Check Point Gaia Operating System (sk1000117)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(362383);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/01");

  script_cve_id("CVE-2026-85102");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2026/09/22");

  script_name(english:"Check Point Gaia Operating System (sk1000117)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The remote host is missing a hotfix for the Gaia Operating System. It is, therefore, affected by a vulnerability as 
referenced in the sk1000117 advisory.

  - An improper certificate validation vulnerability in Check Point Security Gateway and Check Point Spark
    Firewall when configured for Site to Site VPN or Remote Access VPN allows an unauthenticated remote 
    attacker to execute arbitrary code on the Gateway. (CVE-2026-85102)

Note that Nessus has not tested for this issue but has instead relied only on the application's
self-reported version number.");
  # https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?528d65cf");
  script_set_attribute(attribute:"see_also", value:"https://support.checkpoint.com/results/sk/sk1000117");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant patch referenced in the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-85102");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/01");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:check_point:gaia_os");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Firewalls");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("check_point_gaia_os_version.nbin");
  script_require_keys("Host/Check_Point/version", "Host/Check_Point/installed_hotfixes", "Settings/ParanoidReport");

  exit(0);
}

if (report_paranoia < 2) audit(AUDIT_PARANOID);

var app_name = 'Gaia Operating System';
var version  = get_kb_item_or_exit('Host/Check_Point/version');
var hfs      = get_kb_item_or_exit('Host/Check_Point/installed_hotfixes');
var jumbo_hf = get_kb_item('Host/Check_Point/jumbo_hf');
var build    = get_kb_item('Host/Check_Point/build');
var vuln     = FALSE;
var fix;

if (version == 'R82.10')
{
  if ('sk1000117' >!< hfs && (empty_or_null(jumbo_hf) || int(jumbo_hf) < 44))
  {
    vuln = TRUE;
    fix = 'Jumbo Hotfix Accumulator for R82.10 Take 44 or above';
  }
}
else if (version == 'R82' || version == 'R82.00')
{
  if ('sk1000117' >!< hfs && (empty_or_null(jumbo_hf) || int(jumbo_hf) < 126))
  {
    vuln = TRUE;
    fix = 'Jumbo Hotfix Accumulator for R82 Take 126 or above';
  }
}
else if (version == 'R81.20')
{
  if ('sk1000117' >!< hfs && (empty_or_null(jumbo_hf) || int(jumbo_hf) < 166))
  {
    vuln = TRUE;
    fix = 'Jumbo Hotfix Accumulator for R81.20 Take 166 or above';
  }
}
else if (version == 'R81.10')
{
  if ('sk1000117' >!< hfs && (empty_or_null(jumbo_hf) || int(jumbo_hf) < 190))
  {
    vuln = TRUE;
    fix = 'Jumbo Hotfix Accumulator for R81.10 Take 190 or above';
  }
}
else if (version == 'R82.00.10')
{
  if (empty_or_null(build) || int(build) < 2325)
  {
    vuln = TRUE;
    fix = 'Upgrade to R82.00.10 Build 2325 or above';
  }
}
else if (version == 'R81.10.17')
{
  if (empty_or_null(build) || int(build) < 4968)
  {
    vuln = TRUE;
    fix = 'Upgrade to R81.10.17 Build 4968 or above';
  }
}
else if (version == 'R81')
{
  vuln = TRUE;
  fix = 'Upgrade to a supported release. No hotfix is available for this end-of-support version.';
}
else
  audit(AUDIT_DEVICE_NOT_VULN, 'The remote device running ' + app_name + ' (version ' + version + ')');

if (vuln)
{
  var report = '\n  Installed version : ' + version;
  if (!empty_or_null(jumbo_hf) && int(jumbo_hf) > 0)
    report += ' with Jumbo Hotfix Take ' + jumbo_hf;
  else if (!empty_or_null(build) && int(build) > 0)
    report += ' Build ' + build;
  report +=
    '\n  Fix               : ' + fix +
    '\n';
  security_report_v4(port:0, severity:SECURITY_HOLE, extra:report);
}
else
  audit(AUDIT_DEVICE_NOT_VULN, 'The remote device running ' + app_name + ' (version ' + version + ')');