EulerOS Virtualization 2.12.0 : gzip (EulerOS-SA-2026-3642)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(348003);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/18");

  script_cve_id("CVE-2026-41991", "CVE-2026-41992");

  script_name(english:"EulerOS Virtualization 2.12.0 : gzip (EulerOS-SA-2026-3642)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS Virtualization host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the gzip package installed, the EulerOS Virtualization installation on the remote host is
affected by the following vulnerabilities :

    GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper
    reuse of shared global state between different decompression formats within a single execution. GNU gzip
    maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not
    reinitialized between files processed in the same invocation.By decompressing a specially crafted LZW file
    followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared
    global state and subsequently trigger an outofbounds read in the LZH decoder. The LZH decompression
    logic follows stale values left in the shared array, causing reads past the end of the allocated global
    buffer.This issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681(CVE-2026-41992)

    GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When
    the mktemp utility is not available in the user's PATH, gzexe falls back to constructing a temporary file
    path based solely on the process ID (PID). This predictable filename is created without exclusive access
    or existence checks.A local attacker can pre-create the predicted temporary file path as a symbolic link
    pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and
    overwrites the target file, resulting in a time-of-check to time-of-use (TOCTOU) condition that allows
    arbitrary file overwrite.This issue has been fixed in the commit
    4e6f8b24ab823146ab8776f0b7fe486ab34d4269(CVE-2026-41991)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization gzip security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-3642
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a2752a61");
  script_set_attribute(attribute:"solution", value:
"Update the affected gzip packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-41992");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:gzip");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:uvp:2.12.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (uvp != "2.12.0") audit(AUDIT_OS_NOT, "EulerOS Virtualization 2.12.0");
if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "x86" >!< cpu) audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

var flag = 0;

var pkgs = [
  "gzip-1.11-5.h4.eulerosv2r12"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "gzip");
}