Debian dla-4764 : libdbi-perl - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4764. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(341671);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/31");

  script_cve_id(
    "CVE-2014-10401",
    "CVE-2014-10402",
    "CVE-2026-14380",
    "CVE-2026-14739",
    "CVE-2026-14740",
    "CVE-2026-15043",
    "CVE-2026-15392",
    "CVE-2026-60081",
    "CVE-2026-60082",
    "CVE-2026-73193",
    "CVE-2026-73194"
  );

  script_name(english:"Debian dla-4764 : libdbi-perl - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 11 / 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the
dla-4764 advisory.

    -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4764-1                [email protected]
    https://www.debian.org/lts/security/                       Guilhem Moulin
    August 31, 2026                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libdbi-perl
    Version        : 1.643-3+deb11u2 1.643-4+deb12u2
    CVE ID         : CVE-2026-14380 CVE-2026-14739 CVE-2026-14740 CVE-2026-15043
                     CVE-2026-15392 CVE-2026-60081 CVE-2026-60082 CVE-2026-73193
                     CVE-2026-73194
    Debian Bug     : 1141667 1142072 1144470 1144471

    Multiple vulnerabilities were discovered in libdbi-perl, the Perl
    Database Interface (DBI), which may lead to arbitrary code execution,
    denial of service, file-backed filter bypass or path traversal.

    CVE-2026-14380

        It was found that missing input validation when interpolating the
        package name in a string `eval` may lead to arbitrary Perl code
        execution from an attacker able controlling the Profile attribute,
        for instance via the `DBI_PROFILE` environment variable or a DSN
        driver-attribute clause `dbi:Driver(Profile=>SPEC):db`.

    CVE-2026-14739

        It was found that preparsing SQL statements with an excessively high
        (over one million) number of placeholders could lead to heap
        overflow.

        This update sets a hard limit of 99999 placeholders.

    CVE-2026-14740

        It was found that preparsing an SQL statement starting with a
        comment line could lead to an out-of-bounds read by one byte.

    CVE-2026-15043

        It was found that DBI::SQL::Nano, DBI's built-in mini-SQL engine,
        evaluated `WHERE` predicates by incorrectly inverting `<=` and `>=`
        SQL operators on text, which may lead to file-backed filter bypass.

    CVE-2026-15392

        It was found that DBD::File did not check whether the table file is
        a symbolic link, which may lead to path traversal if the target
        points outside the `f_dir` and `f_dir_search` directories.

        This issue stems from an incomplete fix for CVE-2014-10401 and
        CVE-2014-10402.

    CVE-2026-60081

        It was found that DBI::ProfileData did not limit the path index when
        parsing a profile-dump file, which may lead to denial of service.

        This updates adds a configurable maximum path depth
        `$DBI::Profile::MAX_PATH_DEPTH`, with a default value of 256.

    CVE-2026-60082

        It was found that missing statement handle consistency checks could
        lead to an out-of-bounds read when a statement handle had no fields
        and the source row was non-empty.

    CVE-2026-73193

        A heap out-of-bounds write issue was found on 32-bit platforms due to
        integer overflow in the output buffer size computed by the `preparse()`
        function.

        This updates limits the size of SQL statements to 292 MiB.

    CVE-2026-73194

        A heap out-of-bounds write issue was found due to unvalidated
        numeric placeholder in the `preparse()` function.

        This issue stems from an incomplete fix for CVE-2026-14739.

    For Debian 11 bullseye, these problems have been fixed in version
    1.643-3+deb11u2.

    For Debian 12 bookworm, these problems have been fixed in version
    1.643-4+deb12u2.

    We recommend that you upgrade your libdbi-perl packages.

    For the detailed security status of libdbi-perl please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/libdbi-perl

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS
    Attachment:
    signature.asc
    Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security-tracker.debian.org/tracker/source-package/libdbi-perl
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a8fc3f03");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2014-10401");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2014-10402");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-14380");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-14739");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-14740");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-15043");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-15392");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-60081");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-60082");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-73193");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-73194");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bookworm/libdbi-perl");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bullseye/libdbi-perl");
  script_set_attribute(attribute:"solution", value:
"Upgrade the libdbi-perl packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2014-10402");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/09/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/31");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libdbi-perl");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(11)\.[0-9]+|^(12)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 11.0 / 12.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '11.0', 'prefix': 'libdbi-perl', 'reference': '1.643-3+deb11u2'},
    {'release': '12.0', 'prefix': 'libdbi-perl', 'reference': '1.643-4+deb12u2'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_NOTE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libdbi-perl');
}