EulerOS 2.0 SP5 : libreoffice (EulerOS-SA-2021-1687)

#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(148079);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/01/08");

  script_cve_id("CVE-2019-9849", "CVE-2020-12803");

  script_name(english:"EulerOS 2.0 SP5 : libreoffice (EulerOS-SA-2021-1687)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the libreoffice packages installed, the
EulerOS installation on the remote host is affected by the following
vulnerabilities :

  - LibreOffice has a 'stealth mode' in which only
    documents from locations deemed 'trusted' are allowed
    to retrieve remote resources. This mode is not the
    default mode, but can be enabled by users who want to
    disable LibreOffice's ability to include remote
    resources within a document. A flaw existed where
    bullet graphics were omitted from this protection prior
    to version 6.2.5. This issue affects: Document
    Foundation LibreOffice versions prior to
    6.2.5.(CVE-2019-9849)

  - ODF documents can contain forms to be filled out by the
    user. Similar to HTML forms, the contained form data
    can be submitted to a URI, for example, to an external
    web server. To create submittable forms, ODF implements
    the XForms W3C standard, which allows data to be
    submitted without the need for macros or other active
    scripting Prior to version 6.4.4 LibreOffice allowed
    forms to be submitted to any URI, including file: URIs,
    enabling form submissions to overwrite local files.
    User-interaction is required to submit the form, but to
    avoid the possibility of malicious documents engineered
    to maximize the possibility of inadvertent user
    submission this feature has now been limited to http[s]
    URIs, removing the possibility to overwrite local
    files. This issue affects: The Document Foundation
    LibreOffice versions prior to 6.4.4.(CVE-2020-12803)

Note that Tenable Network Security has extracted the preceding
description block directly from the EulerOS security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2021-1687
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e9cdaf9f");
  script_set_attribute(attribute:"solution", value:
"Update the affected libreoffice packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-12803");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"patch_publication_date", value:"2021/03/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2021/03/24");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:autocorr-en");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libreoffice-calc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libreoffice-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libreoffice-data");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libreoffice-draw");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libreoffice-filters");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libreoffice-graphicfilter");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libreoffice-gtk2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libreoffice-gtk3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libreoffice-impress");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libreoffice-langpack-en");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libreoffice-math");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libreoffice-opensymbol-fonts");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libreoffice-pdfimport");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libreoffice-pyuno");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libreoffice-ure");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libreoffice-ure-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libreoffice-writer");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libreoffice-x11");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libreoffice-xsltfilter");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libreofficekit");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2021-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item("Host/EulerOS/release");
if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");

sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(5)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP5");

uvp = get_kb_item("Host/EulerOS/uvp_version");
if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP5", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

flag = 0;

pkgs = ["autocorr-en-5.3.6.1-10.h5.eulerosv2r7",
        "libreoffice-calc-5.3.6.1-10.h5.eulerosv2r7",
        "libreoffice-core-5.3.6.1-10.h5.eulerosv2r7",
        "libreoffice-data-5.3.6.1-10.h5.eulerosv2r7",
        "libreoffice-draw-5.3.6.1-10.h5.eulerosv2r7",
        "libreoffice-filters-5.3.6.1-10.h5.eulerosv2r7",
        "libreoffice-graphicfilter-5.3.6.1-10.h5.eulerosv2r7",
        "libreoffice-gtk2-5.3.6.1-10.h5.eulerosv2r7",
        "libreoffice-gtk3-5.3.6.1-10.h5.eulerosv2r7",
        "libreoffice-impress-5.3.6.1-10.h5.eulerosv2r7",
        "libreoffice-langpack-en-5.3.6.1-10.h5.eulerosv2r7",
        "libreoffice-math-5.3.6.1-10.h5.eulerosv2r7",
        "libreoffice-opensymbol-fonts-5.3.6.1-10.h5.eulerosv2r7",
        "libreoffice-pdfimport-5.3.6.1-10.h5.eulerosv2r7",
        "libreoffice-pyuno-5.3.6.1-10.h5.eulerosv2r7",
        "libreoffice-ure-5.3.6.1-10.h5.eulerosv2r7",
        "libreoffice-ure-common-5.3.6.1-10.h5.eulerosv2r7",
        "libreoffice-writer-5.3.6.1-10.h5.eulerosv2r7",
        "libreoffice-x11-5.3.6.1-10.h5.eulerosv2r7",
        "libreoffice-xsltfilter-5.3.6.1-10.h5.eulerosv2r7",
        "libreofficekit-5.3.6.1-10.h5.eulerosv2r7"];

foreach (pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"5", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libreoffice");
}