Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-11.0.1.3)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(324126);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/15");

  script_cve_id(
    "CVE-2024-12086",
    "CVE-2025-10158",
    "CVE-2025-14087",
    "CVE-2025-14512",
    "CVE-2026-4786",
    "CVE-2026-4878",
    "CVE-2026-6100",
    "CVE-2026-33416",
    "CVE-2026-33636",
    "CVE-2026-35385",
    "CVE-2026-35386",
    "CVE-2026-35387",
    "CVE-2026-35388",
    "CVE-2026-35414",
    "CVE-2026-35535",
    "CVE-2026-39979",
    "CVE-2026-40164",
    "CVE-2026-41035"
  );
  script_xref(name:"IAVB", value:"2026-B-0180");

  script_name(english:"Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-11.0.1.3)");

  script_set_attribute(attribute:"synopsis", value:
"The Nutanix AHV host is affected by multiple vulnerabilities .");
  script_set_attribute(attribute:"description", value:
"The version of AHV installed on the remote host is prior to 11.0.1.3 / AHV-11.0.1.3. It is, therefore, affected by
multiple vulnerabilities as referenced in the NXSA-AHV-11.0.1.3 advisory.

  - A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap
    corruption, leading to a denial of service or potential code execution via a buffer-underflow in the
    GVariant parser when processing maliciously crafted input strings. (CVE-2025-14087)

  - In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a
    privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.
    (CVE-2026-35535)

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. In versions 1.2.1 through 1.6.55, `png_set_tRNS` and `png_set_PLTE`
    each alias a heap-allocated buffer between `png_struct` and `png_info`, sharing a single allocation across
    two structs with independent lifetimes. The `trans_alpha` aliasing has been present since at least libpng
    1.0, and the `palette` aliasing since at least 1.2.1. Both affect all prior release lines `png_set_tRNS`
    sets `png_ptr->trans_alpha = info_ptr->trans_alpha` (256-byte buffer) and `png_set_PLTE` sets
    `info_ptr->palette = png_ptr->palette` (768-byte buffer). In both cases, calling `png_free_data` (with
    `PNG_FREE_TRNS` or `PNG_FREE_PLTE`) frees the buffer through `info_ptr` while the corresponding `png_ptr`
    pointer remains dangling. Subsequent row-transform functions dereference and, in some code paths, write to
    the freed memory. A second call to `png_set_tRNS` or `png_set_PLTE` has the same effect, because both
    functions call `png_free_data` internally before reallocating the `info_ptr` buffer. Version 1.6.56 fixes
    the issue. (CVE-2026-33416)

  - A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the
    client's machine. This issue occurs when files are being copied from a client to a server. During this
    process, the rsync server will send checksums of local data to the client to compare with in order to
    determine what data needs to be sent to the server. By sending specially constructed checksum values for
    arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the
    responses from the client. (CVE-2024-12086)

  - A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a
    heap based buffer, via a negative array index. The malicious rsync client requires at least read access to
    the remote rsync module in order to trigger the issue. (CVE-2025-10158)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://portal.nutanix.com/page/documents/security-advisories/release-advisories/details?id=NXSA-AHV-11.0.1.3
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?209a2bcc");
  script_set_attribute(attribute:"solution", value:
"Update the Nutanix AHV software to the recommended version. Before upgrading: if this cluster is registered with Prism
Central, ensure that Prism Central has been upgraded first to a compatible version. Refer to the Software Product
Interoperability page on the Nutanix portal.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-14087");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-6100");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/01/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:nutanix:ahv");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nutanix_collect.nasl");
  script_require_keys("Host/Nutanix/Data/Node/Version", "Host/Nutanix/Data/Node/Type");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

var app_info = vcf::nutanix::get_app_info(node:TRUE);

var constraints = [
  { 'min_version' : '11.0', 'fixed_version' : '11.0.1.3', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1.3 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1.3', 'equal' : '20230302.102001', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1.3 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1.3', 'equal' : '20230302.102005', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1.3 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1.3', 'equal' : '20230302.103003', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1.3 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1.3', 'equal' : '20230302.103014', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1.3 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1.3', 'equal' : '20230302.103032', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1.3 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1.3', 'equal' : '20230302.103053', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1.3 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1.3', 'equal' : '20230302.103068', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1.3 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1.3', 'equal' : '20230302.103072', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1.3 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1.3', 'equal' : '20230302.103084', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1.3 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1.3', 'equal' : '20230302.103087', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1.3 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1.3', 'equal' : '20230302.103100', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1.3 or higher.' }
];

vcf::nutanix::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);