Debian dla-4760 : roundcube - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4760. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(341564);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/29");

  script_cve_id(
    "CVE-2026-35540",
    "CVE-2026-48843",
    "CVE-2026-62643",
    "CVE-2026-74997",
    "CVE-2026-74998",
    "CVE-2026-74999",
    "CVE-2026-75000",
    "CVE-2026-75002",
    "CVE-2026-75003",
    "CVE-2026-75004",
    "CVE-2026-75006",
    "CVE-2026-75007",
    "CVE-2026-75010"
  );
  script_xref(name:"IAVA", value:"2026-A-0301-S");
  script_xref(name:"IAVA", value:"2026-A-0521");
  script_xref(name:"IAVA", value:"2026-A-0663");

  script_name(english:"Debian dla-4760 : roundcube - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dla-4760 advisory.

    -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4760-1                [email protected]
    https://www.debian.org/lts/security/                       Guilhem Moulin
    August 29, 2026                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : roundcube
    Version        : 1.4.15+dfsg.1-1+deb11u11 1.6.5+dfsg-1+deb12u11
    CVE ID         : CVE-2026-74997 CVE-2026-74998 CVE-2026-74999 CVE-2026-75000
                     CVE-2026-75002 CVE-2026-75003 CVE-2026-75004 CVE-2026-75006
                     CVE-2026-75007 CVE-2026-75010
    Debian Bug     : 1144059

    Multiple vulnerabilities were discovered in Roundcube, a skinnable AJAX based
    webmail solution for IMAP servers, which could result in cross-site scripting,
    server-side request forgery, information disclosure, privilege escalation, IMAP
    injection, account takeover, or remote code execution.

    CVE-2026-74997

        A remote code execution vulnerability was found in the cmd_learn learning
        driver of the markasjunk plugin.  Placeholders such as %u (username), %l
        (localpart) and %d (domainpart) were injected with insufficiently
        sanitized/escaped values used within a `sh -c ''` shell construction,
        thereby allowing remote code execution from the user used to run roundcube
        (by default www-data).

        Only installations where 1/ the markasjunk plugin was enabled, and 2/
        where the `$config['markasjunk_learning_driver']` setting was set to
        `cmd_learn`, were affected by this vulnerability.  In particular, stock
        installations were not affected since the plugin is not enabled by default.

    CVE-2026-74998

        Content proxied by the CSS proxy (which is used to retrieve remote style
        sheets linked to in text/html emails) was found to be lacking basic
        validation, which may result in information disclosure or XSS (cross-site
        scripting) via MIME sniffing.

    CVE-2026-74999

        Paulos Yibelo discovered that the Add to address book action was subject
        to stored XSS due to insufficient sanitization of error messages and
        information popups.

    CVE-2026-75000

        Insufficient HTML/CSS sanitization may lead to remote image blocking bypass
        or XSS via crafted SVG animate `by` attribute sent in malicious text/html
        emails.

    CVE-2026-75002

        Zach Hanley discovered that mail search and RFC2088 IMAP4 LITERAL+
        byte-count desynchronization may lead to IMAP command injection.

    CVE-2026-75003

        Milan Hoppe discovered that insufficient HTML/CSS sanitization may lead to
        remote image blocking bypass or XSS via unclosed url() in a FuncIRI
        attribute.

    CVE-2026-75004

        Milan Hoppe discovered that managesieve rule names were not sanitized,
        thereby allowing arbitrary sieve injection and bypass of the
        managesieve_disabled_actions restriction set by an administrator.

        This vulnerability only affects installations where the managesieve plugin
        is enabled.  In particular, stock installations were not affected since the
        plugin is not enabled by default.

    CVE-2026-75006

        Dmytro Ivanenko and Milan Hoppe discovered that that the CSS sanitization
        fixes for CVE-2026-35540, CVE-2026-48843 and CVE-2026-62643 were
        insufficient, allowing a malicious embedded stylesheet in a text/html email
        to lead to SSRF or information disclosure.

    CVE-2026-75007

        Milan Hoppe discovered that the LDAP integration was subject to filter
        injection via unescaped %u/%fu/%d substitution.

    CVE-2026-75010

        The modoba driver of the password plugin was found to be leaking an
        authentication token, which may lead to account takeover.

        Only installations where 1/ the password plugin was enabled, and 2/
        where the `$config['password_driver']` setting was set to `modoboa`,
        were affected by this vulnerability.  In particular, stock installations
        were not affected since the password plugin is not enabled by default.

    For Debian 11 bullseye, these problems have been fixed in version
    1.4.15+dfsg.1-1+deb11u11.

    For Debian 12 bookworm, these problems have been fixed in version
    1.6.5+dfsg-1+deb12u11.

    We recommend that you upgrade your roundcube packages.

    For the detailed security status of roundcube please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/roundcube

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS
    Attachment:
    signature.asc
    Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/roundcube");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-35540");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-48843");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-62643");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-74997");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-74998");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-74999");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-75000");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-75002");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-75003");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-75004");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-75006");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-75007");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-75010");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bookworm/roundcube");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bullseye/roundcube");
  script_set_attribute(attribute:"solution", value:
"Upgrade the roundcube packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-62643");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/31");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/29");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:roundcube");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:roundcube-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:roundcube-mysql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:roundcube-pgsql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:roundcube-plugins");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:roundcube-sqlite3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(11)\.[0-9]+|^(12)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 11.0 / 12.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '11.0', 'prefix': 'roundcube', 'reference': '1.4.15+dfsg.1-1+deb11u11'},
    {'release': '11.0', 'prefix': 'roundcube-core', 'reference': '1.4.15+dfsg.1-1+deb11u11'},
    {'release': '11.0', 'prefix': 'roundcube-mysql', 'reference': '1.4.15+dfsg.1-1+deb11u11'},
    {'release': '11.0', 'prefix': 'roundcube-pgsql', 'reference': '1.4.15+dfsg.1-1+deb11u11'},
    {'release': '11.0', 'prefix': 'roundcube-plugins', 'reference': '1.4.15+dfsg.1-1+deb11u11'},
    {'release': '11.0', 'prefix': 'roundcube-sqlite3', 'reference': '1.4.15+dfsg.1-1+deb11u11'},
    {'release': '12.0', 'prefix': 'roundcube', 'reference': '1.6.5+dfsg-1+deb12u11'},
    {'release': '12.0', 'prefix': 'roundcube-core', 'reference': '1.6.5+dfsg-1+deb12u11'},
    {'release': '12.0', 'prefix': 'roundcube-mysql', 'reference': '1.6.5+dfsg-1+deb12u11'},
    {'release': '12.0', 'prefix': 'roundcube-pgsql', 'reference': '1.6.5+dfsg-1+deb12u11'},
    {'release': '12.0', 'prefix': 'roundcube-plugins', 'reference': '1.6.5+dfsg-1+deb12u11'},
    {'release': '12.0', 'prefix': 'roundcube-sqlite3', 'reference': '1.6.5+dfsg-1+deb12u11'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'roundcube / roundcube-core / roundcube-mysql / roundcube-pgsql / etc');
}