EulerOS 2.0 SP11 : libsoup (EulerOS-SA-2025-1665)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(238388);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/06/12");

  script_cve_id(
    "CVE-2025-2784",
    "CVE-2025-32052",
    "CVE-2025-32053",
    "CVE-2025-32906",
    "CVE-2025-32907",
    "CVE-2025-32910",
    "CVE-2025-32911",
    "CVE-2025-32912",
    "CVE-2025-32913",
    "CVE-2025-32914"
  );

  script_name(english:"EulerOS 2.0 SP11 : libsoup (EulerOS-SA-2025-1665)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by
the following vulnerabilities :

    A flaw was found in libsoup. A vulnerability in sniff_feed_or_html() and skip_insignificant_space()
    functions may lead to a heap buffer over-read.(CVE-2025-32053)

    A flaw was found in libsoup. A vulnerability in the sniff_unknown() function may lead to heap buffer over-
    read.(CVE-2025-32052)

    A use-after-free type vulnerability was found in libsoup, in the
    soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause
    memory corruption in the libsoup server.(CVE-2025-32911)

    A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-
    of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP
    server.(CVE-2025-32906)

    A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource
    consumption attack. This flaw allows a malicious client to request the same range many times in a single
    HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of
    service.(CVE-2025-32907)

    A flaw was found in libsoup, where SoupAuthDigest is vulnerable to a NULL pointer dereference. The HTTP
    server may cause the libsoup client to crash.(CVE-2025-32912)

    A flaw was found in libsoup, where soup_auth_digest_authenticate() is vulnerable to a NULL pointer
    dereference. This issue may cause the libsoup client to crash.(CVE-2025-32910)

    A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is
    vulnerable to a NULL pointer dereference. This flaw allows a malicious HTTP peer to crash a libsoup client
    or server that uses this function.(CVE-2025-32913)

    A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-
    of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of
    bounds.(CVE-2025-32914)

    A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content
    via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to
    a crafted HTTP response by an HTTP server.(CVE-2025-2784)

Tenable has extracted the preceding description block directly from the EulerOS libsoup security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2025-1665
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?162dc6d2");
  script_set_attribute(attribute:"solution", value:
"Update the affected libsoup packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-32906");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2025-32911");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/04/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/06/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/06/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libsoup");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libsoup-help");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (_release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP11");

var sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(11)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP11");

if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP11", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "x86" >!< cpu) audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

var flag = 0;

var pkgs = [
  "libsoup-2.74.2-1.h6.eulerosv2r11",
  "libsoup-help-2.74.2-1.h6.eulerosv2r11"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"11", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libsoup");
}