Debian dla-4755 : libvncclient1 - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4755. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(339429);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/25");

  script_cve_id(
    "CVE-2026-32853",
    "CVE-2026-32854",
    "CVE-2026-44988",
    "CVE-2026-50538"
  );
  script_xref(name:"IAVA", value:"2026-A-0777");

  script_name(english:"Debian dla-4755 : libvncclient1 - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dla-4755 advisory.

    - -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4755-1                [email protected]
    https://www.debian.org/lts/security/                          Abhijith PA
    August 25, 2026                               https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libvncserver
    Version        : 0.9.13+dfsg-2+deb11u2
    CVE ID         : CVE-2026-32853 CVE-2026-32854 CVE-2026-44988 CVE-2026-50538
    Debian Bug     : 1132016 1132017 1138174 1138253

    Several vulnerabilities were discovered in libvncserver, a
    cross-platform library to implement VNC server or client functionality
    in program

    CVE-2026-32853

        a heap out-of-bounds read vulnerability in the UltraZip encoding
        handler that allows a malicious VNC server to cause information
        disclosure or application crash. Attackers can exploit improper
        bounds checking in the HandleUltraZipBPP() function by
        manipulating subrectangle header counts to read beyond the
        allocated heap buffer

    CVE-2026-32854

        null pointer dereference vulnerabilities in the HTTP proxy
        handlers within httpProcessInput() in httpd.c that allow remote
        attackers to cause a denial of service by sending specially
        crafted HTTP requests. Attackers can exploit missing validation of
        strchr() return values in the CONNECT and GET proxy handling paths
        to trigger null pointer dereferences and crash the server when
        httpd and proxy features are enabled.

    CVE-2026-44988

        LibVNCClient Tight Gradient decoding allows malicious
        server-triggered heap/stack out-of-bounds writes

    CVE-2026-50538

        a malicious (or man-in-the-middle) VNC server can force a
        connecting `libvncclient` to write attacker-controlled data past
        the end of its framebuffer. This is an out-of-bounds heap write
        with attacker-controlled length, contents, and offset.

    For Debian 11 bullseye, these problems have been fixed in version
    0.9.13+dfsg-2+deb11u2.

    We recommend that you upgrade your libvncserver packages.

    For the detailed security status of libvncserver please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/libvncserver

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security-tracker.debian.org/tracker/source-package/libvncserver
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b930abb4");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-32853");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-32854");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-44988");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-50538");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bullseye/libvncserver");
  script_set_attribute(attribute:"solution", value:
"Upgrade the libvncclient1 packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-32853");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/25");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libvncclient1");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libvncserver-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libvncserver1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(11)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 11.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '11.0', 'prefix': 'libvncclient1', 'reference': '0.9.13+dfsg-2+deb11u2'},
    {'release': '11.0', 'prefix': 'libvncserver-dev', 'reference': '0.9.13+dfsg-2+deb11u2'},
    {'release': '11.0', 'prefix': 'libvncserver1', 'reference': '0.9.13+dfsg-2+deb11u2'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libvncclient1 / libvncserver-dev / libvncserver1');
}