EulerOS Virtualization 2.12.1 : vim (EulerOS-SA-2026-2091)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(319371);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/06");

  script_cve_id(
    "CVE-2026-25749",
    "CVE-2026-26269",
    "CVE-2026-28417",
    "CVE-2026-28419",
    "CVE-2026-28421"
  );

  script_name(english:"EulerOS Virtualization 2.12.1 : vim (EulerOS-SA-2026-2091)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS Virtualization host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the vim packages installed, the EulerOS Virtualization installation on the remote host is
affected by the following vulnerabilities :

    Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow
    exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a
    delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated
    buffer. Version 9.2.0075 fixes the issue.(CVE-2026-28419)

    Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow
    vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The
    vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim
    copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes
    (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been
    patched in version 9.1.2132.(CVE-2026-25749)

    Vim is an open source, command line text editor. Prior to 9.1.2148, a stack buffer overflow vulnerability
    exists in Vim's NetBeans integration when processing the specialKeys command, affecting Vim builds that
    enable and use the NetBeans feature. The Stack buffer overflow exists in special_keys() (in
    src/netbeans.c). The while (*tok) loop writes two bytes per iteration into a 64-byte stack buffer (keybuf)
    with no bounds check. A malicious NetBeans server can overflow keybuf with a single specialKeys command.
    The issue has been fixed as of Vim patch v9.1.2148.(CVE-2026-26269)

    Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow
    and a segmentation fault (SEGV) exist in Vim's swap file recovery logic. Both are caused by unvalidated
    fields read from crafted pointer blocks within a swap file. Version 9.2.0077 fixes the
    issue.(CVE-2026-28421)

    Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection
    vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted
    URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the
    privileges of the Vim process. Version 9.2.0073 fixes the issue.(CVE-2026-28417)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization vim security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-2091
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8ff6c355");
  script_set_attribute(attribute:"solution", value:
"Update the affected vim packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-26269");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-28421");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/02/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:vim-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:vim-enhanced");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:vim-filesystem");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:vim-minimal");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:uvp:2.12.1");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (uvp != "2.12.1") audit(AUDIT_OS_NOT, "EulerOS Virtualization 2.12.1");
if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);

var flag = 0;

var pkgs = [
  "vim-common-9.0-5.h28.eulerosv2r12",
  "vim-enhanced-9.0-5.h28.eulerosv2r12",
  "vim-filesystem-9.0-5.h28.eulerosv2r12",
  "vim-minimal-9.0-5.h28.eulerosv2r12"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "vim");
}