HCL BigFix Server 10.0.x <= 10.0.16 / 11.0.x <= 11.0.7 Certificate Validation (KB0134758)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(373597);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/30");

  script_cve_id("CVE-2026-108013");
  script_xref(name:"IAVA", value:"2026-A-1206");

  script_name(english:"HCL BigFix Server 10.0.x <= 10.0.16 / 11.0.x <= 11.0.7 Certificate Validation (KB0134758)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by a certificate validation vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of HCL BigFix Server installed on the remote host is 10.0.x through 10.0.16 or 11.0.x through 11.0.7. It
is, therefore, affected by a vulnerability in the bundled CA certificate store:

  - BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20
    still trust certificates whose private keys have been compromised. When BigFix Platform validates servers
    using such a bundle, an on-path attacker can impersonate remote servers and tamper with files downloaded
    by the application. The issue is resolved by using bundle version 2026/10/20 or later. The fixed bundle is
    available starting from BES Support v1520. (CVE-2026-108013)

HCL has not published a fixed HCL BigFix Platform release for this issue. The corrected certificate bundle is
delivered as content, so the installed platform version does not change once the remediation has been applied.
Nessus cannot verify the version of the deployed certificate bundle, so this finding is flagged as a potential
vulnerability.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://support.hcl-software.com/kb_view.do?sysparm_article=KB0134758");
  script_set_attribute(attribute:"solution", value:
"Gather BES Support site version 1520 and apply the Fixlet 6120 on all applicable targets, based upon the guidance
specified in KB0134758.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-108013");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/29");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:hcltech:bigfix_platform");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:bigfix_platform");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:endpoint_manager");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:tivoli_endpoint_manager");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("hcl_bigfix_server_win_installed.nbin");
  script_require_keys("installed_sw/HCL BigFix Server", "SMB/Registry/Enumerated", "Settings/ParanoidReport");

  exit(0);
}

include('vdf.inc');

get_kb_item_or_exit('SMB/Registry/Enumerated');

if (report_paranoia < 2)
  audit(AUDIT_PARANOID);

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'windows'}}
  ],
  'checks': [
    {
      'product': {'name': 'HCL BigFix Server', 'type': 'app'},
      'check_algorithm': 'default',
      'potential_vulnerability': {
        'missing_config_check': true
      },
      'requires': [
        {'scope': 'target', 'match': {'paranoia': true}}
      ],
      'constraints': [
        {'min_version': '10.0.0', 'max_version': '10.0.16.999999', 'fixed_display': 'Gather BES Support v1520'},
        {'min_version': '11.0.0', 'max_version': '11.0.7.999999', 'fixed_display': 'Gather BES Support v1520'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);