The remote NewStart CGSL host, running version MAIN 6.02, has nss packages installed that are affected by multiple vulnerabilities:
A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability. This flaw affects NSS versions before 3.58. (CVE-2020-25648)
NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. Note: This vulnerability does NOT impact Mozilla Firefox. However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.
(CVE-2021-43527)
Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from ZTE advisory NS-SA-2022-0098. The text
# itself is copyright (C) ZTE, Inc.
##
include('compat.inc');
if (description)
{
script_id(167486);
script_version("1.4");
script_set_attribute(attribute:"plugin_modification_date", value:"2023/10/04");
script_cve_id("CVE-2020-25648", "CVE-2021-43527");
script_name(english:"NewStart CGSL MAIN 6.02 : nss Multiple Vulnerabilities (NS-SA-2022-0098)");
script_set_attribute(attribute:"synopsis", value:
"The remote NewStart CGSL host is affected by multiple vulnerabilities.");
script_set_attribute(attribute:"description", value:
"The remote NewStart CGSL host, running version MAIN 6.02, has nss packages installed that are affected by multiple
vulnerabilities:
- A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a
remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the
NSS library. The highest threat from this vulnerability is to system availability. This flaw affects NSS
versions before 3.58. (CVE-2020-25648)
- NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow
when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures
encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for
certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how
they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and
PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and
Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.
(CVE-2021-43527)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
script_set_attribute(attribute:"see_also", value:"http://security.gd-linux.com/notice/NS-SA-2022-0098");
script_set_attribute(attribute:"see_also", value:"http://security.gd-linux.com/info/CVE-2020-25648");
script_set_attribute(attribute:"see_also", value:"http://security.gd-linux.com/info/CVE-2021-43527");
script_set_attribute(attribute:"solution", value:
"Upgrade the vulnerable CGSL nss packages. Note that updated packages may not be available yet. Please contact ZTE for
more information.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-43527");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2020/10/20");
script_set_attribute(attribute:"patch_publication_date", value:"2022/11/09");
script_set_attribute(attribute:"plugin_publication_date", value:"2022/11/15");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:nss");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:nss-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:nss-softokn");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:nss-softokn-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:nss-softokn-freebl");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:nss-softokn-freebl-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:nss-sysinit");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:nss-tools");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:nss-util");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:nss-util-devel");
script_set_attribute(attribute:"cpe", value:"cpe:/o:zte:cgsl_main:6");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"NewStart CGSL Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/ZTE-CGSL/release", "Host/ZTE-CGSL/rpm-list", "Host/cpu");
exit(0);
}
include('rpm.inc');
if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/ZTE-CGSL/release');
if (isnull(os_release) || os_release !~ "^CGSL (MAIN|CORE)") audit(AUDIT_OS_NOT, 'NewStart Carrier Grade Server Linux');
if (os_release !~ "CGSL MAIN 6.02")
audit(AUDIT_OS_NOT, 'NewStart CGSL MAIN 6.02');
if (!get_kb_item('Host/ZTE-CGSL/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'NewStart Carrier Grade Server Linux', cpu);
var flag = 0;
var pkgs = {
'CGSL MAIN 6.02': [
'nss-3.67.0-7.el8_5',
'nss-devel-3.67.0-7.el8_5',
'nss-softokn-3.67.0-7.el8_5',
'nss-softokn-devel-3.67.0-7.el8_5',
'nss-softokn-freebl-3.67.0-7.el8_5',
'nss-softokn-freebl-devel-3.67.0-7.el8_5',
'nss-sysinit-3.67.0-7.el8_5',
'nss-tools-3.67.0-7.el8_5',
'nss-util-3.67.0-7.el8_5',
'nss-util-devel-3.67.0-7.el8_5'
]
};
var pkg_list = pkgs[os_release];
foreach (pkg in pkg_list)
if (rpm_check(release:'ZTE ' + os_release, reference:pkg)) flag++;
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : rpm_report_get()
);
exit(0);
}
else
{
var tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'nss');
}
Vendor | Product | Version | CPE |
---|---|---|---|
zte | cgsl_main | nss | p-cpe:/a:zte:cgsl_main:nss |
zte | cgsl_main | nss-devel | p-cpe:/a:zte:cgsl_main:nss-devel |
zte | cgsl_main | nss-softokn | p-cpe:/a:zte:cgsl_main:nss-softokn |
zte | cgsl_main | nss-softokn-devel | p-cpe:/a:zte:cgsl_main:nss-softokn-devel |
zte | cgsl_main | nss-softokn-freebl | p-cpe:/a:zte:cgsl_main:nss-softokn-freebl |
zte | cgsl_main | nss-softokn-freebl-devel | p-cpe:/a:zte:cgsl_main:nss-softokn-freebl-devel |
zte | cgsl_main | nss-sysinit | p-cpe:/a:zte:cgsl_main:nss-sysinit |
zte | cgsl_main | nss-tools | p-cpe:/a:zte:cgsl_main:nss-tools |
zte | cgsl_main | nss-util | p-cpe:/a:zte:cgsl_main:nss-util |
zte | cgsl_main | nss-util-devel | p-cpe:/a:zte:cgsl_main:nss-util-devel |