NewStart CGSL MAIN 6.06 : httpd Multiple Vulnerabilities (NS-SA-2025-0240)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from ZTE advisory NS-SA-2025-0240. The text
# itself is copyright (C) ZTE, Inc.
##

include('compat.inc');

if (description)
{
  script_id(297071);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/28");

  script_cve_id(
    "CVE-2013-5704",
    "CVE-2014-3581",
    "CVE-2014-3583",
    "CVE-2014-8109",
    "CVE-2016-5387",
    "CVE-2016-8740",
    "CVE-2017-9798",
    "CVE-2022-22719",
    "CVE-2022-22720",
    "CVE-2022-22721",
    "CVE-2022-23943",
    "CVE-2024-36387"
  );

  script_name(english:"NewStart CGSL MAIN 6.06 : httpd Multiple Vulnerabilities (NS-SA-2025-0240)");

  script_set_attribute(attribute:"synopsis", value:
"The remote NewStart CGSL host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote NewStart CGSL host, running version MAIN 6.06, has httpd packages installed that are affected by multiple
vulnerabilities:

  - Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap
    memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions. (CVE-2022-23943)

  - The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass RequestHeader
    unset directives by placing a header in the trailer portion of data sent with chunked transfer coding.
    NOTE: the vendor states this is not a security issue in httpd as such. (CVE-2013-5704)

  - The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache
    HTTP Server before 2.4.11 allows remote attackers to cause a denial of service (NULL pointer dereference
    and application crash) via an empty HTTP Content-Type header. (CVE-2014-3581)

  - The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server
    2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon crash) via
    long response headers. (CVE-2014-3583)

  - mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support
    an httpd configuration in which the same Lua authorization provider is used with different arguments
    within different contexts, which allows remote attackers to bypass intended access restrictions in
    opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration
    that specifies authorization for one group to access a certain directory, and authorization for a second
    group to access a second directory. (CVE-2014-8109)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/notice/NS-SA-2025-0240");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2013-5704");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2014-3581");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2014-3583");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2014-8109");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2016-5387");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2016-8740");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2017-9798");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2022-22719");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2022-22720");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2022-22721");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2022-23943");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2024-36387");
  script_set_attribute(attribute:"solution", value:
"Upgrade the vulnerable CGSL httpd packages. Note that updated packages may not be available yet. Please contact ZTE for
more information.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-23943");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2013/10/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/28");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:httpd");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:httpd-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:httpd-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:httpd-filesystem");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:httpd-manual");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:httpd-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:mod_lua");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:mod_ssl");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:zte:cgsl_main:6");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"NewStart CGSL Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/ZTE-CGSL/release", "Host/ZTE-CGSL/rpm-list", "Host/cpu");

  exit(0);
}

include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var os_release = get_kb_item('Host/ZTE-CGSL/release');
if (isnull(os_release) || os_release !~ "^CGSL (MAIN|CORE)") audit(AUDIT_OS_NOT, 'NewStart Carrier Grade Server Linux');

if (os_release !~ "CGSL\sMAIN\s6\.06")
  audit(AUDIT_OS_NOT, 'NewStart CGSL MAIN 6.06');

if (!get_kb_item('Host/ZTE-CGSL/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'NewStart Carrier Grade Server Linux', cpu);

var flag = 0;

var pkgs = {
  'CGSL MAIN 6.06': [
    'httpd-2.4.62-1.zncgsl6.t1.0',
    'httpd-core-2.4.62-1.zncgsl6.t1.0',
    'httpd-devel-2.4.62-1.zncgsl6.t1.0',
    'httpd-filesystem-2.4.62-1.zncgsl6.t1.0',
    'httpd-manual-2.4.62-1.zncgsl6.t1.0',
    'httpd-tools-2.4.62-1.zncgsl6.t1.0',
    'mod_lua-2.4.62-1.zncgsl6.t1.0',
    'mod_ssl-2.4.62-1.zncgsl6.t1.0'
  ]
};
var pkg_list = pkgs[os_release];
var pkg;
foreach (pkg in pkg_list)
  if (rpm_check(reference:pkg, release:'ZTE ' + os_release, rpm_spec_vers_cmp:TRUE)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'httpd');
}