Debian dla-4584 : openssh-client - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4584. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(314975);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/15");

  script_cve_id(
    "CVE-2025-61984",
    "CVE-2025-61985",
    "CVE-2026-35385",
    "CVE-2026-35386",
    "CVE-2026-35387",
    "CVE-2026-35388",
    "CVE-2026-35414"
  );
  script_xref(name:"IAVA", value:"2025-A-0729-S");
  script_xref(name:"IAVA", value:"2025-A-0806-S");
  script_xref(name:"IAVA", value:"2026-A-0296");

  script_name(english:"Debian dla-4584 : openssh-client - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dla-4584 advisory.

    -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4584-1                [email protected]
    https://www.debian.org/lts/security/               Santiago Ruano Rincn
    May 15, 2026                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : openssh
    Version        : 1:8.4p1-5+deb11u7
    CVE ID         : CVE-2025-61984 CVE-2025-61985 CVE-2026-35385 CVE-2026-35386
                     CVE-2026-35387 CVE-2026-35388 CVE-2026-35414
    Debian Bug     : 1117529 1117530 1132572 1132573 1132574 1132575 1132576

    Several vulnerabilities have been discovered in OpenSSH, an implementation of
    the SSH protocol suite.

    CVE-2025-61984

        ssh allows control characters in usernames that originate from certain
        possibly untrusted sources, potentially leading to code execution when a
        ProxyCommand is used.

    CVE-2025-61985

        ssh allows the '\0' character in an ssh:// URI, potentially leading to code
        execution when a ProxyCommand is used.

    CVE-2026-35385

        When downloading files as root in legacy (-O) mode and without the -p
        (preserve modes) flag set, scp did not clear setuid/setgid bits from
        downloaded files as one might typically expect.  This bug dates back to the
        original Berkeley rcp program.  Reported by Christos Papakonstantinou of
        Cantina and Spearbit.

    CVE-2026-35386

        Validation of shell metacharacters in user names supplied on the
        command-line was performed too late to prevent some situations where they
        could be expanded from %-tokens in ssh_config. For certain configurations,
        such as those that use a %u token in a Match exec block, an attacker
        who can control the user name passed to ssh(1) could potentially execute
        arbitrary shell commands. Reported by Florian Kohnhuser.

        OpenSSH developers continue to recommend against directly exposing ssh(1)
        and other tools' command-lines to untrusted input. Mitigations as the one
        addressing this issue can not be absolute given the variety of shells and
        user configurations in use.

    CVE-2026-35387

        ssh can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in
        PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted
        to mean all ECDSA algorithms. Reported by Christos Papakonstantinou of
        Cantina and Spearbit.

    CVE-2026-35388

        Connection multiplexing confirmation (requested using ControlMaster
        ask/autoask) was not being tested for proxy mode multiplexing sessions (i.e.
        ssh -O proxy ...). Reported by Michalis Vasileiadis.

    CVE-2026-35414

        When matching an authorized_keys principals= option against a list of
        principals in a certificate, an incorrect algorithm was used that could
        allow inappropriate matching in cases where a principal name in the
        certificate contains a comma character. Exploitation of the condition requires
        an authorized_keys principals= option that lists more than one principal
        *and* a CA that will issue a certificate that encodes more than one of
        these principal names separated by a comma (typical CAs strongly constrain
        which principal names they will place in a certificate). This condition
        only applies to user- trusted CA keys in authorized_keys, the main
        certificate authentication path
        (TrustedUserCAKeys/AuthorizedPrincipalsFile) is not affected. Reported by
        Vladimir Tokarev.

    For Debian 11 bullseye, these problems have been fixed in version
    1:8.4p1-5+deb11u7.

    We recommend that you upgrade your openssh packages.

    For the detailed security status of openssh please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/openssh

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS
    Attachment:
    signature.asc
    Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/openssh");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-61984");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-61985");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-35385");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-35386");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-35387");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-35388");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-35414");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bullseye/openssh");
  script_set_attribute(attribute:"solution", value:
"Upgrade the openssh-client packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-35414");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/10/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/05/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:openssh-client");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:openssh-client-udeb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:openssh-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:openssh-server-udeb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:openssh-sftp-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:openssh-tests");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:ssh");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:ssh-askpass-gnome");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(11)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 11.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '11.0', 'prefix': 'openssh-client', 'reference': '1:8.4p1-5+deb11u7'},
    {'release': '11.0', 'prefix': 'openssh-client-udeb', 'reference': '1:8.4p1-5+deb11u7'},
    {'release': '11.0', 'prefix': 'openssh-server', 'reference': '1:8.4p1-5+deb11u7'},
    {'release': '11.0', 'prefix': 'openssh-server-udeb', 'reference': '1:8.4p1-5+deb11u7'},
    {'release': '11.0', 'prefix': 'openssh-sftp-server', 'reference': '1:8.4p1-5+deb11u7'},
    {'release': '11.0', 'prefix': 'openssh-tests', 'reference': '1:8.4p1-5+deb11u7'},
    {'release': '11.0', 'prefix': 'ssh', 'reference': '1:8.4p1-5+deb11u7'},
    {'release': '11.0', 'prefix': 'ssh-askpass-gnome', 'reference': '1:8.4p1-5+deb11u7'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'openssh-client / openssh-client-udeb / openssh-server / etc');
}