MiracleLinux 7 : dnsmasq-2.76-2.el7.2 (AXSA:2017-2341:02)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# Miracle Linux Security Advisory AXSA:2017-2341:02.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(289580);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/16");

  script_cve_id(
    "CVE-2017-14491",
    "CVE-2017-14492",
    "CVE-2017-14493",
    "CVE-2017-14494",
    "CVE-2017-14495",
    "CVE-2017-14496"
  );

  script_name(english:"MiracleLinux 7 : dnsmasq-2.76-2.el7.2 (AXSA:2017-2341:02)");

  script_set_attribute(attribute:"synopsis", value:
"The remote MiracleLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the
AXSA:2017-2341:02 advisory.

    * A heap buffer overflow was found in dnsmasq in the code responsible for building DNS replies. An
    attacker could send crafted DNS packets to dnsmasq which would cause it to crash or, potentially, execute
    arbitrary code. (CVE-2017-14491)
      * A heap buffer overflow was discovered in dnsmasq in the IPv6 router advertisement (RA) handling code.
    An attacker on the local network segment could send crafted RAs to dnsmasq which would cause it to crash
    or, potentially, execute arbitrary code. This issue only affected configurations using one of these
    options: enable-ra, ra-only, slaac, ra-names, ra-advrouter, or ra-stateless. (CVE-2017-14492)
      * A stack buffer overflow was found in dnsmasq in the DHCPv6 code. An attacker on the local network
    could send a crafted DHCPv6 request to dnsmasq which would cause it to a crash or, potentially, execute
    arbitrary code. (CVE-2017-14493)
      * An information leak was found in dnsmasq in the DHCPv6 relay code. An attacker on the local network
    could send crafted DHCPv6 packets to dnsmasq causing it to forward the contents of process memory,
    potentially leaking sensitive data. (CVE-2017-14494)
      * A memory exhaustion flaw was found in dnsmasq in the EDNS0 code. An attacker could send crafted DNS
    packets which would trigger memory allocations which would never be freed, leading to unbounded memory
    consumption and eventually a crash. This issue only affected configurations using one of the options: add-
    mac, add-cpe-id, or add-subnet. (CVE-2017-14495)
      * An integer underflow flaw leading to a buffer over-read was found in dnsmasq in the EDNS0 code. An
    attacker could send crafted DNS packets to dnsmasq which would cause it to crash. This issue only affected
    configurations using one of the options: add-mac, add-cpe-id, or add-subnet. (CVE-2017-14496)
    Asianux would like to thank Felix Wilhelm (Google Security Team), Fermin J.
    Serna (Google Security Team), Gabriel Campana (Google Security Team), Kevin
    Hamacher (Google Security Team), and Ron Bowes (Google Security Team) for
    reporting these issues.
    CVE-2017-14491
    Heap-based buffer overflow in dnsmasq before 2.78 allows remote
    attackers to cause a denial of service (crash) or execute arbitrary
    code via a crafted DNS response.
    CVE-2017-14492
    Heap-based buffer overflow in dnsmasq before 2.78 allows remote
    attackers to cause a denial of service (crash) or execute arbitrary
    code via a crafted IPv6 router advertisement request.
    CVE-2017-14493
    Stack-based buffer overflow in dnsmasq before 2.78 allows remote
    attackers to cause a denial of service (crash) or execute arbitrary
    code via a crafted DHCPv6 request.
    CVE-2017-14494
    dnsmasq before 2.78, when configured as a relay, allows remote
    attackers to obtain sensitive memory information via vectors involving
    handling DHCPv6 forwarded requests.
    CVE-2017-14495
    Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id
    or --add-subnet option is specified, allows remote attackers to cause
    a denial of service (memory consumption) via vectors involving DNS
    response creation.
    CVE-2017-14496
    Integer underflow in the add_pseudoheader function in dnsmasq before
    2.78 , when the --add-mac, --add-cpe-id or --add-subnet option is
    specified, allows remote attackers to cause a denial of service via a
    crafted DNS request.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://tsn.miraclelinux.com/en/node/8781");
  script_set_attribute(attribute:"solution", value:
"Update the affected dnsmasq package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-14493");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"High");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/10/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/10/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:dnsmasq");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:miracle:linux:7");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Miracle Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/MiracleLinux/release", "Host/MiracleLinux/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'MIRACLE LINUX' >!< os_product) audit(AUDIT_OS_NOT, 'MIRACLE LINUX');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'MIRACLE LINUX');
if (! preg(pattern:"^7([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'MiracleLinux 7.x', 'MIRACLE LINUX ' + os_version);

if (!get_kb_item('Host/MiracleLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'ppc' >!< cpu && 's390' >!< cpu && 'x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'MIRACLE LINUX', cpu);

var constraints = [
  {
    'release': '7',
    'pkgs': [
      {'reference':'dnsmasq-2.76-2.el7.2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}
if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dnsmasq');
}