Erlang/OTP 17.0 < 27.3.4.15 / 28.0 < 28.5.0.4 / 29.0 < 29.0.4 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(331349);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/31");

  script_cve_id("CVE-2026-55953", "CVE-2026-59250");
  script_xref(name:"IAVA", value:"2026-A-0785");

  script_name(english:"Erlang/OTP 17.0 < 27.3.4.15 / 28.0 < 28.5.0.4 / 29.0 < 29.0.4 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Erlang/OTP installed on the remote host is 17.0 prior to 27.3.4.15, 28.0 prior to
28.5.0.4, or 29.0 prior to 29.0.4. It is, therefore, affected by multiple vulnerabilities:

  - The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite
    selected by the server in ServerHello was among the suites offered by the client in ClientHello.
    An on-path attacker can respond with a ServerHello selecting an anonymous key exchange suite,
    bypassing certificate validation and allowing interception of traffic. (CVE-2026-55953)

  - Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote
    unauthenticated attacker to corrupt the driver's memory by sending a single text-encoded
    H.248/Megaco message containing an oversized property parm name. (CVE-2026-59250)

Note that Nessus has not tested for these issues but has instead relied only on the application's
self-reported version number.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/erlang/otp/security/advisories/GHSA-c6cw-pr89-w882");
  script_set_attribute(attribute:"see_also", value:"https://github.com/erlang/otp/security/advisories/GHSA-7xgh-gmgf-q2g7");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Erlang/OTP version 27.3.4.15, 28.5.0.4, or 29.0.4 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-55953");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-59250");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/31");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:erlang:erlang%2fotp");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ericcson_erlang_otp_win_installed.nbin", "ericsson_erlang_otp_nix_installed.nbin");
  script_require_keys("installed_sw/Erlang-OTP");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Erlang-OTP', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '17.0', 'fixed_version': '27.3.4.15'},
        {'min_version': '28.0', 'fixed_version': '28.5.0.4'},
        {'min_version': '29.0', 'fixed_version': '29.0.4'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);