Debian dla-4773 : libssh2-1 - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4773. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(343114);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/05");

  script_cve_id(
    "CVE-2025-15661",
    "CVE-2026-7598",
    "CVE-2026-58050",
    "CVE-2026-58051",
    "CVE-2026-66032",
    "CVE-2026-66034"
  );

  script_name(english:"Debian dla-4773 : libssh2-1 - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dla-4773 advisory.

    -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4773-1                [email protected]
    https://www.debian.org/lts/security/                       Emmanuel Arias
    September 05, 2026                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libssh2
    Version        : 1.10.0-3+deb12u1
    CVE ID         : CVE-2025-15661 CVE-2026-7598 CVE-2026-58050 CVE-2026-58051
                     CVE-2026-66032 CVE-2026-66034
    Debian Bug     : 1140401 1142856 1144415

    Multiple security vulnerabilities were discovered in libssh2, a
    client-side C library implementing the SSH2 protocol which could result
    in memory disclosure, denial of service or potentially the execution of
    arbitrary code.

    CVE-2025-15661

        A malicious server could send an oversized link_len in SSH_FXP_NAME
        responses (READLINK/REALPATH) and trigger an out-of-bounds memcpy, leaking
        heap memory or crashing the client

    CVE-2026-7598

        The impacted element is the function userauth_password of the file
        src/userauth.c. Such manipulation of the argument

    CVE-2026-58050

        libsshw2 reads an attacker-controlled 32-bit attribute without bounds
        checking, so on 32-bit platforms the multiplication overflows to an
        undersized buffer. count from a publickey-subsystem response and uses it
        without bounds checking, causing an overflows to an undersized buffer

    CVE-2026-58051

        libssh2 grows its publickey list with SSH2_REALLOC but does not
        zero-initialize new entries before parsing populates them, so a parse
        failure reaching the cleanup path leaves. A malicious SSH server offering
        the publickey subsystem can use a malformed response to make cleanup free an
        uninitialized, attacker-influenceable attrs pointer in a connecting libssh2
        client.

    CVE-2026-66032

        Fix double free in sftp_open() reachable from a malicious server during SFTP
        session setup (SSH_FXP_OPEN answered with SSH_FXP_STATUS/FX_OK followed by a
        failing sftp_packet_require()) (Closes:

    CVE-2026-66034

        Fix missing bounds check in libssh2_publickey_list_fetch() leading to a heap
        out-of-bounds read and a free of an uninitialized pointer, triggerable by a
        malicious server via the publickey subsystem.


    For Debian 12 bookworm, these problems have been fixed in version
    1.10.0-3+deb12u1.

    We recommend that you upgrade your libssh2 packages.

    For the detailed security status of libssh2 please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/libssh2

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS
    Attachment:
    signature.asc
    Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/libssh2");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-15661");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-58050");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-58051");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-66032");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-66034");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-7598");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bookworm/libssh2");
  script_set_attribute(attribute:"solution", value:
"Upgrade the libssh2-1 packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-7598");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2025-15661");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-66032");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/05");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libssh2-1");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libssh2-1-dev");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(12)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 12.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '12.0', 'prefix': 'libssh2-1', 'reference': '1.10.0-3+deb12u1'},
    {'release': '12.0', 'prefix': 'libssh2-1-dev', 'reference': '1.10.0-3+deb12u1'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libssh2-1 / libssh2-1-dev');
}