GLSA-201709-09 : Subversion: Arbitrary code execution

#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 201709-09.
#
# The advisory text is Copyright (C) 2001-2018 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike 
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(103277);
  script_version("3.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/21");

  script_cve_id("CVE-2017-9800");
  script_xref(name:"GLSA", value:"201709-09");

  script_name(english:"GLSA-201709-09 : Subversion: Arbitrary code execution");

  script_set_attribute(attribute:"synopsis", value:
"The remote Gentoo host is missing one or more security-related
patches.");
  script_set_attribute(attribute:"description", value:
"The remote host is affected by the vulnerability described in GLSA-201709-09
(Subversion: Arbitrary code execution)

    Specially crafted ‘ssh://...’ URLs may allow the owner of the
      repository to execute arbitrary commands on client’s machine if those
      commands are already installed on the client’s system. This is
      especially dangerous when the third-party repository has one or more
      submodules with specially crafted ‘ssh://...’ URLs. Each time the
      repository is recursively cloned or submodules are updated the payload
      will be triggered.
  
Impact :

    A remote attacker, by enticing a user to clone a specially crafted
      repository, could possibly execute arbitrary code with the privileges of
      the process.
  
Workaround :

    There are several alternative ways to fix this vulnerability. Please
      refer to Subversion Team Announce for more details.");
  script_set_attribute(attribute:"see_also", value:"https://subversion.apache.org/security/CVE-2017-9800-advisory.txt");
  script_set_attribute(attribute:"see_also", value:"https://security.gentoo.org/glsa/201709-09");
  script_set_attribute(attribute:"solution", value:
"All Subversion 1.9.x users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=dev-vcs/subversion-1.9.7'
    All Subversion 1.8.x users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=dev-vcs/subversion-1.8.18'");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-9800");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"patch_publication_date", value:"2017/09/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/09/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:subversion");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Gentoo Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2017-2025 Tenable Network Security, Inc.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("qpkg.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (qpkg_check(package:"dev-vcs/subversion", unaffected:make_list("ge 1.9.7", "rgt 1.8.18"), vulnerable:make_list("lt 1.9.7"))) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = qpkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Subversion");
}