According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :
A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.34, in debug_get_real_type, as demonstrated in objdump, that can cause a denial of service via a crafted file.(CVE-2020-16598)
A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to application availability. This flaw affects binutils versions prior to 2.34.(CVE-2020-35493)
A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils 2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.(CVE-2020-16592)
find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32, allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted ELF file.(CVE-2019-17450)
The process_version_sections function in readelf.c in GNU Binutils 2.29 allows attackers to cause a denial of service (Integer Overflow, and hang because of a time-consuming loop) or possibly have unspecified other impact via a crafted binary file with invalid values of ent.vn_next, during ‘readelf -a’ execution.(CVE-2017-14333)
There’s a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower threat to data confidentiality. This flaw affects binutils versions prior to 2.34.(CVE-2020-35494)
Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(149165);
script_version("1.4");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/01/02");
script_cve_id(
"CVE-2017-14333",
"CVE-2019-17450",
"CVE-2020-16592",
"CVE-2020-16598",
"CVE-2020-35493",
"CVE-2020-35494"
);
script_name(english:"EulerOS 2.0 SP3 : binutils (EulerOS-SA-2021-1767)");
script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
script_set_attribute(attribute:"description", value:
"According to the versions of the binutils packages installed, the
EulerOS installation on the remote host is affected by the following
vulnerabilities :
- A Null Pointer Dereference vulnerability exists in the
Binary File Descriptor (BFD) library (aka libbfd), as
distributed in GNU Binutils 2.34, in
debug_get_real_type, as demonstrated in objdump, that
can cause a denial of service via a crafted
file.(CVE-2020-16598)
- A flaw exists in binutils in bfd/pef.c. An attacker who
is able to submit a crafted PEF file to be parsed by
objdump could cause a heap buffer overflow ->
out-of-bounds read that could lead to an impact to
application availability. This flaw affects binutils
versions prior to 2.34.(CVE-2020-35493)
- A use after free issue exists in the Binary File
Descriptor (BFD) library (aka libbfd) in GNU Binutils
2.34 in bfd_hash_lookup, as demonstrated in nm-new,
that can cause a denial of service via a crafted
file.(CVE-2020-16592)
- find_abstract_instance in dwarf2.c in the Binary File
Descriptor (BFD) library (aka libbfd), as distributed
in GNU Binutils 2.32, allows remote attackers to cause
a denial of service (infinite recursion and application
crash) via a crafted ELF file.(CVE-2019-17450)
- The process_version_sections function in readelf.c in
GNU Binutils 2.29 allows attackers to cause a denial of
service (Integer Overflow, and hang because of a
time-consuming loop) or possibly have unspecified other
impact via a crafted binary file with invalid values of
ent.vn_next, during 'readelf -a'
execution.(CVE-2017-14333)
- There's a flaw in binutils /opcodes/tic4x-dis.c. An
attacker who is able to submit a crafted input file to
be processed by binutils could cause usage of
uninitialized memory. The highest threat is to
application availability with a lower threat to data
confidentiality. This flaw affects binutils versions
prior to 2.34.(CVE-2020-35494)
Note that Tenable Network Security has extracted the preceding
description block directly from the EulerOS security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.");
# https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2021-1767
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6e8c690f");
script_set_attribute(attribute:"solution", value:
"Update the affected binutils packages.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P");
script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-35494");
script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2017-14333");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"patch_publication_date", value:"2021/04/30");
script_set_attribute(attribute:"plugin_publication_date", value:"2021/04/30");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:binutils");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:binutils-devel");
script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Huawei Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2021-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
script_exclude_keys("Host/EulerOS/uvp_version");
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("rpm.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/EulerOS/release");
if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");
sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(3)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP3");
uvp = get_kb_item("Host/EulerOS/uvp_version");
if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP3", "EulerOS UVP " + uvp);
if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);
flag = 0;
pkgs = ["binutils-2.25.1-22.base.h46",
"binutils-devel-2.25.1-22.base.h46"];
foreach (pkg in pkgs)
if (rpm_check(release:"EulerOS-2.0", sp:"3", reference:pkg)) flag++;
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_WARNING,
extra : rpm_report_get()
);
exit(0);
}
else
{
tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, "binutils");
}
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14333
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17450
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16592
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16598
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35493
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35494
www.nessus.org/u?6e8c690f