Debian DSA-037-1 : Athena Widget replacement libraries - insecure tempfile handling

#%NASL_MIN_LEVEL 70300

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-037. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(14874);
  script_version("1.16");
  script_set_attribute(attribute:"plugin_modification_date", value:"2021/01/04");

  script_xref(name:"DSA", value:"037");

  script_name(english:"Debian DSA-037-1 : Athena Widget replacement libraries - insecure tempfile handling");
  script_summary(english:"Checks dpkg output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"It has been reported that the AsciiSrc and MultiSrc widget in the
Athena widget library handle temporary files insecurely. Joey Hess has
ported the bugfix from XFree86 to these Xaw replacements libraries.
The fixes are available in nextaw 0.5.1-34potato1, xaw3d
1.3-6.9potato1, and xaw95 1.1-4.6potato1."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.debian.org/security/2001/dsa-037"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Upgrade the affected nextaw, xaw3d, and xaw95 packages."
  );
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:nextaw");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xaw3d");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xaw95");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:2.2");

  script_set_attribute(attribute:"patch_publication_date", value:"2001/03/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2004/09/29");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2004-2021 Tenable Network Security, Inc.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"2.2", prefix:"nextaw", reference:"0.5.1-34potato1")) flag++;
if (deb_check(release:"2.2", prefix:"nextawg", reference:"0.5.1-34potato1")) flag++;
if (deb_check(release:"2.2", prefix:"xaw3d", reference:"1.3-6.9potato1")) flag++;
if (deb_check(release:"2.2", prefix:"xaw3dg", reference:"1.3-6.9potato1")) flag++;
if (deb_check(release:"2.2", prefix:"xaw3dg-dev", reference:"1.3-6.9potato1")) flag++;
if (deb_check(release:"2.2", prefix:"xaw95g", reference:"1.1-4.6potato1")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");