EulerOS Virtualization 2.11.0 : gnutls (EulerOS-SA-2026-3506)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(347079);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/18");

  script_cve_id(
    "CVE-2024-12243",
    "CVE-2025-6395",
    "CVE-2025-9820",
    "CVE-2025-14831",
    "CVE-2025-32988",
    "CVE-2025-32990",
    "CVE-2026-3833",
    "CVE-2026-5260",
    "CVE-2026-33845",
    "CVE-2026-33846",
    "CVE-2026-42009",
    "CVE-2026-42010",
    "CVE-2026-42012",
    "CVE-2026-42013",
    "CVE-2026-42014",
    "CVE-2026-42015"
  );
  script_xref(name:"IAVA", value:"2025-A-0879-S");
  script_xref(name:"IAVA", value:"2026-A-0147-S");
  script_xref(name:"IAVA", value:"2026-A-0405");

  script_name(english:"EulerOS Virtualization 2.11.0 : gnutls (EulerOS-SA-2026-3506)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS Virtualization host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the gnutls packages installed, the EulerOS Virtualization installation on the remote host
is affected by the following vulnerabilities :

    A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient
    algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to
    increased resource consumption. This flaw allows a remote attacker to send a specially crafted
    certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service
    condition.(CVE-2024-12243)

    A NULL pointer dereference flaw was found in the GnuTLS software in
    _gnutls_figure_common_ciphersuite().(CVE-2025-6395)

    A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic
    within the certtool utility. When it reads certain settings from a template file, it allows an attacker to
    cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service
    (DoS) that could potentially crash the system.(CVE-2025-32990)

    A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership
    handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the
    type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not
    own, leading to a double-free condition when the parent function or caller later attempts to free the same
    structure.This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of
    service or memory corruption, depending on allocator behavior.(CVE-2025-32988)

    A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that
    handles PKCS#11 token initialization. When a token label longer than expected is processed, the function
    writes past the end of a fixed-size stack buffer. This programming error can cause the application using
    GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or
    applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation
    attacks.(CVE-2025-9820)

    A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central
    Processing Unit) and memory consumption via specially crafted malicious certificates containing a large
    number of name constraints and subject alternative names (SANs).(CVE-2025-14831)

    A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons
    of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within
    `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf
    certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass
    where a certificate that should be rejected is instead accepted. This could result in unauthorized access
    or information disclosure.(CVE-2026-3833)

    A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially
    crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative
    Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS
    hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or
    intercept sensitive information.(CVE-2026-42012)

    A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer
    Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by
    sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to
    unstable packet ordering or undefined behavior, resulting in a denial of service.(CVE-2026-42009)

    A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security
    Officer PIN, can lead to a use-after-free vulnerability. This occurs when an attacker attempts to change
    the PIN with a NULL old PIN for a token that lacks a protected authentication path.(CVE-2026-42014)

    A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The
    issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based
    solely on handshake type, without validating that the message_length field remains consistent across all
    fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with
    conflicting message_length values, causing the implementation to allocate a buffer based on a smaller
    initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because
    the merge operation does not enforce proper bounds checking against the allocated buffer size, this
    results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without
    authentication via the DTLS handshake path and can lead to application crashes or potential memory
    corruption.(CVE-2026-33846)

    A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset,
    leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is
    remotely exploitable and may cause information disclosure or denial of service.(CVE-2026-33845)

    A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN)
    could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This
    could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or
    man-in-the-middle attacks.(CVE-2026-42013)

    A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an
    RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap
    overread. This memory corruption vulnerability could lead to information disclosure.(CVE-2026-5260)

    A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest-Shamir-Adleman - Pre-Shared Key)
    wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could
    exploit this by sending a specially crafted username, leading to an authentication bypass. This
    vulnerability allows an attacker to gain unauthorized access by circumventing the authentication
    process.(CVE-2026-42010)

    A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This
    vulnerability allows an remote attacker to write past the internal array of a PKCS#12 bag when appending
    to a bag that already contains 32 elements. This memory corruption could lead to a denial of service (DoS)
    or potentially other unspecified impacts.(CVE-2026-42015)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization gnutls security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-3506
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d46ab7fb");
  script_set_attribute(attribute:"solution", value:
"Update the affected gnutls packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-42010");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/02/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:gnutls");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:gnutls-utils");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:uvp:2.11.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (uvp != "2.11.0") audit(AUDIT_OS_NOT, "EulerOS Virtualization 2.11.0");
if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "x86" >!< cpu) audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

var flag = 0;

var pkgs = [
  "gnutls-3.7.2-2.h40.eulerosv2r11",
  "gnutls-utils-3.7.2-2.h40.eulerosv2r11"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "gnutls");
}