CentOS 9 : unbound-1.26.1-1.el9

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# the CentOS Stream Build Service.
##

include('compat.inc');

if (description)
{
  script_id(351124);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/02");

  script_cve_id(
    "CVE-2026-77860",
    "CVE-2026-77955",
    "CVE-2026-78227",
    "CVE-2026-80225",
    "CVE-2026-81634",
    "CVE-2026-81642",
    "CVE-2026-82717",
    "CVE-2026-82720",
    "CVE-2026-85501"
  );
  script_xref(name:"IAVA", value:"2026-A-1070");

  script_name(english:"CentOS 9 : unbound-1.26.1-1.el9");

  script_set_attribute(attribute:"synopsis", value:
"The remote CentOS host is missing one or more security updates for python3-unbound.");
  script_set_attribute(attribute:"description", value:
"The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the
unbound-1.26.1-1.el9 build changelog.

  - In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively
    corrupt heap memory and under certain systems and compilation options could lead to remote code execution.
    The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max
    TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value
    and invalidates the domain name, it leads to an error path that does not properly move the buffer position
    and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are
    memory corruption that eventually leads to a crash and under specific systems and compilation options
    remote code execution. (CVE-2026-82717)

  - In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path
    can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the
    counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by
    controlling an authoritative zone with short TTL, so cached entries expire quickly. Each 'slow' query, one
    the attacker's authoritative never answers, is followed by one query for an expired cached name, which is
    answered immediately via the 'serve-expired' path and decrements the counter twice. This second query was
    named 'pump'. By alternating slow queries and pumps, the attacker keeps the per-client counter at or below
    the configured 'wait-limit' indefinitely, and can hold an arbitrary number of pending queries from a
    single source IP, up to the global mesh quota (num-queries-per-thread); eventually bypassing one of the
    counter measures introduced for DNSBomb (CVE-2024-33655). This vulnerability is present on the 'serve-
    expired' code path. (CVE-2026-77860)

  - In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones
    (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where
    (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is
    caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check
    completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered
    data are reloaded on startup and available until ZONEMD verification concludes again. If verification
    fails, the data is not served any more but still persists on disk for future reloads. (CVE-2026-77955)

  - NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for
    DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS
    response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffer for as long as a
    STREAM frame may be resent. On a client RESET_STREAM, the output buffer is freed but ngtcp2 still holds
    the matching retransmission entries. The next PTO timeout makes ngtcp2 re-encode the STREAM frame and copy
    from the freed buffer. A malicious actor that can query Unbound over DoQ and that withholds ACKs, sends
    RESET_STREAM, and waits for PTO, reaches this use-after-free with no privilege. This leads to
    retransmissions against freed memory and eventually an abnormal server exit under a 20-query spray.
    (CVE-2026-78227)

  - In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the
    TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream
    and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's
    entire event loop for as long as its writes stay ahead of the drain. (CVE-2026-80225)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://kojihub.stream.centos.org/koji/buildinfo?buildID=130893");
  script_set_attribute(attribute:"solution", value:
"Update the CentOS 9 Stream python3-unbound package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_supplemental", value:"CVSS:4.0/U:Red");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-82717");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-81642");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/29");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:centos:centos:9");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:python3-unbound");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:unbound");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:unbound-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:unbound-dracut");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:unbound-libs");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CentOS Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');
include('rhel.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'CentOS' >!< os_product) audit(AUDIT_OS_NOT, 'CentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS');
if (!rhel_check_release(operator: 'ge', os_version: os_version, rhel_version: '9')) audit(AUDIT_OS_NOT, 'CentOS 9.x', 'CentOS ' + os_version);

if (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS', cpu);

var constraints = [
  {
    'release': '9',
    'pkgs': [
      {'reference':'python3-unbound-1.26.1-1.el9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'unbound-1.26.1-1.el9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'unbound-devel-1.26.1-1.el9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'unbound-dracut-1.26.1-1.el9', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'unbound-libs-1.26.1-1.el9', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'python3-unbound / unbound / unbound-devel / unbound-dracut / etc');
}