EulerOS 2.0 SP5 : spamassassin (EulerOS-SA-2020-2272)

#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(142129);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/02/13");

  script_cve_id(
    "CVE-2017-15705",
    "CVE-2018-11781",
    "CVE-2019-12420",
    "CVE-2020-1931"
  );

  script_name(english:"EulerOS 2.0 SP5 : spamassassin (EulerOS-SA-2020-2272)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the spamassassin package installed, the
EulerOS installation on the remote host is affected by the following
vulnerabilities :

  - A denial of service vulnerability was identified that
    exists in Apache SpamAssassin before 3.4.2. The
    vulnerability arises with certain unclosed tags in
    emails that cause markup to be handled incorrectly
    leading to scan timeouts. In Apache SpamAssassin, using
    HTML::Parser, we setup an object and hook into the
    begin and end tag event handlers In both cases, the
    'open' event is immediately followed by a 'close' event
    - even if the tag *does not* close in the HTML being
    parsed. Because of this, we are missing the 'text'
    event to deal with the object normally. This can cause
    carefully crafted emails that might take more scan time
    than expected leading to a Denial of Service. The issue
    is possibly a bug or design decision in HTML::Parser
    that specifically impacts the way Apache SpamAssassin
    uses the module with poorly formed html. The exploit
    has been seen in the wild but not believed to have been
    purposefully part of a Denial of Service attempt. We
    are concerned that there may be attempts to abuse the
    vulnerability in the future.(CVE-2017-15705)

  - Apache SpamAssassin 3.4.2 fixes a local user code
    injection in the meta rule syntax.(CVE-2018-11781)

  - In Apache SpamAssassin before 3.4.3, a message can be
    crafted in a way to use excessive resources. Upgrading
    to SA 3.4.3 as soon as possible is the recommended fix
    but details will not be shared
    publicly.(CVE-2019-12420)

  - A command execution issue was found in Apache
    SpamAssassin prior to 3.4.3. Carefully crafted
    nefarious Configuration (.cf) files can be configured
    to run system commands similar to CVE-2018-11805. This
    issue is less stealthy and attempts to exploit the
    issue will throw warnings. Thanks to Damian Lukowski at
    credativ for reporting the issue ethically. With this
    bug unpatched, exploits can be injected in a number of
    scenarios though doing so remotely is difficult. In
    addition to upgrading to SA 3.4.4, we again recommend
    that users should only use update channels or 3rd party
    .cf files from trusted places.(CVE-2020-1931)

Note that Tenable Network Security has extracted the preceding
description block directly from the EulerOS security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-2272
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4c573b3e");
  script_set_attribute(attribute:"solution", value:
"Update the affected spamassassin packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-1931");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"patch_publication_date", value:"2020/10/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/10/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:spamassassin");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2020-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item("Host/EulerOS/release");
if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");

sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(5)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP5");

uvp = get_kb_item("Host/EulerOS/uvp_version");
if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP5", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

flag = 0;

pkgs = ["spamassassin-3.4.0-2.h1.eulerosv2r7"];

foreach (pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"5", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "spamassassin");
}