NewStart CGSL MAIN 7.02 : cups Multiple Vulnerabilities (NS-SA-2026-0093)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from ZTE advisory NS-SA-2026-0093. The text
# itself is copyright (C) ZTE, Inc.
##

include('compat.inc');

if (description)
{
  script_id(343582);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/08");

  script_cve_id(
    "CVE-2024-47175",
    "CVE-2025-58060",
    "CVE-2025-58364",
    "CVE-2025-58436",
    "CVE-2025-61915",
    "CVE-2026-27447",
    "CVE-2026-34978",
    "CVE-2026-34979",
    "CVE-2026-34980",
    "CVE-2026-39314",
    "CVE-2026-39316",
    "CVE-2026-41079"
  );

  script_name(english:"NewStart CGSL MAIN 7.02 : cups Multiple Vulnerabilities (NS-SA-2026-0093)");

  script_set_attribute(attribute:"synopsis", value:
"The remote NewStart CGSL host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote NewStart CGSL host, running version MAIN 7.02, has cups packages installed that are affected by multiple
vulnerabilities:

  - libppd <= 2.1b1 ppdCreatePPDFromIPP2 does not validate or sanitize the IPP attributes when writing them to
    a temporary PPD file, allowing the injection of attacker controlled data in the resulting PPD.
    (CVE-2024-47175)

  - CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file
    support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the
    PPD buffer. When used in combination with other functions such as `cfGetPrinterAttributes5`, can result in
    user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an
    exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176. (CVE-2024-47175)

  - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In
    versions 2.4.12 and earlier, when the `AuthType` is set to anything but `Basic`, if the request contains
    an `Authorization: Basic ...` header, the password is not checked. This results in authentication bypass.
    Any configuration that allows an `AuthType` that is not `Basic` is affected. Version 2.4.13 fixes the
    issue. (CVE-2025-58060)

  - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In
    versions 2.4.12 and earlier, an unsafe deserialization and validation of printer attributes causes null
    dereference in the libcups library. This is a remote DoS vulnerability available in local subnet in
    default configurations. It can cause the cups & cups-browsed to crash, on all the machines in local
    network who are listening for printers (so by default for all regular linux machines). On systems where
    the vulnerability CVE-2024-47176 (cups-filters 1.x/cups-browsed 2.x vulnerability) was not fixed, and the
    firewall on the machine does not reject incoming communication to IPP port, and the machine is set to be
    available to public internet, attack vector Network is possible. The current versions of CUPS and cups-
    browsed projects have the attack vector Adjacent in their default configurations. Version 2.4.13
    contains a patch for CVE-2025-58364. (CVE-2025-58364)

  - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior
    to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second,
    delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in
    version 2.4.15. (CVE-2025-58436)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/notice/NS-SA-2026-0093");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2024-47175");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2025-58060");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2025-58364");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2025-58436");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2025-61915");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2026-27447");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2026-34978");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2026-34979");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2026-34980");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2026-39314");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2026-39316");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2026-41079");
  script_set_attribute(attribute:"solution", value:
"Upgrade the vulnerable CGSL cups packages. Note that updated packages may not be available yet. Please contact ZTE for
more information.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-47175");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-34980");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/09/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:cups");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:cups-client");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:cups-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:cups-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:cups-filesystem");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:cups-ipptool");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:cups-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:cups-lpd");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:cups-printerapp");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:zte:cgsl_main:7");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"NewStart CGSL Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/ZTE-CGSL/release", "Host/ZTE-CGSL/rpm-list", "Host/cpu");

  exit(0);
}

include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var os_release = get_kb_item('Host/ZTE-CGSL/release');
if (isnull(os_release) || os_release !~ "^CGSL (MAIN|CORE)") audit(AUDIT_OS_NOT, 'NewStart Carrier Grade Server Linux');

if (os_release !~ "CGSL\sMAIN\s7\.02")
  audit(AUDIT_OS_NOT, 'NewStart CGSL MAIN 7.02');

if (!get_kb_item('Host/ZTE-CGSL/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'NewStart Carrier Grade Server Linux', cpu);

var flag = 0;

var pkgs = {
  'CGSL MAIN 7.02': [
    'cups-2.4.10-8.zncgsl7.1',
    'cups-client-2.4.10-8.zncgsl7.1',
    'cups-devel-2.4.10-8.zncgsl7.1',
    'cups-doc-2.4.10-8.zncgsl7.1',
    'cups-filesystem-2.4.10-8.zncgsl7.1',
    'cups-ipptool-2.4.10-8.zncgsl7.1',
    'cups-libs-2.4.10-8.zncgsl7.1',
    'cups-lpd-2.4.10-8.zncgsl7.1',
    'cups-printerapp-2.4.10-8.zncgsl7.1'
  ]
};
var pkg_list = pkgs[os_release];
var pkg;
foreach (pkg in pkg_list)
  if (rpm_check(reference:pkg, release:'ZTE ' + os_release, rpm_spec_vers_cmp:TRUE)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'cups');
}