Ollama < 0.1.34 DoS

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(210501);
  script_version("1.7");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/13");

  script_cve_id("CVE-2024-39721");
  script_xref(name:"IAVB", value:"2024-B-0164-S");

  script_name(english:"Ollama < 0.1.34 DoS");

  script_set_attribute(attribute:"synopsis", value:
"The Ollama instance installed on the remote host is affected by a denial of service vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Ollama installed on the remote host is prior to 0.1.34. It is, therefore, affected by a 
denial-of-service vulnerability:

  - An issue was discovered in Ollama before 0.1.34. The CreateModelHandler function uses os.Open to read a file until 
    completion. The req.Path parameter is user-controlled and can be set to /dev/random, which is blocking, causing 
    the goroutine to run infinitely (even after the HTTP request is aborted by the client). 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.oligo.security/blog/more-models-more-probllms");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Ollama version 0.1.34 or later.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-39721");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/10/31");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/10/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/11/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ollama:ollama");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Artificial Intelligence");

  script_copyright(english:"This script is Copyright (C) 2024-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ollama_mac_installed.nbin", "ollama_nix_installed.nbin", "ollama_web_detect.nbin");
  script_require_keys("installed_sw/Ollama");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Ollama', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {
          'fixed_version': '0.1.34'
        }
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);