NewStart CGSL MAIN 7.02 : unbound Multiple Vulnerabilities (NS-SA-2026-0095)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from ZTE advisory NS-SA-2026-0095. The text
# itself is copyright (C) ZTE, Inc.
##

include('compat.inc');

if (description)
{
  script_id(343577);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/08");

  script_cve_id(
    "CVE-2024-43167",
    "CVE-2024-43168",
    "CVE-2025-5994",
    "CVE-2025-11411",
    "CVE-2026-32792",
    "CVE-2026-33278",
    "CVE-2026-40622",
    "CVE-2026-41292",
    "CVE-2026-42534",
    "CVE-2026-42923",
    "CVE-2026-42944",
    "CVE-2026-42959",
    "CVE-2026-42960",
    "CVE-2026-44390",
    "CVE-2026-44608"
  );

  script_name(english:"NewStart CGSL MAIN 7.02 : unbound Multiple Vulnerabilities (NS-SA-2026-0095)");

  script_set_attribute(attribute:"synopsis", value:
"The remote NewStart CGSL host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote NewStart CGSL host, running version MAIN 7.02, has unbound packages installed that are affected by multiple
vulnerabilities:

  - NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records
    for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be
    used to trick Unbound to cache such records. If an adversary is able to attach such records in a reply
    (i.e., spoofed packet, fragmentation attack) he would be able to poison Unbound's cache. A malicious actor
    can exploit the possible poisonous effect by injecting RRSets other than NS that are also accompanied by
    address records in a reply, for example MX. This could be achieved by trying to spoof a reply packet or
    fragmentation attacks. Unbound would then accept the relative address records in the additional section
    and cache them if the authority RRSet has enough trust at this point, i.e., in-zone data for the
    delegation point. Unbound 1.25.1 contains a patch with a fix that disregards address records from the
    additional section if they are not explicitly relevant only to authority NS records, mitigating the
    possible poison effect. This is a complement fix to CVE-2025-11411. (CVE-2026-42960)

  - NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator
    that enables denial of service and possible remote code execution as a result of deep copying a data
    structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by
    controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend
    validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-
    copies response messages to preserve them across memory region teardown. A struct-assignment bug
    overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the
    resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary
    code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep
    copying the data structure. (CVE-2026-33278)

  - DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original
    software developer, NLnet Labs) falls within the expected functionality and security controls of the
    application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs
    has no further information about the claim, and suggests that affected Red Hat customers refer to
    available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A NULL pointer dereference flaw
    was found in the ub_ctx_set_fwd function in Unbound. This issue could allow an attacker who can invoke
    specific sequences of API calls to cause a segmentation fault. When certain API functions such as
    ub_ctx_set_fwd and ub_ctx_resolvconf are called in a particular order, the program attempts to read from a
    NULL pointer, leading to a crash. This issue can result in a denial of service by causing the application
    to terminate unexpectedly. (CVE-2024-43167)

  - DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original
    software developer, NLnet Labs) falls within the expected functionality and security controls of the
    application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs
    has no further information about the claim, and suggests that affected Red Hat customers refer to
    available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A heap-buffer-overflow flaw was
    found in the cfg_mark_ports function within Unbound's config_file.c, which can lead to memory corruption.
    This issue could allow an attacker with local access to provide specially crafted input, potentially
    causing the application to crash or allowing arbitrary code execution. This could result in a denial of
    service or unauthorized actions on the system. (CVE-2024-43168)

  - NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks.
    Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick
    resolvers to update their delegation information for the zone. Usually these RRSets are used to update the
    resolver's knowledge of the zone's name servers. A malicious actor can exploit the possible poisonous
    effect by injecting NS RRSets (and possibly their respective address records) in a reply. This could be
    done for example by trying to spoof a packet or fragmentation attacks. Unbound would then proceed to
    update the NS RRSet data it already has since the new data has enough trust for it, i.e., in-zone data for
    the delegation point. Unbound 1.24.1 includes a fix that scrubs unsolicited NS RRSets (and their
    respective address records) from replies mitigating the possible poison effect. Unbound 1.24.2 includes an
    additional fix that scrubs unsolicited NS RRSets (and their respective address records) from YXDOMAIN and
    non-referral nodata replies, further mitigating the possible poison effect. (CVE-2025-11411)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/notice/NS-SA-2026-0095");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2024-43167");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2024-43168");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2025-11411");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2025-5994");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2026-32792");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2026-33278");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2026-40622");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2026-41292");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2026-42534");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2026-42923");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2026-42944");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2026-42959");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2026-42960");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2026-44390");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2026-44608");
  script_set_attribute(attribute:"solution", value:
"Upgrade the vulnerable CGSL unbound packages. Note that updated packages may not be available yet. Please contact ZTE
for more information.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_supplemental", value:"CVSS:4.0/U:Red");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-33278");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-42960");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/08/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:python3-unbound");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:unbound");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:unbound-anchor");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:unbound-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:unbound-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:unbound-utils");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:zte:cgsl_main:7");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"NewStart CGSL Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/ZTE-CGSL/release", "Host/ZTE-CGSL/rpm-list", "Host/cpu");

  exit(0);
}

include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var os_release = get_kb_item('Host/ZTE-CGSL/release');
if (isnull(os_release) || os_release !~ "^CGSL (MAIN|CORE)") audit(AUDIT_OS_NOT, 'NewStart Carrier Grade Server Linux');

if (os_release !~ "CGSL\sMAIN\s7\.02")
  audit(AUDIT_OS_NOT, 'NewStart CGSL MAIN 7.02');

if (!get_kb_item('Host/ZTE-CGSL/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'NewStart Carrier Grade Server Linux', cpu);

var flag = 0;

var pkgs = {
  'CGSL MAIN 7.02': [
    'python3-unbound-1.17.1-13.zncgsl7',
    'unbound-1.17.1-13.zncgsl7',
    'unbound-anchor-1.17.1-13.zncgsl7',
    'unbound-devel-1.17.1-13.zncgsl7',
    'unbound-libs-1.17.1-13.zncgsl7',
    'unbound-utils-1.17.1-13.zncgsl7'
  ]
};
var pkg_list = pkgs[os_release];
var pkg;
foreach (pkg in pkg_list)
  if (rpm_check(reference:pkg, release:'ZTE ' + os_release, rpm_spec_vers_cmp:TRUE)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'unbound');
}