File with the name "sem.|var|lib|loginsight-agent|update.dat" reported as vulnerable on Linux VM's

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• File with the name "sem.|var|lib|loginsight-agent|update.dat" is reported as vulnerable by scanners.
• Only affecting loginsight(LI) agents on Linux machines.
• The majority of customers have seen this issue with RedHat and CentOS.

     For Example:

Environment

VMware vRealize Log Insight 8.x

Aria Operations for Logs 8.x

Resolution

Change the permission of update.dat file

1. SSH to the Virtual Machine on which the vulnerability is reported

2. Run the below commands:

            cd /var/lib/loginsight-agent
  
            chmod 600 \|var\|lib\|loginsight-agent\|update.dat
             
3. Confirm the permission is changed for "sem.|var|lib|loginsight-agent|update.dat" file

            ls -l /dev/shm/sem.\|var\|lib\|loginsight-agent\|update.dat

     Example:
            [root@localhost loginsight-agent]# ls -l /dev/shm/sem.\|var\|lib\|loginsight-agent\|update.dat
             
              -rw-------. 1 root root 32 Oct 2 13:17 '/dev/shm/sem.|var|lib|loginsight-agent|update.dat'

4. Once the file permission is changed successfully, please re-run the vulnerability check.