MiracleLinux 4 : openssl-1.0.1e-48.3.0.1.AXS4 (AXSA:2016-686:04)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# Miracle Linux Security Advisory AXSA:2016-686:04.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(289655);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/16");

  script_cve_id(
    "CVE-2016-2177",
    "CVE-2016-2178",
    "CVE-2016-2179",
    "CVE-2016-2180",
    "CVE-2016-2181",
    "CVE-2016-2182",
    "CVE-2016-6302",
    "CVE-2016-6304",
    "CVE-2016-6306"
  );

  script_name(english:"MiracleLinux 4 : openssl-1.0.1e-48.3.0.1.AXS4 (AXSA:2016-686:04)");

  script_set_attribute(attribute:"synopsis", value:
"The remote MiracleLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the
AXSA:2016-686:04 advisory.

    The OpenSSL toolkit provides support for secure communications between
    machines. OpenSSL includes a certificate management tool and shared
    libraries which provide various cryptographic algorithms and
    protocols.
    Security issues fixed with this release:
    CVE-2016-2177
    OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for
    heap-buffer boundary checks, which might allow remote attackers to
    cause a denial of service (integer overflow and application crash) or
    possibly have unspecified other impact by leveraging unexpected malloc
    behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.
    CVE-2016-2178
    The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL
    through 1.0.2h does not properly ensure the use of constant-time
    operations, which makes it easier for local users to discover a DSA
    private key via a timing side-channel attack.
    CVE-2016-2179
    The DTLS implementation in OpenSSL before 1.1.0 does not properly
    restrict the lifetime of queue entries associated with unused
    out-of-order messages, which allows remote attackers to cause a denial
    of service (memory consumption) by maintaining many crafted DTLS
    sessions simultaneously, related to d1_lib.c, statem_dtls.c,
    statem_lib.c, and statem_srvr.c.
    CVE-2016-2180
    The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509
    Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in
    OpenSSL through 1.0.2h allows remote attackers to cause a denial of
    service (out-of-bounds read and application crash) via a crafted
    time-stamp file that is mishandled by the openssl ts command.
    CVE-2016-2181
    The Anti-Replay feature in the DTLS implementation in OpenSSL before
    1.1.0 mishandles early use of a new epoch number in conjunction with a
    large sequence number, which allows remote attackers to cause a denial
    of service (false-positive packet drops) via spoofed DTLS records,
    related to rec_layer_d1.c and ssl3_record.c.
    CVE-2016-2182
    The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0
    does not properly validate division results, which allows remote
    attackers to cause a denial of service (out-of-bounds write and
    application crash) or possibly have unspecified other impact via
    unknown vectors.
    CVE-2016-6302
    The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before
    1.1.0 does not consider the HMAC size during validation of the ticket
    length, which allows remote attackers to cause a denial of service via
    a ticket that is too short.
    CVE-2016-6304
    Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2
    before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause
    a denial of service (memory consumption) via large OCSP Status Request
    extensions.
    CVE-2016-6306
    The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before
    1.0.2i might allow remote attackers to cause a denial of service
    (out-of-bounds read) via crafted certificate operations, related to
    s3_clnt.c and s3_srvr.c.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://tsn.miraclelinux.com/en/node/7118");
  script_set_attribute(attribute:"solution", value:
"Update the affected openssl and / or openssl-devel packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-2182");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"High");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/05/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/09/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:openssl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:openssl-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:miracle:linux:4");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Miracle Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/MiracleLinux/release", "Host/MiracleLinux/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'MIRACLE LINUX' >!< os_product) audit(AUDIT_OS_NOT, 'MIRACLE LINUX');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'MIRACLE LINUX');
if (! preg(pattern:"^4([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'MiracleLinux 4.x', 'MIRACLE LINUX ' + os_version);

if (!get_kb_item('Host/MiracleLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'ppc' >!< cpu && 's390' >!< cpu && 'x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'MIRACLE LINUX', cpu);

var constraints = [
  {
    'release': '4',
    'pkgs': [
      {'reference':'openssl-1.0.1e-48.3.0.1.AXS4', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'openssl-1.0.1e-48.3.0.1.AXS4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'openssl-devel-1.0.1e-48.3.0.1.AXS4', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'openssl-devel-1.0.1e-48.3.0.1.AXS4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}
if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'openssl / openssl-devel');
}