Fedora 43 : nsd (2026-0b77a23312)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory FEDORA-2026-0b77a23312
#

include('compat.inc');

if (description)
{
  script_id(331674);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/03");

  script_cve_id(
    "CVE-2026-12244",
    "CVE-2026-12245",
    "CVE-2026-12246",
    "CVE-2026-12490"
  );
  script_xref(name:"FEDORA", value:"2026-0b77a23312");

  script_name(english:"Fedora 43 : nsd (2026-0b77a23312)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Fedora host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the
FEDORA-2026-0b77a23312 advisory.

    FEATURES:

        Merge #483 from ruuda: Improve Prometheus metrics: Move zonestats from metric name to label

    BUG FIXES:

        Fix #478: Feature request: reduce syslog noise from frequent read-only control commands (e.g.
    stats_noreset). It logs the verbosity command always, and others at 2 and higher.
        Fix XDP cleanup code being executed even if xdp is not configured
        Merge #481 from jaredmauch: Fix pedantic/CodeQL warning in sources
        Merge #484 from orlitzky: OpenRC: fix network deps and support both supervisors
        Fix PROXYv2 header read and consume, it checks the header size.
        Thanks to Qifan Zhang, Palo Alto Networks for the report.
        Fix notify relay ipc to check for large size. This stops desync of the internal notify pipe.
        Thanks to Qifan Zhang, Palo Alto Networks for the report.
        Fix print of malformed HIP records.
        Thanks to Qifan Zhang, Palo Alto Networks, for the report, and Haruki Oyama (Waseda University) for
    also reporting this issue.
        Fix to not fail on NSEC3 records with a bad owner name.
        Thanks to Qifan Zhang, Palo Alto Networks, for the report.
        Fix print of NXT RR without bitmap
        Thanks to Qifan Zhang, Palo Alto Networks, for the report.
        Fix overflow for NSEC3 zones with 255-octet name
        Thanks to Haruki Oyama (Waseda University) for the report, and Qifan Zhang, Palo Alto Networks, for
    also reporting this issue.
        Fix to update github ci actions/checkout to v7.
        Fix notify and zone transfer processing for malformed SOA records, with a short rdata content. It
    stops an assertion failure.
        Thanks to Tristan Madani (@TristanInSec) from Talence Security for the report.
        Fix that wrong buffer position in IXFR for the first SOA causes the storage to retrieve wrong
    information. Later data would overwrite it so it did not cause observable trouble.
        Thanks to Tristan Madani (@TristanInSec) from Talence Security for the report.
        More robust removing of RRs from an IXFR processing.
        Thanks zhangph for reporting this issue
        Fix unit test for stopmany for process role logs.
        Fix nsd-control assoc_tsig, if that interrupts a zone transfer in progress, to not crash. It restarts
    the transfer from the primary.
        Thanks to Qifan Zhang, Palo Alto Networks, for the report.
        Fix nsd-control del_tsig, if that interrupts a zone transfer in progress, to not crash. It does not
    delete the key, if in use.
        Thanks to Qifan Zhang, Palo Alto Networks, for the report.
        Fix catalog producer zone with long name, so that it does not crash on that. Thanks to Qifan Zhang,
    Palo Alto Networks, for the report.
        Fix catalog consumer zone with long name for member unique label that is long, so that it does not
    crash on that.
        Thanks to Qifan Zhang, Palo Alto Networks, for the report.
        Fix that non-IN-class records cause a zone transfer to be rejected. Also such records are not added
    from a transfer. This stops an assertion failure.
        Thanks to Qifan Zhang, Palo Alto Networks, for the report.
        Fix to disallow a SOA record in the middle of an AXFR. This stops an assertion failure.
        Thanks to Qifan Zhang, Palo Alto Networks, for the report.
        Fix to set zone is_secure to false when IXFR removes RRSIG DNSKEY.
        This stops an assertion failure. Also fix soa and ns rrset change in IXFR when packed rrsets are
    disabled.
        Thanks to Qifan Zhang, Palo Alto Networks, for the report.
        Fix to handle NSEC3 zones without space for hashes. Zones with a apex domain name length >= 223 bytes,
    that have a NSEC3PARAM must not be prehashed, since the hashed owner name would not fit.
        Thanks Qifan Zhang, Palo Alto Networks, for the report
        Fix to add hardening to zone_ixfr_remove_oldest, for IXFR processing.
        Thanks to Qifan Zhang, Palo Alto Networks, for the report.
        Fix for xfrd crash with too short response to a UDP SOA query Only for release builds and only when
    configured for XFR over UDP
        Thanks to Qifan Zhang, Palo Alto Networks, for the report.
        Fix that out-of-zone records are skipped from zone transfers.
        Otherwise such records could stick around after zone deletion and cause failures for DS queries.
        Thanks to Qifan Zhang, Palo Alto Networks, for the report.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2026-0b77a23312");
  script_set_attribute(attribute:"solution", value:
"Update the affected nsd package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-12244");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-12245");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/03");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:43");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:nsd");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Fedora Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'Fedora' >!< os_product) audit(AUDIT_OS_NOT, 'Fedora');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Fedora');
if (! preg(pattern:"^43([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'Fedora 43', 'Fedora ' + os_version);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Fedora', cpu);

var constraints = [
  {
    'release': '43',
    'pkgs': [
      {'reference':'nsd-4.15.0-1.fc43', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'nsd');
}