MiracleLinux 4 : ipa-3.0.0-47.0.1.AXS4 (AXSA:2015-419:01)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# Miracle Linux Security Advisory AXSA:2015-419:01.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(289793);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/16");

  script_cve_id("CVE-2010-5312", "CVE-2012-6662");

  script_name(english:"MiracleLinux 4 : ipa-3.0.0-47.0.1.AXS4 (AXSA:2015-419:01)");

  script_set_attribute(attribute:"synopsis", value:
"The remote MiracleLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the
AXSA:2015-419:01 advisory.

    IPA is an integrated solution to provide centrally managed Identity (machine,
    user, virtual machines, groups, authentication credentials), Policy
    (configuration settings, access control information) and Audit (events,
    logs, analysis thereof).
    Security issues fixed with this release:
    CVE-2010-5312
    Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the
    Dialog widget in jQuery UI before 1.10.0 allows remote attackers to
    inject arbitrary web script or HTML via the title option.
    CVE-2012-6662
    Cross-site scripting (XSS) vulnerability in the default content option
    in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before
    1.10.0 allows remote attackers to inject arbitrary web script or HTML
    via the title attribute, which is not properly handled in the
    autocomplete combo box demo.
    Fixed bugs:
    * The ipa-server-install, ipa-replica-install, and ipa-client-install utilities
    are not supported on machines running in FIPS-140 mode. Previously, IdM did not
    warn users about this. Now, the bug has been fixed with this update.
    * If an Active Directory (AD) server was specified or discovered automatically
    when running the ipa-client-install utility, the utility produced a traceback
    instead of informing the user that an IdM server is expected in this situation.
    With this update, the bug has been fixed.
    * When IdM servers were configured to require the TLS protocol version 1.1
    (TLSv1.1) or later in the httpd server, the ipa utility failed. With this
    update, running ipa works as expected with TLSv1.1 or later.
    * In certain high-load environments, the Kerberos authentication step of the IdM
    client installer can fail. Previously, the entire client installation failed in
    this situation. To fix this bug, this update modifies ipa-client-install to prefer the TCP
    protocol over the UDP protocol and to retry the authentication attempt in case
    of failure.
    * If ipa-client-install updated or created the /etc/nsswitch.conf file, the sudo
    utility could terminate unexpectedly with a segmentation fault. Now,
    ipa-client-install puts a new line character at the end of nsswitch.conf if it
    modifies the last line of the file, fixing this bug.
    * The ipa-client-automount utility failed with the UNWILLING_TO_PERFORM LDAP
    error when the nsslapd-minssf Red Hat Directory Server configuration parameter
    was set to 1. With this update, the problem has been fixed.
    * If installing an IdM server failed after the Certificate Authority (CA)
    installation, the ipa-server-install --uninstall command did not perform a
    proper cleanup. After the user issued ipa-server-install --uninstall and then
    attempted to install the server again, the installation failed. With this update, the bug
    has been fixed.
    * Running ipa-client-install added the sss entry to the sudoers line in
    nsswitch.conf even if sss was already configured and the entry was present in
    the file. Duplicate sss then caused sudo to become unresponsive. With this update,
    the bug has been fixed.
    * After running ipa-client-install, it was not possible to log in using SSH
    under certain circumstances. Now, ipa-client-install no longer corrupts the
    sshd_config file, and the sshd service can start as expected.
    * An incorrect definition of the dc attribute in the
    /usr/share/ipa/05rfc2247.ldif file caused bogus error messages to be returned
    during migration. The attribute has been fixed, but the bug persists if the
    copy-schema-to-ca.py script was run on Asianux Server 4 SP4 prior to
    running it on Asianux Server 4 SP5. With this update, fixed it.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://tsn.miraclelinux.com/en/node/5766");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2012-6662");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2010-5312");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Moderate");

  script_set_attribute(attribute:"vuln_publication_date", value:"2012/11/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2015/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:ipa-admintools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:ipa-client");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:ipa-python");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:ipa-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:ipa-server-selinux");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:ipa-server-trust-ad");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:miracle:linux:4");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Miracle Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/MiracleLinux/release", "Host/MiracleLinux/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'MIRACLE LINUX' >!< os_product) audit(AUDIT_OS_NOT, 'MIRACLE LINUX');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'MIRACLE LINUX');
if (! preg(pattern:"^4([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'MiracleLinux 4.x', 'MIRACLE LINUX ' + os_version);

if (!get_kb_item('Host/MiracleLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'ppc' >!< cpu && 's390' >!< cpu && 'x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'MIRACLE LINUX', cpu);

var constraints = [
  {
    'release': '4',
    'pkgs': [
      {'reference':'ipa-admintools-3.0.0-47.0.1.AXS4', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'ipa-admintools-3.0.0-47.0.1.AXS4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'ipa-client-3.0.0-47.0.1.AXS4', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'ipa-client-3.0.0-47.0.1.AXS4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'ipa-python-3.0.0-47.0.1.AXS4', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'ipa-python-3.0.0-47.0.1.AXS4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'ipa-server-3.0.0-47.0.1.AXS4', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'ipa-server-3.0.0-47.0.1.AXS4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'ipa-server-selinux-3.0.0-47.0.1.AXS4', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'ipa-server-selinux-3.0.0-47.0.1.AXS4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'ipa-server-trust-ad-3.0.0-47.0.1.AXS4', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'ipa-server-trust-ad-3.0.0-47.0.1.AXS4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}
if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'ipa-admintools / ipa-client / ipa-python / ipa-server / etc');
}