Amazon Linux 2 : perl-MIME-tools (ALAS-2026-4095)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2 Security Advisory ALAS-2026-4095.
##

include('compat.inc');

if (description)
{
  script_id(379826);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/12");

  script_cve_id(
    "CVE-2026-116267",
    "CVE-2026-116268",
    "CVE-2026-116269",
    "CVE-2026-116270",
    "CVE-2026-116271",
    "CVE-2026-116273"
  );

  script_name(english:"Amazon Linux 2 : perl-MIME-tools (ALAS-2026-4095)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of perl-MIME-tools installed on the remote host is prior to 5.505-1. It is, therefore, affected by multiple
vulnerabilities as referenced in the ALAS2-2026-4095 advisory.

    MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a
    truncated, deeply nested message. Each stored parser diagnostic is indented by three spaces per nesting
    level. When a message nested N levels deep ends without its closing boundaries, every level logs an error
    at its own depth, so the stored diagnostics grow with the square of N. The defaults place no limit on
    nesting depth. (CVE-2026-116267)

    MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header
    parameters. The comment pattern used to parse Content-Type and Content-Disposition parameters scans from
    each ( to the next ). In a field with no ), every ( scans to the end of the header and fails, so
    parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup,
    several times per MIME entity. A 40 KB header takes about 7 seconds to parse once. (CVE-2026-116268)

    MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language
    tag into an empty recommended filename. A parameter such as filename*=utf-8'en-US'payload.exe is converted
    to an encoded word with the language tag appended to the charset. The decoder strips the language suffix
    only when it is a single word, so it cannot resolve the charset UTF-8*EN-US and returns an empty string.
    The recommended_filename() method returns that empty string rather than falling back to the name
    parameter. Other mail readers return payload.exe. A remote sender can get an attachment past a policy that
    checks file extensions on the recommended filename. (CVE-2026-116269)

    MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated =? sequences in
    decode_mimewords. For each =? that does not start a complete encoded word, decode_mimewords appends an
    error message containing the whole input string to $@. A boundary of 8,000 =? pairs (16,000 bytes) adds
    8,000 copies of itself to $@, about 128 MB. From version 5.518, MIME::Parser decodes every multipart
    boundary this way, so a remote sender can exhaust the memory of the parsing process with one Content-Type
    header. (CVE-2026-116270)

    MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow
    symlinks in it, letting local users redirect attachment writes. Each message is written to a directory
    named msg-<time>-<pid>-<n> under the output base, and an existing directory of that name is used as is. A
    file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the
    body file is then opened in a way that follows the link. When the output base is writable by other users,
    as with output_under(/tmp), a local user can pre-create the directory with a symlink named like an
    attachment. The parser then writes the attachment to the link target with the privileges of the parsing
    process. (CVE-2026-116271)

    MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default,
    allowing memory exhaustion. The max_parts option defaulted to -1, which disables the limit, so a parser
    created with default settings builds an entity for every part however many a message has. Version 5.521
    sets max_parts to 1000 and max_depth to 64 by default. Setting either to -1 still removes the limit.
    (CVE-2026-116273)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2/ALAS2-2026-4095.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-116267.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-116268.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-116269.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-116270.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-116271.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-116273.html");
  script_set_attribute(attribute:"solution", value:
"Run 'yum update perl-MIME-tools' or
  or 'yum update --advisory ALAS2-2026-4095' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-116271");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/11/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/11/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perl-MIME-tools");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "2")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'perl-MIME-tools-5.505-1.amzn2.0.1', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "perl-MIME-tools");
}