CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:C/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
AI Score
Confidence
High
The remote host is affected by the vulnerability described in GLSA-202409-26 (IcedTea: Multiple Vulnerabilities)
Multiple vulnerabilities have been discovered in IcedTea. Please review the CVE identifiers referenced below for details.
Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.
#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# @NOAGENT@
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 202409-26.
#
# The advisory text is Copyright (C) 2001-2021 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#
include('compat.inc');
if (description)
{
script_id(207886);
script_version("1.2");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/09/28");
script_cve_id(
"CVE-2020-14556",
"CVE-2020-14562",
"CVE-2020-14573",
"CVE-2020-14577",
"CVE-2020-14578",
"CVE-2020-14579",
"CVE-2020-14581",
"CVE-2020-14583",
"CVE-2020-14593",
"CVE-2020-14621",
"CVE-2020-14664",
"CVE-2020-14779",
"CVE-2020-14781",
"CVE-2020-14782",
"CVE-2020-14792",
"CVE-2020-14796",
"CVE-2020-14797",
"CVE-2020-14798",
"CVE-2020-14803",
"CVE-2021-2341",
"CVE-2021-2369",
"CVE-2021-2388",
"CVE-2021-2432",
"CVE-2021-35550",
"CVE-2021-35556",
"CVE-2021-35559",
"CVE-2021-35561",
"CVE-2021-35564",
"CVE-2021-35565",
"CVE-2021-35567",
"CVE-2021-35578",
"CVE-2021-35586",
"CVE-2021-35588",
"CVE-2021-35603",
"CVE-2022-21618",
"CVE-2022-21619",
"CVE-2022-21624",
"CVE-2022-21626",
"CVE-2022-21628",
"CVE-2022-39399",
"CVE-2023-21830",
"CVE-2023-21835",
"CVE-2023-21843"
);
script_xref(name:"CEA-ID", value:"CEA-2021-0004");
script_name(english:"GLSA-202409-26 : IcedTea: Multiple Vulnerabilities");
script_set_attribute(attribute:"synopsis", value:
"");
script_set_attribute(attribute:"description", value:
"The remote host is affected by the vulnerability described in GLSA-202409-26 (IcedTea: Multiple Vulnerabilities)
Multiple vulnerabilities have been discovered in IcedTea. Please review the CVE identifiers referenced
below for details.
Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
script_set_attribute(attribute:"see_also", value:"https://security.gentoo.org/glsa/202409-26");
script_set_attribute(attribute:"see_also", value:"https://bugs.gentoo.org/show_bug.cgi?id=732628");
script_set_attribute(attribute:"see_also", value:"https://bugs.gentoo.org/show_bug.cgi?id=803608");
script_set_attribute(attribute:"see_also", value:"https://bugs.gentoo.org/show_bug.cgi?id=877599");
script_set_attribute(attribute:"solution", value:
"Gentoo has discontinued support for IcedTea. We recommend that users unmerge it:
# emerge --sync
# emerge --ask --depclean dev-java/icedtea dev-java/icedtea-bin");
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:N/A:N");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-35550");
script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2020-14664");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"vuln_publication_date", value:"2020/07/14");
script_set_attribute(attribute:"patch_publication_date", value:"2024/09/28");
script_set_attribute(attribute:"plugin_publication_date", value:"2024/09/28");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Gentoo Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
exit(0);
}
include('qpkg.inc');
if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item('Host/Gentoo/release')) audit(AUDIT_OS_NOT, 'Gentoo');
if (!get_kb_item('Host/Gentoo/qpkg-list')) audit(AUDIT_PACKAGE_LIST_MISSING);
var flag = 0;
var packages = [
];
foreach var package( packages ) {
if (isnull(package['unaffected'])) package['unaffected'] = make_list();
if (isnull(package['vulnerable'])) package['vulnerable'] = make_list();
if (qpkg_check(package: package['name'] , unaffected: package['unaffected'], vulnerable: package['vulnerable'])) flag++;
}
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : qpkg_report_get()
);
exit(0);
}
else
{
qpkg_tests = list_uniq(qpkg_tests);
var tested = qpkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'IcedTea');
}
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14556
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14562
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14573
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14577
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14578
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14579
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14581
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14583
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14593
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14621
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14664
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14779
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14781
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14782
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14792
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14796
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14797
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14798
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14803
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2341
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2369
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2388
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2432
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35550
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35556
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35559
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35561
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35564
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35565
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35567
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35578
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35586
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35588
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35603
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21618
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21619
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21624
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21626
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21628
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39399
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21830
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21835
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21843
bugs.gentoo.org/show_bug.cgi?id=732628
bugs.gentoo.org/show_bug.cgi?id=803608
bugs.gentoo.org/show_bug.cgi?id=877599
security.gentoo.org/glsa/202409-26
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:C/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
AI Score
Confidence
High