Security update for SUSE Manager Client Tools Beta

Announcement ID:	SUSE-SU-2024:1629-1
Rating:	moderate
References:	bsc#1014637 bsc#1156309 jsc#MSQA-775
Cross-References:	CVE-2016-9566 CVE-2019-3698
CVSS scores:	CVE-2016-9566 ( SUSE ): 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVE-2016-9566 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2019-3698 ( SUSE ): 4.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L CVE-2019-3698 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products:	Advanced Systems Management Module 12 Containers Module 12 SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Desktop 12 SP4 SUSE Linux Enterprise High Performance Computing 12 SP2 SUSE Linux Enterprise High Performance Computing 12 SP3 SUSE Linux Enterprise High Performance Computing 12 SP4 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Server for the Raspberry Pi 12-SP2 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Workstation Extension 12 12-SP5 SUSE Manager Client Tools Beta for SLE 12 SUSE Manager Client Tools for SLE 12

An update that solves two vulnerabilities and contains one feature can now be installed.

Description:

This update for SUSE Manager Client Tools Beta fixes the following issues:

• Changed codestream origin of SUSE Manager Client Tools Beta (no source changes)

icinga in SUSE Manager Client Tools Beta also received the following security fixes:

• CVE-2016-9566: Fixed root privilege escalation (bsc#1014637)
• CVE-2019-3698 : Symbolic Link (Symlink) following vulnerability in the cronjob allows local attackers to cause cause DoS or potentially escalate privileges by winning a race (bsc#1156309)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Manager Client Tools for SLE 12
  zypper in -t patch SUSE-SLE-Manager-Tools-12-2024-1629=1
• SUSE Manager Client Tools Beta for SLE 12
  zypper in -t patch SUSE-SLE-Manager-Tools-12-BETA-2024-1629=1
• Advanced Systems Management Module 12
  zypper in -t patch SUSE-SLE-Module-Adv-Systems-Management-12-2024-1629=1
• Containers Module 12
  zypper in -t patch SUSE-SLE-Module-Containers-12-2024-1629=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP5
  zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-1629=1 SUSE-SLE-SAP-12-SP5-2024-1629=1
• SUSE Linux Enterprise Software Development Kit 12 SP5
  zypper in -t patch SUSE-SLE-SDK-12-SP5-2024-1629=1
• SUSE Linux Enterprise High Performance Computing 12 SP5
  zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-1629=1
• SUSE Linux Enterprise Server 12 SP5
  zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-1629=1
• SUSE Linux Enterprise Workstation Extension 12 12-SP5
  zypper in -t patch SUSE-SLE-WE-12-SP5-2024-1629=1

Package List:

• SUSE Manager Client Tools for SLE 12 (noarch)
  • grafana-sap-providers-1.1-1.7.1
  • hwdata-0.314-10.14.1
  • sysuser-shadow-2.0-1.9.1
  • grafana-sap-netweaver-dashboards-1.0.3+git.1601889366.9f71957-1.10.1
  • grafana-ha-cluster-dashboards-1.1.0+git.1605027022.a84d536-1.10.1
  • grafana-sleha-provider-1.1.0+git.1605027022.a84d536-1.10.1
• SUSE Manager Client Tools for SLE 12 (aarch64 ppc64le s390x x86_64)
  • icinga-debugsource-1.13.3-12.8.1
  • icinga-www-1.13.3-12.8.1
  • libzmq3-4.0.4-15.8.1
  • icinga-plugins-eventhandlers-1.13.3-12.8.1
  • icinga-idoutils-oracle-1.13.3-12.8.1
  • icinga-1.13.3-12.8.1
  • icinga-devel-1.13.3-12.8.1
  • icinga-idoutils-pgsql-1.13.3-12.8.1
  • monitoring-tools-1.13.3-12.8.1
  • icinga-debuginfo-1.13.3-12.8.1
  • zeromq-debugsource-4.0.4-15.8.1
  • icinga-plugins-downtimes-1.13.3-12.8.1
  • icinga-idoutils-mysql-1.13.3-12.8.1
  • icinga-idoutils-1.13.3-12.8.1
  • icinga-www-config-1.13.3-12.8.1
  • icinga-doc-1.13.3-12.8.1
  • libzmq3-debuginfo-4.0.4-15.8.1
• SUSE Manager Client Tools Beta for SLE 12 (noarch)
  • grafana-sap-providers-1.1-1.7.1
  • sysuser-shadow-2.0-1.9.1
  • grafana-sap-netweaver-dashboards-1.0.3+git.1601889366.9f71957-1.10.1
  • grafana-ha-cluster-dashboards-1.1.0+git.1605027022.a84d536-1.10.1
  • grafana-sleha-provider-1.1.0+git.1605027022.a84d536-1.10.1
• SUSE Manager Client Tools Beta for SLE 12 (aarch64 ppc64le s390x x86_64)
  • icinga-debugsource-1.13.3-12.8.1
  • icinga-www-1.13.3-12.8.1
  • libzmq3-4.0.4-15.8.1
  • icinga-plugins-eventhandlers-1.13.3-12.8.1
  • icinga-idoutils-oracle-1.13.3-12.8.1
  • icinga-1.13.3-12.8.1
  • icinga-devel-1.13.3-12.8.1
  • icinga-idoutils-pgsql-1.13.3-12.8.1
  • monitoring-tools-1.13.3-12.8.1
  • icinga-debuginfo-1.13.3-12.8.1
  • zeromq-debugsource-4.0.4-15.8.1
  • icinga-plugins-downtimes-1.13.3-12.8.1
  • icinga-idoutils-mysql-1.13.3-12.8.1
  • icinga-idoutils-1.13.3-12.8.1
  • icinga-www-config-1.13.3-12.8.1
  • icinga-doc-1.13.3-12.8.1
  • libzmq3-debuginfo-4.0.4-15.8.1
• Advanced Systems Management Module 12 (ppc64le s390x x86_64)
  • libzmq3-4.0.4-15.8.1
  • libzmq3-debuginfo-4.0.4-15.8.1
  • zeromq-debugsource-4.0.4-15.8.1
• Containers Module 12 (noarch)
  • sysuser-shadow-2.0-1.9.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP5 (noarch)
  • grafana-sap-providers-1.1-1.7.1
  • sysuser-shadow-2.0-1.9.1
  • grafana-sap-netweaver-dashboards-1.0.3+git.1601889366.9f71957-1.10.1
  • grafana-ha-cluster-dashboards-1.1.0+git.1605027022.a84d536-1.10.1
  • grafana-sleha-provider-1.1.0+git.1605027022.a84d536-1.10.1
  • sysuser-tools-2.0-1.9.1
• SUSE Linux Enterprise Software Development Kit 12 SP5 (aarch64 ppc64le s390x x86_64)
  • libzmq3-4.0.4-15.8.1
  • zeromq-devel-4.0.4-15.8.1
  • libzmq3-debuginfo-4.0.4-15.8.1
  • zeromq-debugsource-4.0.4-15.8.1
• SUSE Linux Enterprise High Performance Computing 12 SP5 (noarch)
  • sysuser-shadow-2.0-1.9.1
  • sysuser-tools-2.0-1.9.1
• SUSE Linux Enterprise Server 12 SP5 (noarch)
  • sysuser-shadow-2.0-1.9.1
  • sysuser-tools-2.0-1.9.1
• SUSE Linux Enterprise Workstation Extension 12 12-SP5 (x86_64)
  • libzmq3-4.0.4-15.8.1
  • libzmq3-debuginfo-4.0.4-15.8.1
  • zeromq-debugsource-4.0.4-15.8.1

References:

• https://www.suse.com/security/cve/CVE-2016-9566.html
• https://www.suse.com/security/cve/CVE-2019-3698.html
• https://bugzilla.suse.com/show_bug.cgi?id=1014637
• https://bugzilla.suse.com/show_bug.cgi?id=1156309
• https://jira.suse.com/browse/MSQA-775