Debian dla-4646 : libecpg-compat3 - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4646. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(322551);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/24");

  script_cve_id(
    "CVE-2026-6473",
    "CVE-2026-6474",
    "CVE-2026-6475",
    "CVE-2026-6477",
    "CVE-2026-6478",
    "CVE-2026-6479",
    "CVE-2026-6637"
  );

  script_name(english:"Debian dla-4646 : libecpg-compat3 - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dla-4646 advisory.

    -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4646-1                [email protected]
    https://www.debian.org/lts/security/                       Emmanuel Arias
    June 24, 2026                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : postgresql-13
    Version        : 13.23-0+deb11u4
    CVE ID         : CVE-2026-6473 CVE-2026-6474 CVE-2026-6475 CVE-2026-6477
                     CVE-2026-6478 CVE-2026-6479 CVE-2026-6637
    Debian Bug     :

    Brief introduction

    CVE-2026-6473

        Integer wraparound in multiple PostgreSQL server features allows an
        application input provider to cause the server to undersize an allocation
        and write out-of-bounds.

    CVE-2026-6474

        Externally-controlled format string in PostgreSQL timeofday() function
        allows an attacker to retrieve portions of server memory, via crafted
        timezone zones

    CVE-2026-6475

        Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind
        allows an origin superuser to overwrite local files, that hijack the
        operating system account. It will remain the case that starting the server
        after these commands implicitly trusts the origin superuser, due to features
        like shared_preload_libraries.

    CVE-2026-6477

        Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in
        PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64()
        functions allows the server superuser to overwrite a client stack buffer
        with an arbitrarily-large response.

    CVE-2026-6478

        Covert timing channel in comparison of MD5-hashed password in PostgreSQL
        authentication allows an attacker to recover user credentials sufficient to
        authenticate. This does not affect scram-sha-256 passwords, the default in
        all supported releases. However, current databases may have MD5-hashed
        passwords originating in upgrades from PostgreSQL 13 or earlier.


    CVE-2026-6479

        Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an
        attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained
        denial of service. If SSL and GSS are both disabled, an attacker can do the
        same via access to a PostgreSQL TCP socket

    CVE-2026-6637

        Stack buffer overflow in PostgreSQL module refint allows an unprivileged
        database user to execute arbitrary code as the operating system user running
        the database. A distinct attack is possible if the application declares a
        user-controlled column as a refint cascade primary key and facilitates
        user-controlled updates to that column. In that case, a SQL injection allows
        a primary key update value provider to execute arbitrary SQL as the database
        user performing the primary key update.

    For Debian 11 bullseye, these problems have been fixed in version
    13.23-0+deb11u4.

    We recommend that you upgrade your postgresql-13 packages.

    For the detailed security status of postgresql-13 please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/postgresql-13

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS
    Attachment:
    signature.asc
    Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security-tracker.debian.org/tracker/source-package/postgresql-13
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1964ded4");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-6473");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-6474");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-6475");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-6477");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-6478");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-6479");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-6637");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bullseye/postgresql-13");
  script_set_attribute(attribute:"solution", value:
"Upgrade the libecpg-compat3 packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-6477");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-6637");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/24");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libecpg-compat3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libecpg-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libecpg6");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libpgtypes3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libpq-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libpq5");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:postgresql-13");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:postgresql-client-13");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:postgresql-doc-13");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:postgresql-plperl-13");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:postgresql-plpython3-13");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:postgresql-pltcl-13");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:postgresql-server-dev-13");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(11)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 11.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '11.0', 'prefix': 'libecpg-compat3', 'reference': '13.23-0+deb11u4'},
    {'release': '11.0', 'prefix': 'libecpg-dev', 'reference': '13.23-0+deb11u4'},
    {'release': '11.0', 'prefix': 'libecpg6', 'reference': '13.23-0+deb11u4'},
    {'release': '11.0', 'prefix': 'libpgtypes3', 'reference': '13.23-0+deb11u4'},
    {'release': '11.0', 'prefix': 'libpq-dev', 'reference': '13.23-0+deb11u4'},
    {'release': '11.0', 'prefix': 'libpq5', 'reference': '13.23-0+deb11u4'},
    {'release': '11.0', 'prefix': 'postgresql-13', 'reference': '13.23-0+deb11u4'},
    {'release': '11.0', 'prefix': 'postgresql-client-13', 'reference': '13.23-0+deb11u4'},
    {'release': '11.0', 'prefix': 'postgresql-doc-13', 'reference': '13.23-0+deb11u4'},
    {'release': '11.0', 'prefix': 'postgresql-plperl-13', 'reference': '13.23-0+deb11u4'},
    {'release': '11.0', 'prefix': 'postgresql-plpython3-13', 'reference': '13.23-0+deb11u4'},
    {'release': '11.0', 'prefix': 'postgresql-pltcl-13', 'reference': '13.23-0+deb11u4'},
    {'release': '11.0', 'prefix': 'postgresql-server-dev-13', 'reference': '13.23-0+deb11u4'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libecpg-compat3 / libecpg-dev / libecpg6 / libpgtypes3 / libpq-dev / etc');
}