The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2015-743:01 advisory.

    A set of commands to use the XFS filesystem, including mkfs.xfs.
    XFS is a high performance journaling filesystem which originated     on the SGI IRIX platform.  It is completely multi-threaded, can     support large files and large filesystems, extended attributes,     variable block sizes, is extent based, and makes extensive use of     Btrees (directories, extents, free space) to aid both performance     and scalability.
    Refer to the documentation at http://oss.sgi.com/projects/xfs/     for complete details.  This implementation is on-disk compatible     with the IRIX version of XFS.
    Security issues fixed with this release:
    CVE-2012-2150     xfs_metadump in xfsprogs before 3.2.4 does not properly obfuscate file     data, which allows remote attackers to obtain sensitive information by     reading a generated image.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Gabriel Vlasiu reported that xfs_metadump, part of the xfsprogs suite of tools for the XFS filesystem, did not properly obfuscate data.
xfs_metadump properly obfuscates active metadata, but the rest of the space within that fs block comes through in the clear. This could lead to exposure of stale disk data via the produced metadump image.

The expectation of xfs_metadump is to obfuscate all but the shortest names in the metadata, as noted in the manpage :

By default, xfs_metadump obfuscates most file (regular file, directory and symbolic link) names and extended attribute names to allow the dumps to be sent without revealing confidential information. Extended attribute values are zeroed and no data is copied. The only exceptions are file or attribute names that are 4 or less characters in length.
Also file names that span extents (this can only occur with the mkfs.xfs(8) options where -n size > -b size) are not obfuscated. Names between 5 and 8 characters in length inclusively are partially obfuscated.

While the xfs_metadump tool can be run by unprivileged users, it requires appropriate permissions to access block devices (such as root) where the sensitive data might be dumped. An unprivileged user, without access to the block device, could not use this flaw to obtain sensitive data they would not otherwise have permission to access.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the xfs_metadump tool of the xfsprogs suite did not fully adhere to the standards of obfuscation described in its man page. In case a user with the necessary privileges used xfs_metadump and relied on the advertised obfuscation, the generated data could contain unexpected traces of potentially sensitive information.

The remote NewStart CGSL host, running version MAIN 6.06 (SP), has xfsprogs packages installed that are affected by a vulnerability:

  - xfs_metadump in xfsprogs before 3.2.4 does not properly obfuscate file data, which allows remote attackers     to obtain sensitive information by reading a generated image. (CVE-2012-2150)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated xfsprogs packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The xfsprogs packages contain a set of commands to use the XFS file system, including the mkfs.xfs command to construct an XFS system.

It was discovered that the xfs_metadump tool of the xfsprogs suite did not fully adhere to the standards of obfuscation described in its man page. In case a user with the necessary privileges used xfs_metadump and relied on the advertised obfuscation, the generated data could contain unexpected traces of potentially sensitive information.
(CVE-2012-2150)

The xfsprogs packages have been upgraded to upstream version 3.2.2, which provides a number of bug fixes and enhancements over the previous version. This release also includes updates present in upstream version 3.2.3, although it omits the mkfs.xfs default disk format change (for metadata checksumming) which is present upstream.
(BZ#1223991)

Users of xfsprogs are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-2151 advisory.

    - Fix xfs_metadump disclosure flaw, CVE-2012-2150  (#1251118)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
291591	MiracleLinux 7 : xfsprogs-3.2.2-2.el7 (AXSA:2015-743:01)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	high
85549	Fedora 21 : xfsprogs-3.2.2-2.fc21 (2015-12406)	Nessus	Fedora Local Security Checks	2015/8/20	2021/1/11	medium
87348	Amazon Linux AMI : xfsprogs (ALAS-2015-622)	Nessus	Amazon Linux Local Security Checks	2015/12/15	2018/4/18	medium
301212	NewStart CGSL MAIN 6.06 (SP) : xfsprogs Vulnerability (NS-SA-2026-0009)	Nessus	NewStart CGSL Local Security Checks	2026/3/6	2026/3/6	high
87134	CentOS 7 : xfsprogs (CESA-2015:2151)	Nessus	CentOS Local Security Checks	2015/12/2	2021/1/4	medium
85358	Fedora 22 : xfsprogs-3.2.2-2.fc22 (2015-12435)	Nessus	Fedora Local Security Checks	2015/8/13	2021/1/11	medium
85548	Fedora 23 : xfsprogs-3.2.4-1.fc23 (2015-12380)	Nessus	Fedora Local Security Checks	2015/8/20	2021/1/11	medium
87025	Oracle Linux 7 : xfsprogs (ELSA-2015-2151)	Nessus	Oracle Linux Local Security Checks	2015/11/24	2024/10/23	high

检测

插件搜索

high

medium

medium

high

medium

medium

medium

high