EulerOS Virtualization 2.10.0 : curl (EulerOS-SA-2026-3865)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(348528);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/21");

  script_cve_id(
    "CVE-2026-8286",
    "CVE-2026-8924",
    "CVE-2026-8927",
    "CVE-2026-9547"
  );
  script_xref(name:"IAVA", value:"2026-A-0627-S");

  script_name(english:"EulerOS Virtualization 2.10.0 : curl (EulerOS-SA-2026-3865)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS Virtualization host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is
affected by the following vulnerabilities :

    Integer overflow vulnerability has been found in 'builtin.c' program file of gawk. This issue may lead to
    memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and
    objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.(CVE-2026-40468)

    Use After Free vulnerability has been found in 'io.c' program file of gawk (do_getline_redir() routine).
    This issue may lead to a crash. It affects gawk in versions 5.4.0 and below.(CVE-2026-40467)

    Buffer overflow vulnerability has been found in 'extension/readdir.c' program file of gawk (ftype()
    routine). This issue could be used to crash the program and potentially to achieve code execution,
    although the latter has not been confirmed to be feasible. It affects gawk in versions 5.4.0 and
    below.(CVE-2026-40553)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization curl security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-3865
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9b5b41f6");
  script_set_attribute(attribute:"solution", value:
"Update the affected curl packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-9547");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-8927");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:curl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:curl-help");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libcurl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libcurl-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:uvp:2.10.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (uvp != "2.10.0") audit(AUDIT_OS_NOT, "EulerOS Virtualization 2.10.0");
if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "x86" >!< cpu) audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

var flag = 0;

var pkgs = [
  "curl-7.71.1-4.h31.r11.eulerosv2r10",
  "curl-help-7.71.1-4.h31.r11.eulerosv2r10",
  "libcurl-7.71.1-4.h31.r11.eulerosv2r10",
  "libcurl-devel-7.71.1-4.h31.r11.eulerosv2r10"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "curl");
}