Huawei EulerOS: Security Advisory for procps-ng (EulerOS-SA-2018-1230)

The remote host is missing an update for the Huawei EulerOS 'procps-ng' package(s) announced via the EulerOS-SA-2018-1230 advisory.

If the HOME environment variable is unset or empty, top will read its configuration file from the current working directory without any security check. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.(CVE-2018-1122) Due to incorrect accounting when decoding and escaping Unicode data in procfs, ps is vulnerable to overflowing an mmap()ed region when formatting the process list for display. Since ps maps a guard page at the end of the buffer, impact is limited to a crash.(CVE-2018-1123) If an argument longer than INT_MAX bytes is given to pgrep, 'int bytes' could wrap around back to a large positive int (rather than approaching zero), leading to a stack buffer overflow via strncat().(CVE-2018-1125)

'procps-ng' package(s) on Huawei EulerOS V2.0SP3.

Checks if a vulnerable package version is present on the target host.

Please install the updated package(s).