According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation)     because application logic sometimes is based on not equaling an error value (instead of equaling a success     value), and because the values do not resist flips of a single bit.(CVE-2023-42465)

Tenable has extracted the preceding description block directly from the EulerOS sudo security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the sudo package has been released.

According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation)     because application logic sometimes is based on not equaling an error value (instead of equaling a success     value), and because the values do not resist flips of a single bit. (CVE-2023-42465)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0834-1 advisory.

  - Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation)     because application logic sometimes is based on not equaling an error value (instead of equaling a success     value), and because the values do not resist flips of a single bit. (CVE-2023-42465)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-cdccda4f62 advisory.

    Rabase to 1.9.15p5

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-6fa5af9ea8 advisory.

    Rabase to 1.9.15p5

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:0811 advisory.

  - Sudo before 1.9.13 does not escape control characters in log messages. (CVE-2023-28486)

  - Sudo before 1.9.13 does not escape control characters in sudoreplay output. (CVE-2023-28487)

  - Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation)     because application logic sometimes is based on not equaling an error value (instead of equaling a success     value), and because the values do not resist flips of a single bit. (CVE-2023-42465)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0890-1 advisory.

  - Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation)     because application logic sometimes is based on not equaling an error value (instead of equaling a success     value), and because the values do not resist flips of a single bit. (CVE-2023-42465)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0889-1 advisory.

  - Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation)     because application logic sometimes is based on not equaling an error value (instead of equaling a success     value), and because the values do not resist flips of a single bit. (CVE-2023-42465)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202401-29 (sudo: Memory Manipulation)

  - Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation)     because application logic sometimes is based on not equaling an error value (instead of equaling a success     value), and because the values do not resist flips of a single bit. (CVE-2023-42465)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0034 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-28486:
    Sudo before 1.9.13 does not escape control characters in log messages.

    CVE-2023-28487:
    Sudo before 1.9.13 does not escape control characters in sudoreplay output.

    CVE-2023-42465:
    Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation)     because application logic sometimes is based on not equaling an error value (instead of equaling a success     value), and because the values do not resist flips of a single bit.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation)     because application logic sometimes is based on not equaling an error value (instead of equaling a success     value), and because the values do not resist flips of a single bit. (CVE-2023-42465)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the sudo-1.9.5p2-10.el9 build changelog.

  - Sudo does not escape control characters in log messages (CVE-2023-28486)

  - Sudo does not escape control characters in sudoreplay output (CVE-2023-28487)

  - Targeted Corruption of Register and Stack Variables (CVE-2023-42465)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2024:0811 advisory.

  - Sudo before 1.9.13 does not escape control characters in log messages. (CVE-2023-28486)

  - Sudo before 1.9.13 does not escape control characters in sudoreplay output. (CVE-2023-28487)

  - Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation)     because application logic sometimes is based on not equaling an error value (instead of equaling a success     value), and because the values do not resist flips of a single bit. (CVE-2023-42465)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
198181	EulerOS 2.0 SP12 : sudo (EulerOS-SA-2024-1778)	Nessus	Huawei Local Security Checks	2024/5/30	2024/5/30	high
204124	Photon OS 3.0: Sudo PHSA-2024-3.0-0713	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	high
191979	EulerOS 2.0 SP10 : sudo (EulerOS-SA-2024-1348)	Nessus	Huawei Local Security Checks	2024/3/12	2024/3/12	high
192016	SUSE SLES15 Security Update : sudo (SUSE-SU-2024:0834-1)	Nessus	SuSE Local Security Checks	2024/3/13	2024/3/13	high
189724	Fedora 39 : sudo (2024-cdccda4f62)	Nessus	Fedora Local Security Checks	2024/1/28	2024/11/14	high
190663	Fedora 38 : sudo (2024-6fa5af9ea8)	Nessus	Fedora Local Security Checks	2024/2/18	2024/11/14	high
190513	AlmaLinux 9 : sudo (ALSA-2024:0811)	Nessus	Alma Linux Local Security Checks	2024/2/14	2024/2/14	high
191802	EulerOS 2.0 SP11 : sudo (EulerOS-SA-2024-1229)	Nessus	Huawei Local Security Checks	2024/3/12	2024/3/12	high
191809	EulerOS 2.0 SP11 : sudo (EulerOS-SA-2024-1251)	Nessus	Huawei Local Security Checks	2024/3/12	2024/3/12	high
192176	SUSE SLES12 Security Update : sudo (SUSE-SU-2024:0890-1)	Nessus	SuSE Local Security Checks	2024/3/16	2024/3/16	high
192182	SUSE SLES15 Security Update : sudo (SUSE-SU-2024:0889-1)	Nessus	SuSE Local Security Checks	2024/3/16	2024/3/16	high
204400	Photon OS 5.0: Sudo PHSA-2024-5.0-0185	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	high
189404	GLSA-202401-29 : sudo: Memory Manipulation	Nessus	Gentoo Local Security Checks	2024/1/24	2024/2/9	high
236576	Alibaba Cloud Linux 3 : 0034: sudo (ALINUX3-SA-2024:0034)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
226962	Linux Distros Unpatched Vulnerability : CVE-2023-42465	Nessus	Misc.	2025/3/5	2025/3/5	high
193919	CentOS 9 : sudo-1.9.5p2-10.el9	Nessus	CentOS Local Security Checks	2024/4/26	2024/4/26	high
190850	CentOS 8 : sudo (CESA-2024:0811)	Nessus	CentOS Local Security Checks	2024/2/21	2024/2/21	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high