EulerOS 2.0 SP5 : libdwarf (EulerOS-SA-2019-2204)

#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(130666);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/04/15");

  script_cve_id(
    "CVE-2015-8538",
    "CVE-2016-5034",
    "CVE-2016-5036",
    "CVE-2016-5038",
    "CVE-2016-5039",
    "CVE-2016-5040",
    "CVE-2016-5042",
    "CVE-2016-5043"
  );

  script_name(english:"EulerOS 2.0 SP5 : libdwarf (EulerOS-SA-2019-2204)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the libdwarf package installed, the
EulerOS installation on the remote host is affected by the following
vulnerabilities :

  - dwarf_leb.c in libdwarf allows attackers to cause a
    denial of service (SIGSEGV).(CVE-2015-8538)

  - The dwarf_dealloc function in libdwarf before 20160923
    allows remote attackers to cause a denial of service
    (out-of-bounds read and crash) via a crafted DWARF
    section.(CVE-2016-5043)

  - The dwarf_get_aranges_list function in libdwarf before
    20160923 allows remote attackers to cause a denial of
    service (infinite loop and crash) via a crafted DWARF
    section.(CVE-2016-5042)

  - libdwarf before 20160923 allows remote attackers to
    cause a denial of service (out-of-bounds read and
    crash) via a large length value in a compilation unit
    header.(CVE-2016-5040)

  - The get_attr_value function in libdwarf before 20160923
    allows remote attackers to cause a denial of service
    (out-of-bounds read) via a crafted object with all-bits
    on.(CVE-2016-5039)

  - The dwarf_get_macro_startend_file function in
    dwarf_macro5.c in libdwarf before 20160923 allows
    remote attackers to cause a denial of service
    (out-of-bounds read) via a crafted string offset for
    .debug_str.(CVE-2016-5038)

  - The dump_block function in print_sections.c in libdwarf
    before 20160923 allows remote attackers to cause a
    denial of service (out-of-bounds read) via crafted
    frame data.(CVE-2016-5036)

  - dwarf_elf_access.c in libdwarf before 20160923 allows
    remote attackers to cause a denial of service
    (out-of-bounds write) via a crafted file, related to
    relocation records.(CVE-2016-5034)

Note that Tenable Network Security has extracted the preceding
description block directly from the EulerOS security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-2204
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ec3c9e9a");
  script_set_attribute(attribute:"solution", value:
"Update the affected libdwarf packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-5043");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"patch_publication_date", value:"2019/10/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/11/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libdwarf");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2019-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item("Host/EulerOS/release");
if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");

sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(5)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP5");

uvp = get_kb_item("Host/EulerOS/uvp_version");
if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP5", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

flag = 0;

pkgs = ["libdwarf-20180809-1.h1.eulerosv2r7"];

foreach (pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"5", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libdwarf");
}