EulerOS 2.0 SP2 : libX11 (EulerOS-SA-2019-2480)

#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(131633);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/04/08");

  script_cve_id(
    "CVE-2016-7942",
    "CVE-2016-7943",
    "CVE-2018-14598",
    "CVE-2018-14599",
    "CVE-2018-14600"
  );

  script_name(english:"EulerOS 2.0 SP2 : libX11 (EulerOS-SA-2019-2480)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the libX11 packages installed, the
EulerOS installation on the remote host is affected by the following
vulnerabilities :

  - The XGetImage function in X.org libX11 before 1.6.4
    might allow remote X servers to gain privileges via
    vectors involving image type and geometry, which
    triggers out-of-bounds read operations.(CVE-2016-7942)

  - The XListFonts function in X.org libX11 before 1.6.4
    might allow remote X servers to gain privileges via
    vectors involving length fields, which trigger
    out-of-bounds write operations.(CVE-2016-7943)

  - An issue was discovered in XListExtensions in ListExt.c
    in libX11 through 1.6.5. A malicious server can send a
    reply in which the first string overflows, causing a
    variable to be set to NULL that will be freed later on,
    leading to DoS (segmentation fault).(CVE-2018-14598)

  - An issue was discovered in libX11 through 1.6.5. The
    function XListExtensions in ListExt.c is vulnerable to
    an off-by-one error caused by malicious server
    responses, leading to DoS or possibly unspecified other
    impact.(CVE-2018-14599)

  - An issue was discovered in libX11 through 1.6.5. The
    function XListExtensions in ListExt.c interprets a
    variable as signed instead of unsigned, resulting in an
    out-of-bounds write (of up to 128 bytes), leading to
    DoS or remote code execution.(CVE-2018-14600)

Note that Tenable Network Security has extracted the preceding
description block directly from the EulerOS security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-2480
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?10a09004");
  script_set_attribute(attribute:"solution", value:
"Update the affected libX11 packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-14600");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"patch_publication_date", value:"2019/12/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/12/04");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libX11");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libX11-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libX11-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2019-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item("Host/EulerOS/release");
if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");

sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(2)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP2");

uvp = get_kb_item("Host/EulerOS/uvp_version");
if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP2", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

flag = 0;

pkgs = ["libX11-1.6.3-2.h2",
        "libX11-common-1.6.3-2.h2",
        "libX11-devel-1.6.3-2.h2"];

foreach (pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"2", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libX11");
}