MiracleLinux 4 : openswan-2.6.32-9.0.1.AXS4 (AXSA:2012-70:01)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# Miracle Linux Security Advisory AXSA:2012-70:01.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(284023);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/14");

  script_cve_id("CVE-2011-4073");

  script_name(english:"MiracleLinux 4 : openswan-2.6.32-9.0.1.AXS4 (AXSA:2012-70:01)");

  script_set_attribute(attribute:"synopsis", value:
"The remote MiracleLinux host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the
AXSA:2012-70:01 advisory.

    Openswan is a free implementation of IPsec & IKE for Linux.  IPsec is the Internet Protocol Security and
    uses strong cryptography to provide both authentication and encryption services.  These services allow
    youto build secure tunnels through untrusted networks.  Everything passing through the untrusted net is
    encrypted by the ipsec gateway machine and decrypted by the gateway at the other end of the tunnel.  The
    resulting tunnel is a virtual private network or VPN.
    This package contains the daemons and userland tools for setting up Openswan. It supports the NETKEY/XFRM
    IPsec kernel stack that exists in the default Linux kernel.
    Openswan 2.6.x also supports IKEv2 (RFC4306)
    Security issues fixed with this release:
    CVE-2011-4073
    Use-after-free vulnerability in the cryptographic helper handler functionality in Openswan 2.3.0 through
    2.6.36 allows remote authenticated users to cause a denial of service (pluto IKE daemon crash) via vectors
    related to the (1) quick_outI1_continue and (2) quick_outI1 functions.
    Fixed bugs:
     - When the ports were defined and the host was defined with its hostname, openswan did not handle
    protocol and port configuration correctly. This has been fixed.
     - Previously, very large security label strings received from a peer were being truncated but still used.
    Those truncated strings could happen to be valid, lead ing to incorrect policy. This has been fixed.
     - Erroneous queuing of on-demand requests of setting up an IPsec connection was discovered in the IKEv2
    (Internet Key Exchange) code. This is not intended and has been removed.
     - Openswan would process the AH (Authentication Header) mode as if it was the ESP (Encrypted Secure
    Payload) mode, and then fail to set up AH mode security associations (SAs) because it was waiting for an
    encryption key. This has been fixed.
     - If a specific port was configured, IPsec connections over a loopback interface did not work properly.
    This has been fixed.
     - Enabled the CRL functionality flags on compilation so that openswan supportretrieving Certificate
    Revocation Lists (CRLs) from HTTP or LDAP CRL Distribution Points (CDPs).
     - Corrected the README.x509 file to provide accurate information regarding the directories to be scanned
    for certification files. openswan now discovers all certificates.
     - The Network Manager padlock icon was not cleared after a VPN connection terminated unexpectedly. This
    has been fixed.
     - Openswan sent wrong IKEv2 (Internet Key Exchange) ICMP (Internet Control Message Protocol) selectors to
    an IPsec destination. This has been fixed.
     - When an IP address had been removed from end of an established IPsec tunnel and the other end of the
    tunnel attempted to reuse the particular IP address to create a new tunnel, the Pluto daemon terminated
    unexpectedly with a segmentation fault. This has been fixed.
    Enhancement:
     - Added the iptable-save command, which uses only iptables and does not load kernel modules, unlike the
    ipsec barf and ipsec verify commands.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://tsn.miraclelinux.com/en/node/2558");
  script_set_attribute(attribute:"solution", value:
"Update the affected openswan package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2011-4073");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_severity", value:"High");

  script_set_attribute(attribute:"vuln_publication_date", value:"2011/10/31");
  script_set_attribute(attribute:"patch_publication_date", value:"2012/02/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:openswan");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:miracle:linux:4");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Miracle Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/MiracleLinux/release", "Host/MiracleLinux/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'MIRACLE LINUX' >!< os_product) audit(AUDIT_OS_NOT, 'MIRACLE LINUX');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'MIRACLE LINUX');
if (! preg(pattern:"^4([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'MiracleLinux 4.x', 'MIRACLE LINUX ' + os_version);

if (!get_kb_item('Host/MiracleLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'ppc' >!< cpu && 's390' >!< cpu && 'x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'MIRACLE LINUX', cpu);

var constraints = [
  {
    'release': '4',
    'pkgs': [
      {'reference':'openswan-2.6.32-9.0.1.AXS4', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'openswan-2.6.32-9.0.1.AXS4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}
if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'openswan');
}