EulerOS 2.0 SP15 : bind (EulerOS-SA-2026-3965)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(364017);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/08");

  script_cve_id("CVE-2026-10723", "CVE-2026-11721", "CVE-2026-13321");
  script_xref(name:"IAVA", value:"2026-A-0764-S");

  script_name(english:"EulerOS 2.0 SP15 : bind (EulerOS-SA-2026-3965)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the
following vulnerabilities :

    It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of
    labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a
    zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to
    have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the
    default)._x000D_
    This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23,
    9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.(CVE-2026-11721)

    BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge
    authenticated NXDOMAIN responses._x000D_
    This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23,
    9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.(CVE-2026-10723)

    The BIND resolver accepts validly-signed NSEC records where the 'Next Domain Name' field points outside
    the signer's zone._x000D_
    This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23,
    9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.(CVE-2026-13321)

Tenable has extracted the preceding description block directly from the EulerOS bind security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-3965
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3a83b18b");
  script_set_attribute(attribute:"solution", value:
"Update the affected bind packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-13321");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:bind");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:bind-dnssec-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:bind-dnssec-utils");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:bind-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:bind-license");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:bind-utils");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (_release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15");

var sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(15)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15");

if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);

var flag = 0;

var pkgs = [
  "bind-9.18.21-3.h21510.11.eulerosv2r15",
  "bind-dnssec-doc-9.18.21-3.h21510.11.eulerosv2r15",
  "bind-dnssec-utils-9.18.21-3.h21510.11.eulerosv2r15",
  "bind-libs-9.18.21-3.h21510.11.eulerosv2r15",
  "bind-license-9.18.21-3.h21510.11.eulerosv2r15",
  "bind-utils-9.18.21-3.h21510.11.eulerosv2r15"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"15", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "bind");
}