PT-2017-8490 · Red Hat+1 · Setroubleshoot+2

Tomas Hoger · Published 2016-06-21 · Updated 2017-04-17 · CVE-2016-4445

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions setroubleshoot versions prior to 3.2.23

Description The issue allows local users to execute arbitrary commands as root by triggering an SELinux denial with a crafted file name. This is related to executing external commands with the commands.getstatusoutput function in the fix lookup id function in sealert.

Recommendations For versions prior to 3.2.23, update to version 3.2.23 or later to resolve the issue. As a temporary workaround, consider restricting the use of the fix lookup id function in sealert until a patch is available.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CESA-2016_1267

CVE-2016-4445

RHSA-2016:1267

RHSA-2016_1267

Affected Products

Centos

Red Hat

Setroubleshoot

References · 9

• 🔥 http://seclists.org/oss-sec/2016/q2/575 · Exploit
• https://github.com/fedora-selinux/setroubleshoot/commit/2d12677629ca319310f6263688bb1b7f676c01b7 · Patch
• https://rhn.redhat.com/errata/RHSA-2016-1267.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4445 · Security Note
• https://linux.oracle.com/errata/ELSA-2016-1267.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-4445 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1339183 · Note
• http://securitytracker.com/id/1036144 · Note
• http://securityfocus.com/bid/91430 · Note