EulerOS Virtualization 2.12.1 : libssh2 (EulerOS-SA-2026-3594)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(347129);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/18");

  script_cve_id(
    "CVE-2025-15661",
    "CVE-2026-55199",
    "CVE-2026-58050",
    "CVE-2026-58051"
  );

  script_name(english:"EulerOS Virtualization 2.12.1 : libssh2 (EulerOS-SA-2026-3594)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS Virtualization host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the libssh2 package installed, the EulerOS Virtualization installation on the remote host
is affected by the following vulnerabilities :

    libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem
    response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds
    checking, so on 32-bit platforms the multiplication overflows to an undersized buffer. A malicious SSH
    server can then drive the attribute-parsing loop to write past the allocation, causing a heap buffer
    overflow in a connecting libssh2 client.(CVE-2026-58050)

    libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries
    before parsing populates them, so a parse failure reaching the cleanup path leaves
    libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the
    publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-
    influenceable attrs pointer in a connecting libssh2 client.(CVE-2026-58051)

    libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the
    sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to
    disclose heap memory contents or cause a crash by sending a crafted SSH_FXP_NAME response. Attackers can
    supply a link_len value larger than the actual packet data in SSH_FXP_NAME responses for SFTP READLINK and
    REALPATH operations, triggering a heap buffer over-read of up to target_len minus one bytes due to the
    missing validation of available packet buffer size before the memcpy operation.(CVE-2025-15661)

    libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service
    vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause
    a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set
    nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over
    60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not
    apply to CPU-bound loops.(CVE-2026-55199)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libssh2 security
advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-3594
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ad59c34c");
  script_set_attribute(attribute:"solution", value:
"Update the affected libssh2 packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-15661");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-58051");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libssh2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:uvp:2.12.1");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (uvp != "2.12.1") audit(AUDIT_OS_NOT, "EulerOS Virtualization 2.12.1");
if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);

var flag = 0;

var pkgs = [
  "libssh2-1.10.0-3.h11.eulerosv2r12"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libssh2");
}