EulerOS 2.0 SP15 : rsync (EulerOS-SA-2026-2907)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(332840);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/06");

  script_cve_id(
    "CVE-2026-29518",
    "CVE-2026-41035",
    "CVE-2026-43617",
    "CVE-2026-43618",
    "CVE-2026-43619",
    "CVE-2026-43620",
    "CVE-2026-45232"
  );
  script_xref(name:"IAVA", value:"2026-A-0502");

  script_name(english:"EulerOS 2.0 SP15 : rsync (EulerOS-SA-2026-2907)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the rsync packages installed, the EulerOS installation on the remote host is affected by
the following vulnerabilities :

    Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's
    hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-
    based deny rules by controlling the PTR record for their source IP address, allowing connections from
    hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to
    UNKNOWN.(CVE-2026-43617)

    Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls
    including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow
    local attackers to redirect operations to files outside the exported rsync module. Attackers with local
    filesystem access can exploit the timing window between path resolution and syscall execution by swapping
    symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files
    outside the intended module boundary on rsync daemons configured with 'use chroot = no'.(CVE-2026-43619)

    Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file
    handling that allows attackers to redirect file writes outside intended directories by replacing parent
    directory components with symbolic links. Attackers with write access to a module path can exploit this
    race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and
    achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only
    be triggered if the chroot setting is false.(CVE-2026-29518)

    In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call,
    leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many
    (but not all) common configurations are vulnerable. Non-Linux platforms are more widely
    vulnerable.(CVE-2026-41035)

    Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder
    where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an
    overflow that causes the receiver process to read and return data from outside the intended buffer bounds.
    Attackers can exploit this vulnerability to disclose process memory contents including environment
    variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR
    effectiveness and facilitating further exploitation.(CVE-2026-43618)

    Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the
    establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by
    sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the
    client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a
    newline terminator, causing a null byte to be written to an out-of-bounds stack address when the
    RSYNC_PROXY environment variable is set.(CVE-2026-45232)

    Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in
    recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process.
    Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a
    specially crafted file list where the first sorted entry is not the leading dot directory, followed by a
    transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes
    before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in
    a deterministic SIGSEGV crash of the rsync client.(CVE-2026-43620)

Tenable has extracted the preceding description block directly from the EulerOS rsync security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-2907
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?dcfc55f1");
  script_set_attribute(attribute:"solution", value:
"Update the affected rsync packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-41035");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-29518");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rsync");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rsync-help");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (_release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15");

var sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(15)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15");

if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "x86" >!< cpu) audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

var flag = 0;

var pkgs = [
  "rsync-3.2.7-6.h21510.5.eulerosv2r15",
  "rsync-help-3.2.7-6.h21510.5.eulerosv2r15"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"15", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "rsync");
}