[R2] Nessus Agent 8.2.0 Fixes One Vulnerability

Related Vulnerabilities: CVE-2020-5793  

A vulnerability in Nessus Agent 8.0.0 and 8.1.0 for Windows could allow an authenticated local attacker to execute arbitrary code by copying user-supplied files to a specially constructed path in a specifically named user directory. The attacker needs valid credentials on the Windows system to exploit this vulnerability.

Synopsis

A vulnerability in Nessus Agent 8.0.0 and 8.1.0 for Windows could allow an authenticated local attacker to execute arbitrary code by copying user-supplied files to a specially constructed path in a specifically named user directory. The attacker needs valid credentials on the Windows system to exploit this vulnerability.

Solution

Tenable has included a fix in Nessus Agent 8.2.0 and Nessus Agent 8.1.1 to address this issue. The installation files can be obtained from the Tenable Downloads Portal (https://www.tenable.com/downloads/nessus-agents).

*Note: Windows Dependency Update

Nessus Agent 8.2.0 and later require Windows host systems to be running the Universal Microsoft C Runtime Library (UCRT) (for more information, see Microsoft Documentation). This means that some older versions of Microsoft Windows will require a minimum update to work with Nessus Agent 8.2.0 and later. While it is recommended to upgrade to the latest version of Nessus Agent 8.2.0, Tenable will release Nessus Agent 8.1.1 in early November to accommodate vulnerability fixes while maintaining the same standard library in cases where Nessus Agent 8.2.0 direct upgrade is not possible.