Debian dsa-5843 : rsync - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dsa-5843. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(214097);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/06/19");

  script_cve_id(
    "CVE-2024-12084",
    "CVE-2024-12085",
    "CVE-2024-12086",
    "CVE-2024-12087",
    "CVE-2024-12088",
    "CVE-2024-12747"
  );

  script_name(english:"Debian dsa-5843 : rsync - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the
dsa-5843 advisory.

    - -------------------------------------------------------------------------
    Debian Security Advisory DSA-5843-2                   [email protected]
    Debian Security Advisory DSA-5843-1                   [email protected]
    https://www.debian.org/security/                     Salvatore Bonaccorso
    January 16, 2025                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : rsync
    Debian Bug     : 1093052 1093089
    CVE ID         : CVE-2024-12084 CVE-2024-12085 CVE-2024-12086 CVE-2024-12087
                     CVE-2024-12088 CVE-2024-12747

    The update for rsync announced in DSA 5843-1 introduced a regression
    when using the -H option to preserve hard links. Updated packages are
    now available to correct this issue.

    Several vulnerabilities were discovered in rsync, a fast, versatile,
    remote (and local) file-copying tool.

    CVE-2024-12084

        Simon Scannell, Pedro Gallegos and Jasiel Spelman discovered a
        heap-based buffer overflow vulnerability due to improper handling of
        attacker-controlled checksum lengths. A remote attacker can take
        advantage of this flaw for code execution.

    CVE-2024-12085

        Simon Scannell, Pedro Gallegos and Jasiel Spelman reported a flaw in
        the way rsync compares file checksums, allowing a remote attacker to
        trigger an information leak.

    CVE-2024-12086

        Simon Scannell, Pedro Gallegos and Jasiel Spelman discovered a flaw
        which would result in a server leaking contents of an arbitrary file
        from the client's machine.

    CVE-2024-12087

        Simon Scannell, Pedro Gallegos and Jasiel Spelman reported a path
        traversal vulnerability in the rsync daemon affecting the
        --inc-recursive option, which could allow a server to write files
        outside of the client's intended destination directory.

    CVE-2024-12088

        Simon Scannell, Pedro Gallegos and Jasiel Spelman reported that when
        using the --safe-links option, rsync fails to properly verify if a
        symbolic link destination contains another symbolic link with it,
        resulting in path traversal and arbitrary file write outside of the
        desired directory.

    CVE-2024-12747

        Aleksei Gorban loqpa discovered a race condition when handling
        symbolic links resulting in an information leak which may enable
        escalation of privileges.

    For the stable distribution (bookworm), these problems have been fixed in
    version 3.2.7-1+deb12u2.

    We recommend that you upgrade your rsync packages.

    For the detailed security status of rsync please refer to its security
    tracker page at:
    https://security-tracker.debian.org/tracker/rsync

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/

    Mailing list: [email protected]

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/rsync");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2024-12084");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2024-12085");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2024-12086");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2024-12087");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2024-12088");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2024-12747");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bookworm/rsync");
  script_set_attribute(attribute:"solution", value:
"Upgrade the rsync packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-12084");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2024-12088");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/01/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/01/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/01/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:rsync");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
var package_array;
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(12)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 12.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '12.0', 'prefix': 'rsync', 'reference': '3.2.7-1+deb12u2'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'rsync');
}