MiracleLinux 4 : libguestfs-1.20.11-2.0.1.AXS4 (AXSA:2014-288:02)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# Miracle Linux Security Advisory AXSA:2014-288:02.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(289866);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/16");

  script_cve_id("CVE-2013-4419");

  script_name(english:"MiracleLinux 4 : libguestfs-1.20.11-2.0.1.AXS4 (AXSA:2014-288:02)");

  script_set_attribute(attribute:"synopsis", value:
"The remote MiracleLinux host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the
AXSA:2014-288:02 advisory.

    Libguestfs is a library for accessing and modifying guest disk images. Amongst the things this is good
    for: making batch configuration changes to guests, getting disk used/free statistics (see also: virt-df),
    migrating between virtualization systems (see also: virt-p2v), performing partial backups, performing
    partial guest clones, cloning guests and changing registry/UUID/hostname info, and much else besides.
    Libguestfs uses Linux kernel and qemu code, and can access any type of guest filesystem that Linux and
    qemu can, including but not limited to: ext2/3/4, btrfs, FAT and NTFS, LVM, many different disk partition
    schemes, qcow, qcow2, vmdk.
    Libguestfs provides ways to enumerate guest storage (eg. partitions, LVs, what filesystem is in each LV,
    etc.). It can also run commands in the context of the guest.
    Libguestfs is a library that can be linked with C and C++ management programs.
    For high level virt tools, guestfish (shell scripting and command line access), and guestmount (mount
    guest filesystems using FUSE), install 'libguestfs-tools'.
    For shell scripting and command line access, install 'guestfish'.
    To mount guest filesystems on the host using FUSE, install 'libguestfs-mount'.
    For Java bindings, install 'libguestfs-java-devel'.
    For OCaml bindings, install 'ocaml-libguestfs-devel'.
    For Perl bindings, install 'perl-Sys-Guestfs'.
    For Python bindings, install 'python-libguestfs'.
    For Ruby bindings, install 'ruby-libguestfs'.
    Security issues fixed with this release:
     CVE-2013-4419
    The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen
    option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket
    file in this directory, which allows local users to write to the socket and execute arbitrary commands by
    creating /tmp/.guestfish-$UID/ in advance.
    Fixed bugs:
     Removed buildnet: builds now detect network automatically.
     Backported new APIs part-get-gpt-type and part-set-gpt-type
     Fixed DoS (abort) due to a double free flaw when inspecting certain guest files / images.
     Previously, libguestfs failed to detect MS Windows guests that used a non-default systemroot path. This
    has been fixed: it now uses the boot.ini file to find the systemroot path.
     Added the back state commands to guestfish.
     Previously, ntfsresize would fail if the target size was not specified. This has been fixed and
    libguestfs now automatically establishes the size of the target storage device.
     Fixed the txz-out API.
     Moved the virt-sysprep to the libguestfs-tools-c package since it's no longer a shell script.
     Fixed hostname inspection: it was faulty because of Augeas path expression
     Previously, libguestfs entered an infinite loop when using the iface parameter when adding a rive. This
    has been fixed.
     Added notes about resizing Windows disk images to virt-resize documentation
     Removed the dependency on lsscsi.
     Fixed yum cache copy so it works when there are several repositories.
     Fixed hivex-commit API to fail with relative paths.
     Improved the documentation for filesystem-available API.
     Fixed double free when kernel link fails during launch
     Fixed virt-sysprep --firstboot option.
     Fixed cap-get-file so it returns empty string instead of error on no cap.
     Improved the documentation for acl-set-file.
     Fixed bogus waitpid error message when using guestfish --remote.
     Disabled 9p support.
     Documented that guestfish --remote doesn't work with certain other arguments.
     Previously, when under heavy load, messages would appear in the debug output. libguestfs now checks if
    the kvmclock kernel feature is enabled, which reduces the output.
     Previously, if a file system was not mounted before running the guestfs_sh or sh command, the guestfish
    utility would crash with a segmentation fault. A check has been added in guestfish and it reports an error
    message if the file system is not mounted.
     Added various fixes to tar-out 'excludes'.
     Documented the use of glob + rsync-out.
     Documented mke2fs blockscount.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://tsn.miraclelinux.com/en/node/4727");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2013-4419");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_severity", value:"High");

  script_set_attribute(attribute:"vuln_publication_date", value:"2013/10/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2014/05/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:libguestfs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:libguestfs-java");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:libguestfs-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:libguestfs-tools-c");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:perl-Sys-Guestfs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:python-libguestfs");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:miracle:linux:4");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Miracle Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/MiracleLinux/release", "Host/MiracleLinux/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'MIRACLE LINUX' >!< os_product) audit(AUDIT_OS_NOT, 'MIRACLE LINUX');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'MIRACLE LINUX');
if (! preg(pattern:"^4([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'MiracleLinux 4.x', 'MIRACLE LINUX ' + os_version);

if (!get_kb_item('Host/MiracleLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'ppc' >!< cpu && 's390' >!< cpu && 'x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'MIRACLE LINUX', cpu);

var constraints = [
  {
    'release': '4',
    'pkgs': [
      {'reference':'libguestfs-1.20.11-2.0.1.AXS4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'libguestfs-java-1.20.11-2.0.1.AXS4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'libguestfs-tools-1.20.11-2.0.1.AXS4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'libguestfs-tools-c-1.20.11-2.0.1.AXS4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'perl-Sys-Guestfs-1.20.11-2.0.1.AXS4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'python-libguestfs-1.20.11-2.0.1.AXS4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}
if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libguestfs / libguestfs-java / libguestfs-tools / etc');
}