Debian dla-3983 : clamav - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-3983. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(212107);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id("CVE-2024-20505", "CVE-2024-20506");
  script_xref(name:"IAVB", value:"2024-B-0134-S");

  script_name(english:"Debian dla-3983 : clamav - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dla-3983 advisory.

    - -------------------------------------------------------------------------
    Debian LTS Advisory DLA-3983-1                [email protected]
    https://www.debian.org/lts/security/                      Lucas Kanashiro
    December 04, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : clamav
    Version        : 1.0.7+dfsg-1~deb11u1
    CVE ID         : CVE-2024-20505 CVE-2024-20506
    Debian Bug     : #1080962

    Two vulnerabilities were found in ClamAV, an antivirus toolkit for Unix.

    CVE-2024-20505

        Affected versions could allow an unauthenticated, remote attacker to cause
        a denial of service (DoS) condition on an affected device. The
        vulnerability is due to an out of bounds read. An attacker could exploit
        this vulnerability by submitting a crafted PDF file to be scanned by ClamAV
        on an affected device. An exploit could allow the attacker to terminate the
        scanning process.

    CVE-2024-20506

        Affected versions could allow an authenticated, local attacker to corrupt
        critical system files. The vulnerability is due to allowing the ClamD
        process to write to its log file while privileged without checking if the
        logfile has been replaced with a symbolic link. An attacker could exploit
        this vulnerability if they replace the ClamD log file with a symlink to a
        critical system file and then find a way to restart the ClamD process. An
        exploit could allow the attacker to corrupt a critical system file by
        appending ClamD log messages after restart.

    ClamAV was updated to version 1.0.7+dfsg-1~deb10u1. Due to the library soname
    bump, the reverse dependencies of libclamav9 were rebuilt against libclamav11.
    The following source packages were updated:

    - - c-icap-modules/1:0.5.4-2+deb11u1
    - - cyrus-imapd/3.2.6-2+deb11u3
    - - havp/0.93-2+deb11u1
    - - pg-snakeoil/1.3-2+deb11u1
    - - libclamunrar/1.0.3-1~deb11u1

    For Debian 11 bullseye, these problems have been fixed in version
    1.0.7+dfsg-1~deb11u1.

    We recommend that you upgrade your clamav packages.

    For the detailed security status of clamav please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/clamav

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/clamav");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2024-20505");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2024-20506");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bullseye/clamav");
  script_set_attribute(attribute:"solution", value:
"Upgrade the clamav packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:P/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-20506");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/09/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/12/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/12/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:clamav");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:clamav-base");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:clamav-daemon");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:clamav-docs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:clamav-freshclam");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:clamav-milter");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:clamav-testfiles");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:clamdscan");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libclamav-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libclamav11");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2024-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(11)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 11.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '11.0', 'prefix': 'clamav', 'reference': '1.0.7+dfsg-1~deb11u1'},
    {'release': '11.0', 'prefix': 'clamav-base', 'reference': '1.0.7+dfsg-1~deb11u1'},
    {'release': '11.0', 'prefix': 'clamav-daemon', 'reference': '1.0.7+dfsg-1~deb11u1'},
    {'release': '11.0', 'prefix': 'clamav-docs', 'reference': '1.0.7+dfsg-1~deb11u1'},
    {'release': '11.0', 'prefix': 'clamav-freshclam', 'reference': '1.0.7+dfsg-1~deb11u1'},
    {'release': '11.0', 'prefix': 'clamav-milter', 'reference': '1.0.7+dfsg-1~deb11u1'},
    {'release': '11.0', 'prefix': 'clamav-testfiles', 'reference': '1.0.7+dfsg-1~deb11u1'},
    {'release': '11.0', 'prefix': 'clamdscan', 'reference': '1.0.7+dfsg-1~deb11u1'},
    {'release': '11.0', 'prefix': 'libclamav-dev', 'reference': '1.0.7+dfsg-1~deb11u1'},
    {'release': '11.0', 'prefix': 'libclamav11', 'reference': '1.0.7+dfsg-1~deb11u1'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'clamav / clamav-base / clamav-daemon / clamav-docs / clamav-freshclam / etc');
}