According to the version of the coreutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - In GNU Coreutils through 8.29, chown-core.c in chown     and chgrp does not prevent replacement of a plain file     with a symlink during use of the POSIX '-R -L' options,     which allows local users to modify the ownership of     arbitrary files by leveraging a race     condition.(CVE-2017-18018)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 在 8.29版及其之前版本的 GNU Coreutils 中，chown 和 chgrp 的 chown-core.c 在使用 POSIX -R -L 選項期間無法防止以符號連結取代純文字檔案，進而允許本機使用者修改任意檔案的擁有權利用爭用情形。 (CVE-2017-18018)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 在 GNU Coreutils 及之前 8.29版本中，chown 和 chgrp 中的 chown-core.c 在使用 POSIX -R -L 选项期间未阻止将普通文件替换为符号链接，这允许本地用户修改任意文件的所有权通过利用争用条件。 (CVE-2017-18018)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - 8.29までの GNU Coreutils では、POSIX -R -L オプションの使用中に、chown および chgrp の chown-core.c がシンボリックリンクによるプレーンファイルの置換を防止しないため、ローカルユーザーが任意のファイルの所有権を変更する可能性があります競合状態を利用する可能性があります。 （CVE-2017-18018）

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

- doc：chown/chgrpでシンボリックリンクを再帰的にたどることについて警告します（CVE-2017-18018）

  - mv -n：宛先を上書きしません

  - mv -n：より信頼できる診断メッセージを提供します

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

According to the version of the coreutils package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In GNU Coreutils through 8.29, chown-core.c in chown     and chgrp does not prevent replacement of a plain file     with a symlink during use of the POSIX '-R -L' options,     which allows local users to modify the ownership of     arbitrary files by leveraging a race     condition.(CVE-2017-18018)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

インストールされているcoreutilsパッケージのバージョンによると、リモートホストにインストールされているEulerOS Virtualization for ARM 64は、次の脆弱性の影響を受けます。- 8.29までのGNU Coreutilsにおいて、chownおよびchgrpのchown-core.cはPOSIXの 「-R -L」オプションの使用中にシンボリックリンクを含むプレーンファイルの置き換えを防止しないため、ローカルユーザーが競合状態を利用して任意のファイルの所有権を変更する可能性があります。（CVE-2017-18018）注意：Tenable Network Securityは、前述の記述ブロックをEulerOSセキュリティアドバイザリから直接抽出しています。Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

According to the version of the coreutils packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - In GNU Coreutils through 8.29, chown-core.c in chown     and chgrp does not prevent replacement of a plain file     with a symlink during use of the POSIX '-R -L' options,     which allows local users to modify the ownership of     arbitrary files by leveraging a race     condition.(CVE-2017-18018)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the coreutils package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - In GNU Coreutils through 8.29, chown-core.c in chown     and chgrp does not prevent replacement of a plain file     with a symlink during use of the POSIX '-R -L' options,     which allows local users to modify the ownership of     arbitrary files by leveraging a race     condition.(CVE-2017-18018)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain     file with a symlink during use of the POSIX -R -L options, which allows local users to modify the     ownership of arbitrary files by leveraging a race condition. (CVE-2017-18018)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote NewStart CGSL host, running version MAIN 6.06, has coreutils packages installed that are affected by multiple vulnerabilities:

  - Gnulib before 2017-04-26 has a heap-based buffer overflow with the TZ environment variable. The error is     in the save_abbr function in time_rz.c. (CVE-2017-7476)

  - The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a     size calculation without considering the number of bytes occupied by multibyte characters, which allows     attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have     unspecified other impact via long UTF-8 strings. (CVE-2015-4041)

  - Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 might allow     attackers to cause a denial of service (application crash) or possibly have unspecified other impact via     long strings. (CVE-2015-4042)

  - In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain     file with a symlink during use of the POSIX -R -L options, which allows local users to modify the     ownership of arbitrary files by leveraging a race condition. (CVE-2017-18018)

  - The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer     overflow because memory is not allocated for a trailing '\0' character during %f processing.
    (CVE-2018-17942)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- doc: warn about following symlinks recursively in     chown/chgrp (CVE-2017-18018)

  - mv -n: do not overwrite the destination

  - mv -n: provide more reliable diagnostic messages

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

根據安裝的 coreutils 套件版本，遠端主機上的 EulerOS Virtualization for ARM 64 安裝會受到下列弱點影響：- 在 GNU Coreutils 8.29 及之前的版本中，chown 和 chgrp 中的 chown-core.c 在使用 POSIX「-R -L」選項期間，不會防止將純文字檔取代為符號連結，進而允許本機使用者利用爭用情形，修改任意檔案的擁有權。(CVE-2017-18018) 請注意，Tenable Network Security 已直接從 EulerOS 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

根据安装的 coreutils 程序包版本，远程主机上的 EulerOS Virtualization for ARM 64 安装会受到下列漏洞影响：- 在 GNU Coreutils 8.29 及之前的版本中，chown 和 chgrp 中的 chown-core.c 在使用 POSIX“-R -L”选项期间，不会防止将普通文件取代为符号链接，进而允许本地用户利用争用条件，修改任意文件的所有权。(CVE-2017-18018) 请注意，Tenable Network Security 已直接从 EulerOS 安全公告中提取上述描述块Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
135646	EulerOS Virtualization 3.0.2.2 : coreutils (EulerOS-SA-2020-1484)	Nessus	Huawei Local Security Checks	2020/4/16	2025/2/21	medium
221095	Linux Distros 未修補弱點：CVE-2017-18018	Nessus	Misc.	2025/3/4	2025/9/14	medium
221095	Linux Distros 未修补的漏洞: CVE-2017-18018	Nessus	Misc.	2025/3/4	2025/9/14	medium
221095	Linux Distros のパッチ未適用の脆弱性: CVE-2017-18018	Nessus	Misc.	2025/3/4	2025/9/14	medium
106514	Fedora 27：coreutils（2018-669520d2ba）	Nessus	Fedora Local Security Checks	2018/1/31	2025/10/30	medium
130843	EulerOS 2.0 SP5 : coreutils (EulerOS-SA-2019-2134)	Nessus	Huawei Local Security Checks	2019/11/12	2025/2/21	medium
131498	EulerOS Virtualization for ARM 64 3.0.3.0：coreutils（EulerOS-SA-2019-2333）	Nessus	Huawei Local Security Checks	2019/12/3	2025/2/21	medium
131498	EulerOS Virtualization for ARM 64 3.0.3.0 : coreutils (EulerOS-SA-2019-2333)	Nessus	Huawei Local Security Checks	2019/12/3	2025/2/21	medium
134483	EulerOS Virtualization for ARM 64 3.0.2.0 : coreutils (EulerOS-SA-2020-1194)	Nessus	Huawei Local Security Checks	2020/3/13	2025/2/21	medium
221095	Linux Distros Unpatched Vulnerability : CVE-2017-18018	Nessus	Misc.	2025/3/4	2025/9/14	medium
266248	NewStart CGSL MAIN 6.06 : coreutils Multiple Vulnerabilities (NS-SA-2025-0228)	Nessus	NewStart CGSL Local Security Checks	2025/9/30	2025/9/30	critical
106514	Fedora 27 : coreutils (2018-669520d2ba)	Nessus	Fedora Local Security Checks	2018/1/31	2025/10/30	medium
131498	EulerOS Virtualization for ARM 64 3.0.3.0：coreutils (EulerOS-SA-2019-2333)	Nessus	Huawei Local Security Checks	2019/12/3	2025/2/21	medium
131498	EulerOS Virtualization for ARM 64 3.0.3.0：coreutils (EulerOS-SA-2019-2333)	Nessus	Huawei Local Security Checks	2019/12/3	2025/2/21	medium
131909	EulerOS 2.0 SP2 : coreutils (EulerOS-SA-2019-2417)	Nessus	Huawei Local Security Checks	2019/12/10	2025/2/21	medium
132280	EulerOS 2.0 SP3 : coreutils (EulerOS-SA-2019-2563)	Nessus	Huawei Local Security Checks	2019/12/19	2025/2/21	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium