Debian dsa-6464 : erlang - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dsa-6464. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(339216);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/25");

  script_cve_id(
    "CVE-2026-28808",
    "CVE-2026-28810",
    "CVE-2026-32144",
    "CVE-2026-32147",
    "CVE-2026-42789",
    "CVE-2026-42790",
    "CVE-2026-42791",
    "CVE-2026-42792",
    "CVE-2026-47078",
    "CVE-2026-48855",
    "CVE-2026-48856",
    "CVE-2026-48858",
    "CVE-2026-48860",
    "CVE-2026-49759",
    "CVE-2026-49760",
    "CVE-2026-53422",
    "CVE-2026-54886",
    "CVE-2026-54887",
    "CVE-2026-54890",
    "CVE-2026-54891",
    "CVE-2026-55737",
    "CVE-2026-55950",
    "CVE-2026-55952",
    "CVE-2026-55953",
    "CVE-2026-58227",
    "CVE-2026-59250",
    "CVE-2026-59251"
  );
  script_xref(name:"IAVA", value:"2026-A-0309-S");
  script_xref(name:"IAVA", value:"2026-A-0522-S");
  script_xref(name:"IAVA", value:"2026-A-0594");
  script_xref(name:"IAVA", value:"2026-A-0655-S");
  script_xref(name:"IAVA", value:"2026-A-0785");

  script_name(english:"Debian dsa-6464 : erlang - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dsa-6464 advisory.

    - -------------------------------------------------------------------------
    Debian Security Advisory DSA-6464-1                   [email protected]
    https://www.debian.org/security/                                  Aron Xu
    August 25, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : erlang
    CVE ID         : CVE-2026-28808 CVE-2026-28810 CVE-2026-32144 CVE-2026-32147
                     CVE-2026-42789 CVE-2026-42790 CVE-2026-42791 CVE-2026-42792
                     CVE-2026-47078 CVE-2026-48855 CVE-2026-48856 CVE-2026-48858
                     CVE-2026-48860 CVE-2026-49759 CVE-2026-49760 CVE-2026-53422
                     CVE-2026-54886 CVE-2026-54887 CVE-2026-54890 CVE-2026-54891
                     CVE-2026-55737 CVE-2026-55950 CVE-2026-55952 CVE-2026-55953
                     CVE-2026-58227 CVE-2026-59250 CVE-2026-59251
    Debian Bug     : 1139727 1139823 1141414 1142985

    Multiple vulnerabilities were discovered in Erlang/OTP, a concurrent,
    real-time, distributed functional language, which may result in denial of
    service, information disclosure, authentication and certificate validation
    bypass, or the execution of arbitrary code. These vulnerbilities affect a
    wide range of components: TLS and certificate validation (ssl, public_key),
    SSH (ssh), network clients and servers (inets, ftp, epmd, kernel),
    runtime and libraries (erts, erl_interface, stdlib, megaco).

    Several of these fixes tighten checks that were previously too permissive,
    and can cause configurations that worked before to stop working. The most
    likely to be noticed are:

     - TLS clients using verify_peer, which is the default, now reject
       certificates that carry no subjectAltName extension; the
       customize_hostname_check option does not restore the old behaviour.

     - Erlang distribution over TLS with the kernel 'check_ip' option now
       enforces the check that was previously a no-op, so clusters whose nodes
       are not on the same subnet lose distribution connectivity until the
       option is unset.

     - TLS clients that request OCSP stapling now fail the handshake when the
       server provides no stapled response.

     - Clients using TLS 1.2 or earlier now abort the handshake if the server
       sends an ALPN extension that the client did not advertise.

     - DNS queries made through inet_res now use randomised source ports

    For the stable distribution (trixie), these problems have been fixed in
    version 1:27.3.4.1+dfsg-1+deb13u3.

    We recommend that you upgrade your erlang packages.

    For the detailed security status of erlang please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/erlang

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/

    Mailing list: [email protected]

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/erlang");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-28808");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-28810");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-32144");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-32147");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-42789");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-42790");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-42791");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-42792");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-47078");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-48855");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-48856");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-48858");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-48860");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-49759");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-49760");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-53422");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-54886");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-54887");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-54890");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-54891");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-55737");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-55950");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-55952");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-55953");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-58227");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-59250");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-59251");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/trixie/erlang");
  script_set_attribute(attribute:"solution", value:
"Upgrade the erlang packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-28808");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-55953");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/25");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-asn1");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-base");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-common-test");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-crypto");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-debugger");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-dialyzer");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-diameter");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-edoc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-eldap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-et");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-eunit");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-examples");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-ftp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-inets");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-jinterface");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-megaco");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-mnesia");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-mode");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-nox");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-observer");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-odbc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-os-mon");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-parsetools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-public-key");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-reltool");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-runtime-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-snmp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-src");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-ssh");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-ssl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-syntax-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-tftp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-wx");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-x11");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:erlang-xmerl");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:13.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(13)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 13.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '13.0', 'prefix': 'erlang', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-asn1', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-base', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-common-test', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-crypto', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-debugger', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-dev', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-dialyzer', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-diameter', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-doc', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-edoc', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-eldap', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-et', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-eunit', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-examples', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-ftp', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-inets', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-jinterface', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-megaco', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-mnesia', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-mode', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-nox', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-observer', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-odbc', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-os-mon', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-parsetools', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-public-key', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-reltool', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-runtime-tools', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-snmp', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-src', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-ssh', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-ssl', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-syntax-tools', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-tftp', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-tools', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-wx', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-x11', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'},
    {'release': '13.0', 'prefix': 'erlang-xmerl', 'reference': '1:27.3.4.1+dfsg-1+deb13u3'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'erlang / erlang-asn1 / erlang-base / erlang-common-test / etc');
}