CVE-2017-7849 in Nessus
Summary
by MITRE
Nessus 6.10.x before 6.10.5 was found to be vulnerable to a local denial of service condition due to insecure permissions when running in Agent Mode.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2020
The vulnerability identified as CVE-2017-7849 affects Tenable Nessus versions 6.10.x prior to 6.10.5, specifically when the application operates in Agent Mode. This represents a significant security weakness that could be exploited to disrupt the normal operation of the scanning infrastructure. The issue stems from improper permission handling within the Nessus agent component, creating a scenario where local users can potentially cause system instability through deliberate abuse of the application's access controls.
The technical flaw manifests in the insecure permissions model that governs how Nessus agents handle file system access and process execution. When Nessus operates in Agent Mode, it typically runs with elevated privileges to perform comprehensive system scans and gather detailed information about target hosts. However, the vulnerability arises from the application's failure to properly validate or restrict file system permissions, allowing local users to manipulate critical components or access restricted resources. This weakness enables an attacker to cause the Nessus agent process to terminate unexpectedly, resulting in a denial of service condition that disrupts ongoing scanning operations.
The operational impact of this vulnerability extends beyond simple service disruption, as it can compromise the integrity of security scanning operations that organizations rely upon for threat detection and compliance monitoring. When a Nessus agent becomes unavailable due to this denial of service condition, it creates gaps in security coverage that could allow malicious actors to remain undetected while the scanning infrastructure is temporarily incapacitated. Organizations using Nessus in production environments may experience reduced visibility into their network security posture, potentially leading to extended exposure to known vulnerabilities and threats. The local nature of this vulnerability means that it requires minimal privileges to exploit, making it particularly concerning for environments where multiple users have access to the system hosting Nessus agents.
Mitigation strategies should focus on immediate patch deployment to upgrade Nessus installations to version 6.10.5 or later, which contains the necessary permission handling improvements. System administrators should also implement additional monitoring controls to detect unusual agent termination patterns and establish automated alerting mechanisms for service disruptions. The vulnerability aligns with CWE-276, which addresses insecure permissions in software systems, and represents a clear violation of the principle of least privilege that is fundamental to secure system design. From an ATT&CK framework perspective, this vulnerability could be leveraged as part of a broader attack chain where adversaries first establish persistence or maintain access before attempting to disrupt security monitoring capabilities. Organizations should also consider implementing additional access controls and privilege separation measures to reduce the attack surface and minimize the potential impact of similar vulnerabilities in other system components.