NewStart CGSL MAIN 6.06 (SP) : chrony Multiple Vulnerabilities (NS-SA-2026-0009)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from ZTE advisory NS-SA-2026-0009. The text
# itself is copyright (C) ZTE, Inc.
##

include('compat.inc');

if (description)
{
  script_id(301211);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/06");

  script_cve_id(
    "CVE-2010-0292",
    "CVE-2010-0293",
    "CVE-2010-0294",
    "CVE-2012-4502",
    "CVE-2012-4503",
    "CVE-2014-0021",
    "CVE-2015-1821",
    "CVE-2015-1822",
    "CVE-2015-1853",
    "CVE-2016-1567"
  );

  script_name(english:"NewStart CGSL MAIN 6.06 (SP) : chrony Multiple Vulnerabilities (NS-SA-2026-0009)");

  script_set_attribute(attribute:"synopsis", value:
"The remote NewStart CGSL host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote NewStart CGSL host, running version MAIN 6.06 (SP), has chrony packages installed that are affected by
multiple vulnerabilities:

  - chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when
    authenticating packets, which might allow remote attackers to conduct impersonation attacks via an
    arbitrary trusted key, aka a skeleton key. (CVE-2016-1567)

  - The read_from_cmd_socket function in cmdmon.c in chronyd in Chrony before 1.23.1, and 1.24-pre1, allows
    remote attackers to cause a denial of service (CPU and bandwidth consumption) by sending a spoofed cmdmon
    packet that triggers a continuous exchange of NOHOSTACCESS messages between two daemons, a related issue
    to CVE-2009-3563. (CVE-2010-0292)

  - The client logging functionality in chronyd in Chrony before 1.23.1 does not restrict the amount of memory
    used for storage of client information, which allows remote attackers to cause a denial of service (memory
    consumption) via spoofed (1) NTP or (2) cmdmon packets. (CVE-2010-0293)

  - chronyd in Chrony before 1.23.1, and possibly 1.24-pre1, generates a syslog message for each unauthorized
    cmdmon packet, which allows remote attackers to cause a denial of service (disk consumption) via a large
    number of invalid packets. (CVE-2010-0294)

  - Multiple integer overflows in pktlength.c in Chrony before 1.29 allow remote attackers to cause a denial
    of service (crash) via a crafted (1) REQ_SUBNETS_ACCESSED or (2) REQ_CLIENT_ACCESSES command request to
    the PKL_CommandLength function or crafted (3) RPY_SUBNETS_ACCESSED, (4) RPY_CLIENT_ACCESSES, (5)
    RPY_CLIENT_ACCESSES_BY_INDEX, or (6) RPY_MANUAL_LIST command reply to the PKL_ReplyLength function, which
    triggers an out-of-bounds read or buffer overflow. NOTE: versions 1.27 and 1.28 do not require
    authentication to exploit. (CVE-2012-4502)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/notice/NS-SA-2026-0009");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2010-0292");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2010-0293");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2010-0294");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2012-4502");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2012-4503");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2014-0021");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2015-1821");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2015-1822");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2015-1853");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2016-1567");
  script_set_attribute(attribute:"solution", value:
"Upgrade the vulnerable CGSL chrony packages. Note that updated packages may not be available yet. Please contact ZTE for
more information.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-1567");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2010/02/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:chrony");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:zte:cgsl_main:6");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"NewStart CGSL Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/ZTE-CGSL/release", "Host/ZTE-CGSL/rpm-list", "Host/cpu");

  exit(0);
}

include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var os_release = get_kb_item('Host/ZTE-CGSL/release');
if (isnull(os_release) || os_release !~ "^CGSL (MAIN|CORE)") audit(AUDIT_OS_NOT, 'NewStart Carrier Grade Server Linux');

if (os_release !~ "CGSL\sMAIN\s6\.06\s\(SP\)")
  audit(AUDIT_OS_NOT, 'NewStart CGSL MAIN 6.06 (SP)');

if (!get_kb_item('Host/ZTE-CGSL/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'NewStart Carrier Grade Server Linux', cpu);

var flag = 0;

var pkgs = {
  'CGSL MAIN 6.06 (SP)': [
    'chrony-4.1-1.0.1.zncgsl6.t1.0'
  ]
};
var pkg_list = pkgs[os_release];
var pkg;
foreach (pkg in pkg_list)
  if (rpm_check(reference:pkg, release:'ZTE ' + os_release, rpm_spec_vers_cmp:TRUE)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'chrony');
}