOS Virtualization release 2.11.0.");
script_tag(name:"solution", value:"Please install the updated package(s).");
script_tag(name:"solution_type", value:"VendorFix");
script_tag(name:"qod_type", value:"package");
exit(0);
}
include("revisions-lib.inc");
include("pkg-lib-rpm.inc");
release = rpm_get_ssh_release();
if(!release)
exit(0);
res = "";
report = "";
if(release == "EULEROSVIRT-2.11.0") {
if(!isnull(res = isrpmvuln(pkg:"sysstat", rpm:"sysstat~12.5.4~1.h4.eulerosv2r11", rls:"EULEROSVIRT-2.11.0"))) {
report += res;
}
if(report != "") {
security_message(data:report);
} else if(__pkg_match) {
exit(99);
}
exit(0);
}
exit(0);
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo