NewStart CGSL MAIN 7.02 : libreswan Multiple Vulnerabilities (NS-SA-2025-0120)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from ZTE advisory NS-SA-2025-0120. The text
# itself is copyright (C) ZTE, Inc.
##

include('compat.inc');

if (description)
{
  script_id(242820);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/07/25");

  script_cve_id(
    "CVE-2023-38710",
    "CVE-2023-38711",
    "CVE-2023-38712",
    "CVE-2024-3652"
  );
  script_xref(name:"IAVA", value:"2024-A-0255");

  script_name(english:"NewStart CGSL MAIN 7.02 : libreswan Multiple Vulnerabilities (NS-SA-2025-0120)");

  script_set_attribute(attribute:"synopsis", value:
"The remote NewStart CGSL host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote NewStart CGSL host, running version MAIN 7.02, has libreswan packages installed that are affected by multiple
vulnerabilities:

  - An issue was discovered in Libreswan 3.x and 4.x before 4.12. When an IKEv1 ISAKMP SA Informational
    Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA,
    such as a duplicated Delete/Notify message, a NULL pointer dereference on the deleted state causes the
    pluto daemon to crash and restart. (CVE-2023-38712)

  - An issue was discovered in Libreswan before 4.12. When an IKEv2 Child SA REKEY packet contains an invalid
    IPsec protocol ID number of 0 or 1, an error notify INVALID_SPI is sent back. The notify payload's
    protocol ID is copied from the incoming packet, but the code that verifies outgoing packets fails an
    assertion that the protocol ID must be ESP (2) or AH(3) and causes the pluto daemon to crash and restart.
    NOTE: the earliest affected version is 3.20. (CVE-2023-38710)

  - An issue was discovered in Libreswan before 4.12. When an IKEv1 Quick Mode connection configured with
    ID_IPV4_ADDR or ID_IPV6_ADDR receives an IDcr payload with ID_FQDN, a NULL pointer dereference causes a
    crash and restart of the pluto daemon. NOTE: the earliest affected version is 4.6. (CVE-2023-38711)

  - The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without
    specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an
    assertion failure and crashes and restarts. IKEv2 connections are not affected. (CVE-2024-3652)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/notice/NS-SA-2025-0120");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2023-38710");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2023-38711");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2023-38712");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2024-3652");
  script_set_attribute(attribute:"solution", value:
"Upgrade the vulnerable CGSL libreswan packages. Note that updated packages may not be available yet. Please contact ZTE
for more information.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-38712");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/08/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/25");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:libreswan");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:zte:cgsl_main:7");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"NewStart CGSL Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/ZTE-CGSL/release", "Host/ZTE-CGSL/rpm-list", "Host/cpu");

  exit(0);
}

include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var os_release = get_kb_item('Host/ZTE-CGSL/release');
if (isnull(os_release) || os_release !~ "^CGSL (MAIN|CORE)") audit(AUDIT_OS_NOT, 'NewStart Carrier Grade Server Linux');

if (os_release !~ "CGSL\sMAIN\s7\.02")
  audit(AUDIT_OS_NOT, 'NewStart CGSL MAIN 7.02');

if (!get_kb_item('Host/ZTE-CGSL/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'NewStart Carrier Grade Server Linux', cpu);

var flag = 0;

var pkgs = {
  'CGSL MAIN 7.02': [
    'libreswan-4.12-1.zncgsl7.3'
  ]
};
var pkg_list = pkgs[os_release];
var pkg;
foreach (pkg in pkg_list)
  if (rpm_check(reference:pkg, release:'ZTE ' + os_release, rpm_spec_vers_cmp:TRUE)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libreswan');
}