MiracleLinux 4 : httpd24-1.1-18.AXS4, httpd24-httpd-2.4.27-8.AXS4 (AXSA:2017-2405:01)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# Miracle Linux Security Advisory AXSA:2017-2405:01.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(288994);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/16");

  script_cve_id("CVE-2017-9798");

  script_name(english:"MiracleLinux 4 : httpd24-1.1-18.AXS4, httpd24-httpd-2.4.27-8.AXS4 (AXSA:2017-2405:01)");

  script_set_attribute(attribute:"synopsis", value:
"The remote MiracleLinux host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the
AXSA:2017-2405:01 advisory.

    * A use-after-free flaw was found in the way httpd handled invalid and
    previously unregistered HTTP methods specified in the Limit directive used in an
    .htaccess file. A remote attacker could possibly use this flaw to disclose
    portions of the server memory, or cause httpd child process to crash.
    (CVE-2017-9798)
    Asianux would like to thank Hanno Bck for reporting this issue.
    Bug Fix(es):
      * The httpd package installation script tried to create both the apache user
    and group in a single useradd command. Consequently, when the apache group
    had already been created on the system, the command failed, and the apache
    user was not created. To fix this bug, the apache group is now created by a
    separate command, and the apache user is correctly created during httpd
    installation even when the apache group exists. (BZ#1486843)
      * When installing the httpd24 Software Collection using the yum command, if
    the apache group already existed on the system with GID other than 48, the
    apache user was not created. This update fixes the bug. (BZ#1487164)
      * With this update, it is possible to run the mod_rewrite external mapping
    program as a non-root user. (BZ#1486832)
      * On a Asianux Server 4 system, when the httpd service was stopped twice in a
    row by running the service httpd stop command, a misleading message was
    returned: Stopping httpd: [FAILED]. This bug has been fixed. (BZ#1418395)
      * When the service httpd24-httpd graceful command was used on Asianux Server
    7 while the httpd24-httpd service was not running, the daemon was started
    without being tracked by systemd. As a consequence, the daemon ran in an
    incorrect SELinux domain. This bug has been fixed, and the httpd daemon runs in
    the correct SELinux domain in the described scenario. (BZ#1440858)
    Enhancement(s):
      * With this update, the mod_ssl module supports the ALPN protocol on Asianux
    Server 7.4 and later versions. (BZ#1327548)
    For further details, see the Asianux Software Collections 3.0 Release Notes
    linked from the References section.
    CVE-2017-9798
    Apache httpd allows remote attackers to read secret data from process
    memory if the Limit directive can be set in a user's .htaccess file, or
    if httpd.conf has certain misconfigurations, aka Optionsbleed. This
    affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27.
    The attacker sends an unauthenticated OPTIONS HTTP request when
    attempting to read secret data. This is a use-after-free issue and thus
    secret data is not always sent, and the specific data depends on many
    factors including configuration. Exploitation with .htaccess can be
    blocked with a patch to the ap_limit_section function in server/core.c.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://tsn.miraclelinux.com/en/node/8848");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-9798");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Moderate");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/09/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/11/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:httpd24");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:httpd24-httpd");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:httpd24-httpd-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:httpd24-httpd-manual");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:httpd24-httpd-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:httpd24-mod_ldap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:httpd24-mod_proxy_html");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:httpd24-mod_session");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:httpd24-mod_ssl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:httpd24-runtime");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:miracle:linux:4");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Miracle Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/MiracleLinux/release", "Host/MiracleLinux/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'MIRACLE LINUX' >!< os_product) audit(AUDIT_OS_NOT, 'MIRACLE LINUX');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'MIRACLE LINUX');
if (! preg(pattern:"^4([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'MiracleLinux 4.x', 'MIRACLE LINUX ' + os_version);

if (!get_kb_item('Host/MiracleLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'ppc' >!< cpu && 's390' >!< cpu && 'x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'MIRACLE LINUX', cpu);

var constraints = [
  {
    'release': '4',
    'pkgs': [
      {'reference':'httpd24-1.1-18.AXS4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'httpd24-httpd-2.4.27-8.AXS4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'httpd24-httpd-devel-2.4.27-8.AXS4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'httpd24-httpd-manual-2.4.27-8.AXS4', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'httpd24-httpd-tools-2.4.27-8.AXS4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'httpd24-mod_ldap-2.4.27-8.AXS4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'httpd24-mod_proxy_html-2.4.27-8.AXS4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'httpd24-mod_session-2.4.27-8.AXS4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'httpd24-mod_ssl-2.4.27-8.AXS4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'httpd24-runtime-1.1-18.AXS4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}
if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'httpd24 / httpd24-httpd / httpd24-httpd-devel / etc');
}