According to the version of the ksh package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In ksh version 20120801, a flaw was found in the way it     evaluates certain environment variables. An attacker     could use this flaw to override or bypass environment     restrictions to execute shell commands. Services and     applications that allow remote unauthenticated     attackers to provide one of those environment variables     could allow them to exploit this issue     remotely.(CVE-2019-14868)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables could allow them to exploit this issue remotely.

For Debian 9 stretch, this problem has been fixed in version 93u+20120801-3.1+deb9u1.

We recommend that you upgrade your ksh packages.

For the detailed security status of ksh please refer to its security tracker page at: https://security-tracker.debian.org/tracker/ksh

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the ksh package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - In ksh version 20120801, a flaw was found in the way it     evaluates certain environment variables. An attacker     could use this flaw to override or bypass environment     restrictions to execute shell commands. Services and     applications that allow remote unauthenticated     attackers to provide one of those environment variables     could allow them to exploit this issue     remotely.(CVE-2019-14868)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-0559 advisory.

    [20120801-253.0.1.el8_1]
    - Disable _AST_no_spawnveg for taskset workaround [Orabug: 26754277]       Red Hat Bug: #1295563

    [20120801-253]
    - Do not evaluate arithmetic expressions from environment variables at startup       Resolves: #1790546

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Do not evaluate arithmetic expressions from environment variables at startup

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:0515 advisory.

  - In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An     attacker could use this flaw to override or bypass environment restrictions to execute shell commands.
    Services and applications that allow remote unauthenticated attackers to provide one of those environment     variables could allow them to exploit this issue remotely. (CVE-2019-14868)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1332 advisory.

    KornShell (ksh) is a Unix shell developed by AT&T Bell Laboratories, which is backward-compatible with the     Bourne shell (sh) and includes many features of the C shell. The most recent version is KSH-93. KornShell     complies with the POSIX.2 standard (IEEE Std 1003.2-1992).

    Security Fix(es):

    * ksh: certain environment variables interpreted as arithmetic expressions on startup, leading to code     injection (CVE-2019-14868)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:5352 advisory.

    KornShell (ksh) is a Unix shell developed by AT&T Bell Laboratories, which is backward-compatible with the     Bourne shell (sh) and includes many features of the C shell. The most recent version is KSH-93. KornShell     complies with the POSIX.2 standard (IEEE Std 1003.2-1992).

    Security Fix(es):

    * ksh: certain environment variables interpreted as arithmetic expressions on startup, leading to code     injection (CVE-2019-14868)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2020-4474:01 advisory.

    * ksh: certain environment variables interpreted as arithmetic expressions on startup, leading to code     injection (CVE-2019-14868)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
137523	EulerOS 2.0 SP2 : ksh (EulerOS-SA-2020-1681)	Nessus	Huawei Local Security Checks	2020/6/17	2024/3/6	high
138783	Debian DLA-2284-1 : ksh security update	Nessus	Debian Local Security Checks	2020/7/21	2024/2/29	high
140142	EulerOS 2.0 SP5 : ksh (EulerOS-SA-2020-1921)	Nessus	Huawei Local Security Checks	2020/9/2	2024/2/22	high
142557	EulerOS Virtualization 3.0.6.6 : ksh (EulerOS-SA-2020-2446)	Nessus	Huawei Local Security Checks	2020/11/6	2021/1/6	high
146239	EulerOS 2.0 SP9 : ksh (EulerOS-SA-2021-1247)	Nessus	Huawei Local Security Checks	2021/2/5	2024/1/23	high
151397	EulerOS Virtualization 3.0.2.2 : ksh (EulerOS-SA-2021-2142)	Nessus	Huawei Local Security Checks	2021/7/6	2023/12/11	high
180682	Oracle Linux 8 : ksh (ELSA-2020-0559)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/10/23	high
133739	Fedora 30 : 1:ksh (2020-a0f0eb8500)	Nessus	Fedora Local Security Checks	2020/2/18	2024/3/27	high
133767	CentOS 6 : ksh (RHSA-2020:0515)	Nessus	CentOS Local Security Checks	2020/2/19	2024/10/9	high
135234	RHEL 7 : ksh (RHSA-2020:1332)	Nessus	Red Hat Local Security Checks	2020/4/6	2024/11/7	high
140875	EulerOS 2.0 SP3 : ksh (EulerOS-SA-2020-2108)	Nessus	Huawei Local Security Checks	2020/9/28	2024/2/19	high
143606	RHEL 7 : ksh (RHSA-2020:5352)	Nessus	Red Hat Local Security Checks	2020/12/9	2024/11/7	high
294156	MiracleLinux 4 : ksh-20120801-38.AXS4 (AXSA:2020-4474:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high