EulerOS 2.0 SP12 : gzip (EulerOS-SA-2026-3266)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(343645);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/08");

  script_cve_id("CVE-2026-41991", "CVE-2026-41992");

  script_name(english:"EulerOS 2.0 SP12 : gzip (EulerOS-SA-2026-3266)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the gzip packages installed, the EulerOS installation on the remote host is affected by the
following vulnerabilities :

    GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper
    reuse of shared global state between different decompression formats within a single execution. GNU gzip
    maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not
    reinitialized between files processed in the same invocation.
    By decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d
    command, an attacker can poison the shared global state and subsequently trigger an outofbounds read
    in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing
    reads past the end of the allocated global buffer.

    This issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681(CVE-2026-41992)

    GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When
    the mktemp utility is not available in the user's PATH, gzexe falls back to constructing a temporary file
    path based solely on the process ID (PID). This predictable filename is created without exclusive access
    or existence checks.
    A local attacker can pre-create the predicted temporary file path as a symbolic link pointing to an
    arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target
    file, resulting in a time-of-check to time-of-use (TOCTOU) condition that allows arbitrary file overwrite.

    This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269(CVE-2026-41991)

Tenable has extracted the preceding description block directly from the EulerOS gzip security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-3266
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?13acce38");
  script_set_attribute(attribute:"solution", value:
"Update the affected gzip packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-41992");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:gzip");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:gzip-help");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (_release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP12");

var sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(12)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP12");

if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP12", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "x86" >!< cpu) audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

var flag = 0;

var pkgs = [
  "gzip-1.11-5.h4.eulerosv2r12",
  "gzip-help-1.11-5.h4.eulerosv2r12"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"12", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "gzip");
}