EulerOS 2.0 SP11 : glibc (EulerOS-SA-2026-3066)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(333474);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/08");

  script_cve_id(
    "CVE-2026-5435",
    "CVE-2026-5450",
    "CVE-2026-5928",
    "CVE-2026-6238"
  );

  script_name(english:"EulerOS 2.0 SP11 : glibc (EulerOS-SA-2026-3066)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by
the following vulnerabilities :

    Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version
    2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in
    a one byte heap buffer overflow.(CVE-2026-5450)

    Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has
    overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or
    earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in
    unintentional disclosure of neighboring data in the heap, or a program crash.

    A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes
    ungetwc() to operate on the regular character buffer (fp-_IO_read_ptr) instead of the actual wide-
    stream read pointer (fp-_wide_data-_IO_read_ptr). The program crash may happen in cases where fp-
    _IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special
    situation where the input character encoding is such that there are overlaps between single byte
    representations and multibyte representations in that encoding, resulting in spurious matches. The
    spurious match case is not possible in the standard Unicode character sets.(CVE-2026-5928)

    The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer
    fail to validate the RDATA content against the RDATA length in a DNS response when processing LOC, CERT,
    TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to
    crash or read uninitialized memory.

    These functions are for application debugging only and hence not in the path of code executed by the DNS
    resolver.  Further, they have been deprecated since version 2.34 and should not be used by any new
    applications.  Applications should consider porting away from these interfaces since they may be removed
    in future versions.(CVE-2026-6238)

    The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer
    fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing
    TSIG records.(CVE-2026-5435)

Tenable has extracted the preceding description block directly from the EulerOS glibc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-3066
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4999cfe0");
  script_set_attribute(attribute:"solution", value:
"Update the affected glibc packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-5450");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:glibc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:glibc-all-langpacks");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:glibc-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:glibc-debugutils");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:glibc-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:glibc-help");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:glibc-locale-archive");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:glibc-locale-source");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libnsl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:nscd");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (_release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP11");

var sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(11)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP11");

if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP11", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "x86" >!< cpu) audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

var flag = 0;

var pkgs = [
  "glibc-2.34-70.h104.eulerosv2r11",
  "glibc-all-langpacks-2.34-70.h104.eulerosv2r11",
  "glibc-common-2.34-70.h104.eulerosv2r11",
  "glibc-debugutils-2.34-70.h104.eulerosv2r11",
  "glibc-devel-2.34-70.h104.eulerosv2r11",
  "glibc-help-2.34-70.h104.eulerosv2r11",
  "glibc-locale-archive-2.34-70.h104.eulerosv2r11",
  "glibc-locale-source-2.34-70.h104.eulerosv2r11",
  "libnsl-2.34-70.h104.eulerosv2r11",
  "nscd-2.34-70.h104.eulerosv2r11"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"11", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "glibc");
}