EulerOS 2.0 SP5 : mutt (EulerOS-SA-2020-1312)

#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(134803);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/21");

  script_cve_id(
    "CVE-2018-14349",
    "CVE-2018-14350",
    "CVE-2018-14351",
    "CVE-2018-14352",
    "CVE-2018-14353",
    "CVE-2018-14355",
    "CVE-2018-14356",
    "CVE-2018-14358",
    "CVE-2018-14359"
  );

  script_name(english:"EulerOS 2.0 SP5 : mutt (EulerOS-SA-2020-1312)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the mutt package installed, the EulerOS
installation on the remote host is affected by the following
vulnerabilities :

  - An issue was discovered in Mutt before 1.10.1 and
    NeoMutt before 2018-07-16. imap/command.c mishandles a
    NO response without a message.(CVE-2018-14349)

  - An issue was discovered in Mutt before 1.10.1 and
    NeoMutt before 2018-07-16. imap/message.c has a
    stack-based buffer overflow for a FETCH response with a
    long INTERNALDATE field.(CVE-2018-14350)

  - An issue was discovered in Mutt before 1.10.1 and
    NeoMutt before 2018-07-16. imap/command.c mishandles a
    long IMAP status mailbox literal count
    size.(CVE-2018-14351)

  - An issue was discovered in Mutt before 1.10.1 and
    NeoMutt before 2018-07-16. imap_quote_string in
    imap/util.c does not leave room for quote characters,
    leading to a stack-based buffer
    overflow.(CVE-2018-14352)

  - An issue was discovered in Mutt before 1.10.1 and
    NeoMutt before 2018-07-16. imap_quote_string in
    imap/util.c has an integer underflow.(CVE-2018-14353)

  - An issue was discovered in Mutt before 1.10.1 and
    NeoMutt before 2018-07-16. imap/util.c mishandles '..'
    directory traversal in a mailbox name.(CVE-2018-14355)

  - An issue was discovered in Mutt before 1.10.1 and
    NeoMutt before 2018-07-16. pop.c mishandles a
    zero-length UID.(CVE-2018-14356)

  - An issue was discovered in Mutt before 1.10.1 and
    NeoMutt before 2018-07-16. imap/message.c has a
    stack-based buffer overflow for a FETCH response with a
    long RFC822.SIZE field.(CVE-2018-14358)

  - An issue was discovered in Mutt before 1.10.1 and
    NeoMutt before 2018-07-16. They have a buffer overflow
    via base64 data.(CVE-2018-14359)

Note that Tenable Network Security has extracted the preceding
description block directly from the EulerOS security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1312
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a95cae54");
  script_set_attribute(attribute:"solution", value:
"Update the affected mutt packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-14359");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"patch_publication_date", value:"2020/03/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/03/23");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:mutt");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2020-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item("Host/EulerOS/release");
if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");

sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(5)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP5");

uvp = get_kb_item("Host/EulerOS/uvp_version");
if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP5", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

flag = 0;

pkgs = ["mutt-1.5.21-28.h2.eulerosv2r7"];

foreach (pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"5", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mutt");
}