GLSA-201203-02 : cURL: Multiple vulnerabilities (BEAST)

#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 201203-02.
#
# The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike 
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(58212);
  script_version("1.15");
  script_set_attribute(attribute:"plugin_modification_date", value:"2022/12/05");

  script_cve_id(
    "CVE-2010-0734",
    "CVE-2011-2192",
    "CVE-2011-3389",
    "CVE-2012-0036"
  );
  script_bugtraq_id(
    38162,
    48434,
    49778,
    51665
  );
  script_xref(name:"GLSA", value:"201203-02");
  script_xref(name:"CEA-ID", value:"CEA-2019-0547");

  script_name(english:"GLSA-201203-02 : cURL: Multiple vulnerabilities (BEAST)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Gentoo host is missing one or more security-related
patches.");
  script_set_attribute(attribute:"description", value:
"The remote host is affected by the vulnerability described in GLSA-201203-02
(cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in cURL:
      When zlib is enabled, the amount of data sent to an application for
        automatic decompression is not restricted (CVE-2010-0734).
      When performing GSSAPI authentication, credential delegation is
        always used (CVE-2011-2192).
      When SSL is enabled, cURL improperly disables the OpenSSL workaround
        to mitigate an information disclosure vulnerability in the SSL and TLS
        protocols (CVE-2011-3389).
      libcurl does not properly verify file paths for escape control
        characters in IMAP, POP3 or SMTP URLs (CVE-2012-0036).
  
Impact :

    A remote attacker could entice a user or automated process to open a
      specially crafted file or URL using cURL, possibly resulting in the
      remote execution of arbitrary code, a Denial of Service condition,
      disclosure of sensitive information, or unwanted actions performed via
      the IMAP, POP3 or SMTP protocols. Furthermore, remote servers may be able
      to impersonate clients via GSSAPI requests.
  
Workaround :

    There is no known workaround at this time.");
  script_set_attribute(attribute:"see_also", value:"https://security.gentoo.org/glsa/201203-02");
  script_set_attribute(attribute:"solution", value:
"All cURL users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=net-misc/curl-7.24.0'");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"in_the_news", value:"true");

  script_set_attribute(attribute:"patch_publication_date", value:"2012/03/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/03/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:curl");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Gentoo Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2012-2022 Tenable Network Security, Inc.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("qpkg.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (qpkg_check(package:"net-misc/curl", unaffected:make_list("ge 7.24.0"), vulnerable:make_list("lt 7.24.0"))) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = qpkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "cURL");
}