EulerOS 2.0 SP15 : glibc (EulerOS-SA-2026-2483)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(323210);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/27");

  script_cve_id(
    "CVE-2026-4046",
    "CVE-2026-4437",
    "CVE-2026-4438",
    "CVE-2026-5450",
    "CVE-2026-5928"
  );

  script_name(english:"EulerOS 2.0 SP15 : glibc (EulerOS-SA-2026-2483)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by
the following vulnerabilities :

    Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has
    overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or
    earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in
    unintentional disclosure of neighboring data in the heap, or a program crash._x000D_
    _x000D_
    A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes
    ungetwc() to operate on the regular character buffer (fp-_IO_read_ptr) instead of the actual wide-
    stream read pointer (fp-_wide_data-_IO_read_ptr). The program crash may happen in cases where fp-
    _IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special
    situation where the input character encoding is such that there are overlaps between single byte
    representations and multibyte representations in that encoding, resulting in spurious matches. The
    spurious match case is not possible in the standard Unicode character sets.(CVE-2026-5928)

    Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version
    2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in
    a one byte heap buffer overflow.(CVE-2026-5450)

    The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure
    when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an
    application._x000D_
    _x000D_
    _x000D_
    _x000D_
    This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from
    systems that do not need them.(CVE-2026-4046)

    Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS
    backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the
    configured DNS server, result in a violation of the DNS specification that causes the application to treat
    a non-answer section of the DNS response as a valid answer.(CVE-2026-4437)

    Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS
    backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being
    returned to the caller in violation of the DNS specification.(CVE-2026-4438)

Tenable has extracted the preceding description block directly from the EulerOS glibc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-2483
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?93931685");
  script_set_attribute(attribute:"solution", value:
"Update the affected glibc packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-5450");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/27");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:glibc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:glibc-all-langpacks");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:glibc-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:glibc-debugutils");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:glibc-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:glibc-help");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:glibc-locale-archive");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:glibc-locale-source");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libnsl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:nscd");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (_release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15");

var sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(15)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15");

if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);

var flag = 0;

var pkgs = [
  "glibc-2.38-47.h21510.42.eulerosv2r15",
  "glibc-all-langpacks-2.38-47.h21510.42.eulerosv2r15",
  "glibc-common-2.38-47.h21510.42.eulerosv2r15",
  "glibc-debugutils-2.38-47.h21510.42.eulerosv2r15",
  "glibc-devel-2.38-47.h21510.42.eulerosv2r15",
  "glibc-help-2.38-47.h21510.42.eulerosv2r15",
  "glibc-locale-archive-2.38-47.h21510.42.eulerosv2r15",
  "glibc-locale-source-2.38-47.h21510.42.eulerosv2r15",
  "libnsl-2.38-47.h21510.42.eulerosv2r15",
  "nscd-2.38-47.h21510.42.eulerosv2r15"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"15", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "glibc");
}