Debian dla-4437 : dirmngr - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4437. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(284513);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/14");

  script_cve_id("CVE-2025-68973");

  script_name(english:"Debian dla-4437 : dirmngr - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing a security-related update.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4437
advisory.

    -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4437-1                [email protected]
    https://www.debian.org/lts/security/                  Roberto C. Snchez
    January 14, 2026                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : gnupg2
    Version        : 2.2.27-2+deb11u3
    CVE ID         : CVE-2025-68973
    Debian Bug     : 1124221

    Several issues have been discovered in gnupg2, a tool for secure
    communication and data storage.

    CVE-2025-68973

        There exist memory corruptions in the armor parsing code of GnuPG
        that can be exploited to provide primitives like out of bounds
        buffer read and write. This might be exploitable to the point of
        remote code execution (RCE).

    Additional issues:

        + Potential key signature digest algorithm downgrade.

          GnuPG may downgrade the message digest algorithm to insecure SHA1
          algorithm during signature checking due to reading from
          uninitialized memory. This reduces the security of User ID
          Certification Signatures to that of SHA1. SHA1 suffers from known
          cryptographic weaknesses like chosen prefix attacks.

        + Multiple plaintext attack on detached PGP signatures.

          An attacker can arbitrarily swap the plaintext shown to a GnuPG
          user, when the user verifies a detached signature versus views it
          with `--decrypt`. This attack allows deceiving users verifying
          messages, following GnuPG usage best practices about the content
          of a message signed with a detached signature. Note, that it is
          possible in many scenarios to convert between signature types,
          i.e., convert a different signature type to a detached signature.

        + GnuPG Accepts Path Separators and Path Traversals in Literal Data.

          GnuPG accepts arbitrary file paths in the unsigned Literal Data
          packet filename field and uses that value without sufficient
          sanitization. In combination with tricking a user with ANSI
          formatted output that changes GnuPG output with deceptive apparent
          GnuPG logs, this can lead to creation or overwrite of any file on
          the system the user can write to, including executable files which
          the user may later execute.

    For Debian 11 bullseye, these problems have been fixed in version
    2.2.27-2+deb11u3.

    We recommend that you upgrade your gnupg2 packages.

    For the detailed security status of gnupg2 please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/gnupg2

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS
    Attachment:
    signature.asc
    Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/gnupg2");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-68973");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bullseye/gnupg2");
  script_set_attribute(attribute:"solution", value:
"Upgrade the dirmngr packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-68973");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:dirmngr");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:gnupg");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:gnupg-agent");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:gnupg-l10n");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:gnupg-utils");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:gnupg2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:gpg");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:gpg-agent");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:gpg-wks-client");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:gpg-wks-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:gpgconf");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:gpgsm");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:gpgv");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:gpgv-static");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:gpgv-udeb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:gpgv-win32");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:gpgv2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:scdaemon");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(11)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 11.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '11.0', 'prefix': 'dirmngr', 'reference': '2.2.27-2+deb11u3'},
    {'release': '11.0', 'prefix': 'gnupg', 'reference': '2.2.27-2+deb11u3'},
    {'release': '11.0', 'prefix': 'gnupg-agent', 'reference': '2.2.27-2+deb11u3'},
    {'release': '11.0', 'prefix': 'gnupg-l10n', 'reference': '2.2.27-2+deb11u3'},
    {'release': '11.0', 'prefix': 'gnupg-utils', 'reference': '2.2.27-2+deb11u3'},
    {'release': '11.0', 'prefix': 'gnupg2', 'reference': '2.2.27-2+deb11u3'},
    {'release': '11.0', 'prefix': 'gpg', 'reference': '2.2.27-2+deb11u3'},
    {'release': '11.0', 'prefix': 'gpg-agent', 'reference': '2.2.27-2+deb11u3'},
    {'release': '11.0', 'prefix': 'gpg-wks-client', 'reference': '2.2.27-2+deb11u3'},
    {'release': '11.0', 'prefix': 'gpg-wks-server', 'reference': '2.2.27-2+deb11u3'},
    {'release': '11.0', 'prefix': 'gpgconf', 'reference': '2.2.27-2+deb11u3'},
    {'release': '11.0', 'prefix': 'gpgsm', 'reference': '2.2.27-2+deb11u3'},
    {'release': '11.0', 'prefix': 'gpgv', 'reference': '2.2.27-2+deb11u3'},
    {'release': '11.0', 'prefix': 'gpgv-static', 'reference': '2.2.27-2+deb11u3'},
    {'release': '11.0', 'prefix': 'gpgv-udeb', 'reference': '2.2.27-2+deb11u3'},
    {'release': '11.0', 'prefix': 'gpgv-win32', 'reference': '2.2.27-2+deb11u3'},
    {'release': '11.0', 'prefix': 'gpgv2', 'reference': '2.2.27-2+deb11u3'},
    {'release': '11.0', 'prefix': 'scdaemon', 'reference': '2.2.27-2+deb11u3'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dirmngr / gnupg / gnupg-agent / gnupg-l10n / gnupg-utils / gnupg2 / etc');
}