MiracleLinux 7 : binutils-2.23.52.0.1-55.el7 (AXSA:2015-717:01)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# Miracle Linux Security Advisory AXSA:2015-717:01.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(288890);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/16");

  script_cve_id(
    "CVE-2014-8484",
    "CVE-2014-8485",
    "CVE-2014-8501",
    "CVE-2014-8502",
    "CVE-2014-8503",
    "CVE-2014-8504",
    "CVE-2014-8737",
    "CVE-2014-8738"
  );

  script_name(english:"MiracleLinux 7 : binutils-2.23.52.0.1-55.el7 (AXSA:2015-717:01)");

  script_set_attribute(attribute:"synopsis", value:
"The remote MiracleLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the
AXSA:2015-717:01 advisory.

    Binutils is a collection of binary utilities, including ar (for
    creating, modifying and extracting from archives), as (a family of GNU
    assemblers), gprof (for displaying call graph profile data), ld (the
    GNU linker), nm (for listing symbols from object files), objcopy (for
    copying and translating object files), objdump (for displaying
    information from object files), ranlib (for generating an index for
    the contents of an archive), readelf (for displaying detailed
    information about binary files), size (for listing the section sizes
    of an object or archive file), strings (for listing printable strings
    from files), strip (for discarding symbols), and addr2line (for
    converting addresses to file and line).
    Security issues fixed with this release:
    CVE-2014-8484
    The srec_scan function in bfd/srec.c in libdbfd in GNU binutils before
    2.25 allows remote attackers to cause a denial of service
    (out-of-bounds read) via a small S-record.
    CVE-2014-8485
    The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24
    and earlier allows remote attackers to cause a denial of service
    (crash) and possibly execute arbitrary code via crafted section group
    headers in an ELF file.
    CVE-2014-8501
    The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU
    binutils 2.24 and earlier allows remote attackers to cause a denial of
    service (out-of-bounds write) and possibly have other unspecified
    impact via a crafted NumberOfRvaAndSizes field in the AOUT header in a
    PE executable.
    CVE-2014-8502
    Heap-based buffer overflow in the pe_print_edata function in
    bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote
    attackers to cause a denial of service (crash) and possibly have other
    unspecified impact via a truncated export table in a PE file.
    CVE-2014-8503
    Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in
    GNU binutils 2.24 and earlier allows remote attackers to cause a
    denial of service (crash) and possibly have other unspecified impact
    via a crafted ihex file.
    CVE-2014-8504
    Stack-based buffer overflow in the srec_scan function in bfd/srec.c in
    GNU binutils 2.24 and earlier allows remote attackers to cause a
    denial of service (crash) and possibly have other unspecified impact
    via a crafted file.
    CVE-2014-8737
    Multiple directory traversal vulnerabilities in GNU binutils 2.24 and
    earlier allow local users to delete arbitrary files via a .. (dot dot)
    or full path name in an archive to (1) strip or (2) objcopy or create
    arbitrary files via (3) a .. (dot dot) or full path name in an archive
    to ar.
    CVE-2014-8738
    The _bfd_slurp_extended_name_table function in bfd/archive.c in GNU
    binutils 2.24 and earlier allows remote attackers to cause a denial of
    service (invalid write, segmentation fault, and crash) via a crafted
    extended name table in an archive.
    Fixed bugs:
    * Binary files started by the system loader could lack the Relocation Read-Only (RELRO) protection even
    though it was explicitly requested when the application was built. This bug has been fixed on multiple
    architectures. Applications and all dependent object files, archives, and libraries built with an alpha or
    beta version of binutils should be rebuilt to correct this defect.
    * The ld linker on 64-bit PowerPC now correctly checks the output format when asked to produce a binary in
    another format than PowerPC.
    * An important variable that holds the symbol table for the binary being debugged has been made
    persistent, and the objdump utility on 64-bit PowerPC is now able to access the needed information without
    reading an invalid memory region.
    * Undesirable runtime relocations described in RHBA-2015:0974.
    Enhancements:
    * New hardware instructions of the IBM z Systems z13 are now supported by assembler, disassembler, and
    linker, as well as Single Instruction, Multiple Data (SIMD) instructions.
    * Expressions of the form: FUNC@localentry to refer to the local entry point for the FUNC function (if
    defined) are now supported by the PowerPC assembler. These are required by the ELFv2 ABI on the little-
    endian variant of IBM Power Systems.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://tsn.miraclelinux.com/en/node/6103");
  script_set_attribute(attribute:"solution", value:
"Update the affected binutils and / or binutils-devel packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2014-8504");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2014-8501");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Moderate");

  script_set_attribute(attribute:"vuln_publication_date", value:"2014/10/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2015/11/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:binutils");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:binutils-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:miracle:linux:7");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Miracle Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/MiracleLinux/release", "Host/MiracleLinux/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'MIRACLE LINUX' >!< os_product) audit(AUDIT_OS_NOT, 'MIRACLE LINUX');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'MIRACLE LINUX');
if (! preg(pattern:"^7([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'MiracleLinux 7.x', 'MIRACLE LINUX ' + os_version);

if (!get_kb_item('Host/MiracleLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'ppc' >!< cpu && 's390' >!< cpu && 'x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'MIRACLE LINUX', cpu);

var constraints = [
  {
    'release': '7',
    'pkgs': [
      {'reference':'binutils-2.23.52.0.1-55.el7', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'binutils-devel-2.23.52.0.1-55.el7', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'binutils-devel-2.23.52.0.1-55.el7', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}
if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'binutils / binutils-devel');
}