Debian dla-4479 : libwireshark-data - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4479. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(299185);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/10");

  script_cve_id(
    "CVE-2024-9781",
    "CVE-2024-11596",
    "CVE-2025-5601",
    "CVE-2025-11626",
    "CVE-2025-13499",
    "CVE-2025-13945",
    "CVE-2025-13946",
    "CVE-2026-0960"
  );
  script_xref(name:"IAVB", value:"2024-B-0153-S");
  script_xref(name:"IAVB", value:"2024-B-0185-S");
  script_xref(name:"IAVB", value:"2025-B-0086-S");
  script_xref(name:"IAVB", value:"2025-B-0170-S");
  script_xref(name:"IAVB", value:"2025-B-0197-S");
  script_xref(name:"IAVB", value:"2026-B-0022-S");

  script_name(english:"Debian dla-4479 : libwireshark-data - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dla-4479 advisory.

    -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4479-1                [email protected]
    https://www.debian.org/lts/security/                   Jochen Sprickerhof
    February 16, 2026                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : wireshark
    Version        : 3.4.16-0+deb11u2
    CVE ID         : CVE-2024-9781 CVE-2024-11596 CVE-2025-5601 CVE-2025-11626
                     CVE-2025-13499 CVE-2025-13945 CVE-2025-13946 CVE-2026-0960
    Debian Bug     :

    Multiple vulnerabilities have been fixed in the network traffic analyzer
    Wireshark.

    CVE-2024-9781

        AppleTalk and RELOAD Framing dissector crash allows denial of
        service via packet injection or crafted capture file.

    CVE-2024-11596

        ECMP dissector crash allows denial of service via packet injection
        or crafted capture file.

    CVE-2025-5601

        Column handling crashes allows denial of service via packet
        injection or crafted capture file.

    CVE-2025-11626

        MONGO dissector infinite loop allows denial of service.

    CVE-2025-13499

        Kafka dissector crash allows denial of service.

    CVE-2025-13945

        HTTP3 dissector crash allows denial of service.

    CVE-2025-13946

        MEGACO dissector infinite loop in allows denial of service.

    CVE-2026-0960

        HTTP3 protocol dissector infinite loop allows denial of service.

    For Debian 11 bullseye, these problems have been fixed in version
    3.4.16-0+deb11u2.

    We recommend that you upgrade your wireshark packages.

    For the detailed security status of wireshark please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/wireshark

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS
    Attachment:
    signature.asc
    Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/wireshark");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2024-11596");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2024-9781");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-11626");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-13499");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-13945");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-13946");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-5601");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-0960");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bullseye/wireshark");
  script_set_attribute(attribute:"solution", value:
"Upgrade the libwireshark-data packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-5601");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2024-9781");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/10/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/02/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libwireshark-data");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libwireshark-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libwireshark14");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libwiretap-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libwiretap11");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libwsutil-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libwsutil12");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:tshark");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:wireshark");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:wireshark-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:wireshark-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:wireshark-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:wireshark-gtk");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:wireshark-qt");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(11)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 11.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '11.0', 'prefix': 'libwireshark-data', 'reference': '3.4.16-0+deb11u2'},
    {'release': '11.0', 'prefix': 'libwireshark-dev', 'reference': '3.4.16-0+deb11u2'},
    {'release': '11.0', 'prefix': 'libwireshark14', 'reference': '3.4.16-0+deb11u2'},
    {'release': '11.0', 'prefix': 'libwiretap-dev', 'reference': '3.4.16-0+deb11u2'},
    {'release': '11.0', 'prefix': 'libwiretap11', 'reference': '3.4.16-0+deb11u2'},
    {'release': '11.0', 'prefix': 'libwsutil-dev', 'reference': '3.4.16-0+deb11u2'},
    {'release': '11.0', 'prefix': 'libwsutil12', 'reference': '3.4.16-0+deb11u2'},
    {'release': '11.0', 'prefix': 'tshark', 'reference': '3.4.16-0+deb11u2'},
    {'release': '11.0', 'prefix': 'wireshark', 'reference': '3.4.16-0+deb11u2'},
    {'release': '11.0', 'prefix': 'wireshark-common', 'reference': '3.4.16-0+deb11u2'},
    {'release': '11.0', 'prefix': 'wireshark-dev', 'reference': '3.4.16-0+deb11u2'},
    {'release': '11.0', 'prefix': 'wireshark-doc', 'reference': '3.4.16-0+deb11u2'},
    {'release': '11.0', 'prefix': 'wireshark-gtk', 'reference': '3.4.16-0+deb11u2'},
    {'release': '11.0', 'prefix': 'wireshark-qt', 'reference': '3.4.16-0+deb11u2'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libwireshark-data / libwireshark-dev / libwireshark14 / libwiretap-dev / etc');
}