Debian DLA-1972-1 : mosquitto security update

#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory DLA-1972-1. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(130285);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/04/16");

  script_cve_id(
    "CVE-2017-7655",
    "CVE-2018-12550",
    "CVE-2018-12551",
    "CVE-2019-11779"
  );

  script_name(english:"Debian DLA-1972-1 : mosquitto security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"Several issues have been found in mosquitto, a MQTT version 3.1/3.1.1
compatible message broker.

CVE-2017-7655

A Null dereference vulnerability in the Mosquitto library could lead
to crashes for those applications using the library.

CVE-2018-12550

An ACL file with no statements was treated as having a default allow
policy. The new behaviour of an empty ACL file is a default policy of
access denied. (this is in compliance with all newer releases)

CVE-2018-12551

Malformed authentication data in the password file could allow clients
to circumvent authentication and get access to the broker.

CVE-2019-11779

Fix for processing a crafted SUBSCRIBE packet containing a topic that
consists of approximately 65400 or more '/' characters. (setting
TOPIC_HIERARCHY_LIMIT to 200)

For Debian 8 'Jessie', these problems have been fixed in version
1.3.4-2+deb8u4.

We recommend that you upgrade your mosquitto packages.

NOTE: Tenable Network Security has extracted the preceding description
block directly from the DLA security advisory. Tenable has attempted
to automatically clean and format it as much as possible without
introducing additional issues.");
  script_set_attribute(attribute:"see_also", value:"https://lists.debian.org/debian-lts-announce/2019/10/msg00035.html");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/jessie/mosquitto");
  script_set_attribute(attribute:"solution", value:
"Upgrade the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-12551");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/03/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/10/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/10/28");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmosquitto-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmosquitto1");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmosquittopp-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmosquittopp1");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:mosquitto");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:mosquitto-clients");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:mosquitto-dbg");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:python-mosquitto");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:python3-mosquitto");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2019-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"8.0", prefix:"libmosquitto-dev", reference:"1.3.4-2+deb8u4")) flag++;
if (deb_check(release:"8.0", prefix:"libmosquitto1", reference:"1.3.4-2+deb8u4")) flag++;
if (deb_check(release:"8.0", prefix:"libmosquittopp-dev", reference:"1.3.4-2+deb8u4")) flag++;
if (deb_check(release:"8.0", prefix:"libmosquittopp1", reference:"1.3.4-2+deb8u4")) flag++;
if (deb_check(release:"8.0", prefix:"mosquitto", reference:"1.3.4-2+deb8u4")) flag++;
if (deb_check(release:"8.0", prefix:"mosquitto-clients", reference:"1.3.4-2+deb8u4")) flag++;
if (deb_check(release:"8.0", prefix:"mosquitto-dbg", reference:"1.3.4-2+deb8u4")) flag++;
if (deb_check(release:"8.0", prefix:"python-mosquitto", reference:"1.3.4-2+deb8u4")) flag++;
if (deb_check(release:"8.0", prefix:"python3-mosquitto", reference:"1.3.4-2+deb8u4")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");