Amazon Linux AMI : nss-util / nss,nss-softokn (ALAS-2016-774)

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux AMI Security Advisory ALAS-2016-774.
#

include("compat.inc");

if (description)
{
  script_id(95894);
  script_version("3.2");
  script_cvs_date("Date: 2018/04/18 15:09:36");

  script_cve_id("CVE-2016-2834", "CVE-2016-5285", "CVE-2016-8635");
  script_xref(name:"ALAS", value:"2016-774");

  script_name(english:"Amazon Linux AMI : nss-util / nss,nss-softokn (ALAS-2016-774)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Amazon Linux AMI host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"CVE-2016-2834 nss: Multiple security flaws (MFSA 2016-61)

Multiple buffer handling flaws were found in the way NSS handled
cryptographic data from the network. A remote attacker could use these
flaws to crash an application using NSS or, possibly, execute
arbitrary code with the permission of the user running the
application.

CVE-2016-8635 nss: small-subgroups attack flaw

It was found that Diffie Hellman Client key exchange handling in NSS
was vulnerable to small subgroup confinement attack. An attacker could
use this flaw to recover private keys by confining the client DH key
to small subgroup of the desired group.

CVE-2016-5285 nss: Missing NULL check in PK11_SignWithSymKey /
ssl3_ComputeRecordMACConstantTime causes server crash

A NULL pointer dereference flaw was found in the way NSS handled
invalid Diffie-Hellman keys. A remote client could use this flaw to
crash a TLS/SSL server using NSS."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://alas.aws.amazon.com/ALAS-2016-774.html"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Run 'yum update nss-util' to update your system.

Run 'yum update nss' to update your system.

Run 'yum update nss-softokn' to update your system."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nss");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nss-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nss-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nss-pkcs11-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nss-softokn");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nss-softokn-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nss-softokn-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nss-softokn-freebl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nss-softokn-freebl-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nss-sysinit");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nss-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nss-util");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nss-util-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nss-util-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2016/12/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/12/16");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2016-2018 Tenable Network Security, Inc.");
  script_family(english:"Amazon Linux Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item("Host/AmazonLinux/release");
if (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, "Amazon Linux");
os_ver = pregmatch(pattern: "^AL(A|\d)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "A")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux AMI", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (rpm_check(release:"ALA", reference:"nss-3.21.3-2.77.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"nss-debuginfo-3.21.3-2.77.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"nss-devel-3.21.3-2.77.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"nss-pkcs11-devel-3.21.3-2.77.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"nss-softokn-3.16.2.3-14.4.39.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"nss-softokn-debuginfo-3.16.2.3-14.4.39.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"nss-softokn-devel-3.16.2.3-14.4.39.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"nss-softokn-freebl-3.16.2.3-14.4.39.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"nss-softokn-freebl-devel-3.16.2.3-14.4.39.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"nss-sysinit-3.21.3-2.77.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"nss-tools-3.21.3-2.77.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"nss-util-3.21.3-1.1.51.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"nss-util-debuginfo-3.21.3-1.1.51.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"nss-util-devel-3.21.3-1.1.51.amzn1")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "nss / nss-debuginfo / nss-devel / nss-pkcs11-devel / nss-softokn / etc");
}