CVE-2016-4989
HighSummary
The vulnerability in setroubleshoot allows local users to bypass the intended container protection mechanism and execute arbitrary commands. This can be achieved by triggering an SELinux denial using a crafted file name or crafted fields in an XML document.
Risk Assessment
The organization may be exposed to unauthorized command execution, potentially leading to serious security breaches.
Recommendation
It is recommended to update the setroubleshoot software to the latest version to mitigate this vulnerability and to monitor the system for unauthorized activities.
Other vulnerabilities in setroubleshoot
See all- CVE-2016-4445High
The fix_lookup_id function in sealert in setroubleshoot before version 3.2.23 allows local users to execute arbitrary commands as root by triggering an SELinux denial with a crafted file name.
- CVE-2016-4444High
The allow_execmod plugin for setroubleshoot before version 3.2.23 allows local users to execute arbitrary commands by triggering an execmod SELinux denial with a crafted binary filename.
- CVE-2015-1815High
The get_rpm_nvr_by_file_path_temporary function in util.py in setroubleshoot before version 3.2.22 allows remote attackers to execute arbitrary commands via shell metacharacters in a file name.
Original NVD description (English source)
setroubleshoot allows local users to bypass an intended container protection mechanism and execute arbitrary commands by (1) triggering an SELinux denial with a crafted file name, which is handled by the _set_tpath function in audit_data.py or via a crafted (2) local_id or (3) analysis_id field in a crafted XML document to the run_fix function in SetroubleshootFixit.py, related to the subprocess.check_output and commands.getstatusoutput functions, a different vulnerability than CVE-2016-4445.