Fedora 44 : coturn (2026-8856c5be6f)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory FEDORA-2026-8856c5be6f
#

include('compat.inc');

if (description)
{
  script_id(331602);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/02");
  script_xref(name:"FEDORA", value:"2026-8856c5be6f");

  script_name(english:"Fedora 44 : coturn (2026-8856c5be6f)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Fedora host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the
FEDORA-2026-8856c5be6f advisory.

    # Coturn 4.15.0

    ## Security
     - **Ignore STUN attributes after MESSAGE-INTEGRITY** (GHSA-5538-7cxj-5jcc). Per RFC 8489 9 / RFC 5389
    15.4, attributes following MESSAGE-INTEGRITY (other than FINGERPRINT) must be ignored, but coturn
    processed the full attribute list. This also fixes an interop bug where an RFC 8489 client sending
    MESSAGE-INTEGRITY-SHA256 after MESSAGE-INTEGRITY was wrongly answered with error 420.
     - **Bind mobility session-resume to the original allocation owner**  a MOBILITY-TICKET resume is now
    only accepted from the user that created the allocation.
     - **Reject ACME requests via signed 400 response** instead of silently dropping them.
     - Reset the reused UDP receive-buffer offset in the DTLS listener.
     - Zeroed channel-data padding in `stun_init_channel_message_str` so uninitialized stack bytes never reach
    the wire.
     - Fixed a `uint16_t` truncation overflow when computing STUN message length.
     - Fixed an off-by-one write past the realm buffer in `redis_list_admin_users`.
     - Fixed a `size_t` underflow in the telnet (CLI) `_process` data emit and bounded MSSP subnegotiation
    parsing to the buffer end.
     - NULL-terminated the HTTP request buffer before it is logged verbatim; switched `apputils.c` to bounded
    `snprintf`.

    ## New features
     - **RFC 8016 graceful dual-5-tuple mobility handoff**. A MOBILITY-TICKET resume no longer hard-switches
    the allocation at REFRESH time. The server now does a make-before-break transition: peerclient traffic
    stays on the old 5-tuple until the client's first packet arrives on the new one, and only then is the old
    socket discarded.
     - `--drain-min-allocations`  a shutdown threshold for drain mode: the server exits once the live
    allocation count falls to the configured value instead of waiting for zero.
     - `--log-min-level` (`log_min_level` in the config file)  a real minimum-log-level filter, since
    `-v`/`--verbose` had little effect on turnserver logging.
     - **Alternate-server TCP/UDP distinction**  alternate servers are now tracked per transport, so TCP
    and UDP clients can be redirected to different alternate servers.
     - **Fail-fast allocation wrappers**  all heap allocation in coturn-owned code goes through
    `turn_malloc`/`turn_calloc`/`turn_realloc`/`turn_strdup`, which log the call site and abort on OOM rather
    than risking NULL-dereference or silent degradation in a long-running server.

    ## Reliability and correctness fixes
     - Fixed the remaining misaligned wire-buffer accesses and added alignment-safe
    `turn_read_u16`/`u32`/`u64` / `turn_write_*` helpers  misaligned reads of STUN attribute values were
    undefined behavior and a SIGBUS on strict-alignment targets.
     - Fixed `uint32_t` counter wraparound in the relay port allocator.
     - Worker threads are now joined on shutdown, fixing an exit-time OpenSSL race; OpenSSL atexit cleanup is
    disabled in turnserver.
     - Released the alternate-server list mutex when `del_alt_server` removes the last entry, fixing a
    deadlock.
     - `setgroups` is no longer called unconditionally in mainrelay, fixing startup under environments where
    it's not permitted.
     - Freed `EVP_CIPHER_CTX` on error paths in the OAuth GCM encode/decode and avoided leaks on realloc
    failure in TCP relay allocation.
     - Cast to `unsigned char` before `isspace()` in config-file parsing.
     - Log an explicit error when a configured `tls-listening-port` cannot start.
     - Autotools build now detects `hiredis_ssl`, enabling Redis TLS in the `./configure` build.

    ## Metrics
     - Every STUN Binding response is now counted in the Prometheus metrics.

    ## Client utilities
     - `turnutils_uclient` now sends the SNI host name on TLS connections.
     - heap-allocates its STUN message buffers instead of using large stack buffers.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2026-8856c5be6f");
  script_set_attribute(attribute:"solution", value:
"Update the affected coturn package.");
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/02");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:44");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:coturn");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Fedora Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'Fedora' >!< os_product) audit(AUDIT_OS_NOT, 'Fedora');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Fedora');
if (! preg(pattern:"^44([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'Fedora 44', 'Fedora ' + os_version);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Fedora', cpu);

var constraints = [
  {
    'release': '44',
    'pkgs': [
      {'reference':'coturn-4.15.0-1.fc44', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'coturn');
}