openSUSE 16 Security Update : cups (openSUSE-SU-2026:20172-1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# openSUSE Security Update openSUSE-SU-2026:20172-1. The text itself
# is copyright (C) SUSE.
##

include('compat.inc');

if (description)
{
  script_id(298240);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/06");

  script_cve_id(
    "CVE-2025-58060",
    "CVE-2025-58364",
    "CVE-2025-58436",
    "CVE-2025-61915"
  );

  script_name(english:"openSUSE 16 Security Update : cups (openSUSE-SU-2026:20172-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote openSUSE host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the
openSUSE-SU-2026:20172-1 advisory.

    Update to version 2.4.16.

    Security issues fixed:

    - CVE-2025-61915: local denial-of-service via cupsd.conf update and related issues (bsc#1253783).
    - CVE-2025-58436: slow client communication leads to a possible DoS attack (bsc#1244057).
    - CVE-2025-58364: unsafe deserialization and validation of printer attributes can cause a null dereference
    (bsc#1249128).
    - CVE-2025-58060: authentication bypass with AuthType Negotiate (bsc#1249049).

    Other updates and bugfixes:

    - Version upgrade to 2.4.16:

      * 'cupsUTF8ToCharset' didn't validate 2-byte UTF-8 sequences,
        potentially reading past the end of the source string
        (Issue #1438)
      * The web interface did not support domain usernames fully
        (Issue #1441)
      * Fixed an infinite loop issue in the GTK+ print dialog
        (Issue #1439 boo#1254353)
      * Fixed stopping scheduler on unknown directive in
        configuration (Issue #1443)
      * Fixed packages for Immutable Mode (jsc#PED-14775
        from epic jsc#PED-14688)

    - Version upgrade to 2.4.15:

      * Fixed potential crash in 'cups-driverd' when there are
        duplicate PPDs (Issue #1355)
      * Fixed error recovery when scanning for PPDs
        in 'cups-driverd' (Issue #1416)

    - Version upgrade to 2.4.14.

    - Version upgrade to 2.4.13:

      * Added 'print-as-raster' printer and job attributes
        for forcing rasterization (Issue #1282)
      * Updated documentation (Issue #1086)
      * Updated IPP backend to try a sanitized user name if the
        printer/server does not like the value (Issue #1145)
      * Updated the scheduler to send the printer-added
        or printer-modified events  whenever an IPP Everywhere PPD
        is installed (Issue #1244)
      * Updated the scheduler to send the printer-modified event
        whenever the system default printer is changed (Issue #1246)
      * Fixed a memory leak in 'httpClose' (Issue #1223)
      * Fixed missing commas in 'ippCreateRequestedArray'
        (Issue #1234)
      * Fixed subscription issues in the scheduler and D-Bus notifier
        (Issue #1235)
      * Fixed media-default reporting for custom sizes (Issue #1238)
      * Fixed support for IPP/PPD options with periods or underscores
        (Issue #1249)
      * Fixed parsing of real numbers in PPD compiler source files
        (Issue #1263)
      * Fixed scheduler freezing with zombie clients (Issue #1264)
      * Fixed support for the server name in the ErrorLog filename
        (Issue #1277)
      * Fixed job cleanup after daemon restart (Issue #1315)
      * Fixed handling of buggy DYMO USB printer serial numbers
       (Issue #1338)
      * Fixed unreachable block in IPP backend (Issue #1351)
      * Fixed memory leak in _cupsConvertOptions (Issue #1354)

    - Version upgrade to 2.4.12:

      * GnuTLS follows system crypto policies now (Issue #1105)
      * Added `NoSystem` SSLOptions value (Issue #1130)
      * Now we raise alert for certificate issues (Issue #1194)
      * Added Kyocera USB quirk (Issue #1198)
      * The scheduler now logs a job's debugging history
        if the backend fails (Issue #1205)
      * Fixed a potential timing issue with `cupsEnumDests`
        (Issue #1084)
      * Fixed a potential lost PPD condition in the scheduler
        (Issue #1109)
      * Fixed a compressed file error handling bug (Issue #1070)
      * Fixed a bug in the make-and-model whitespace trimming
        code (Issue #1096)
      * Fixed a removal of IPP Everywhere permanent queue
        if installation failed (Issue #1102)
      * Fixed `ServerToken None` in scheduler (Issue #1111)
      * Fixed invalid IPP keyword values created from PPD
        option names (Issue #1118)
      * Fixed handling of media and PageSize in the same
        print request (Issue #1125)
      * Fixed client raster printing from macOS (Issue #1143)
      * Fixed the default User-Agent string.
      * Fixed a recursion issue in `ippReadIO`.
      * Fixed handling incorrect radix in `scan_ps()` (Issue #1188)
      * Fixed validation of dateTime values with time zones
        more than UTC+11 (Issue #1201)
      * Fixed attributes returned by the Create-Xxx-Subscriptions
        requests (Issue #1204)
      * Fixed `ippDateToTime` when using a non GMT/UTC timezone
        (Issue #1208)
      * Fixed `job-completed` event notifications for jobs that are
        cancelled before started (Issue #1209)
      * Fixed DNS-SD discovery with `ippfind` (Issue #1211)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1244057");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1249049");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1249128");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1253783");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1254353");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2025-58060");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2025-58364");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2025-58436");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2025-61915");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:M/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-61915");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/02/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:cups");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:cups-client");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:cups-config");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:cups-ddk");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:cups-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libcups2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libcupsimage2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:16.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SuSE Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include('rpm.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/SuSE/release');
if (isnull(os_release) || os_release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, 'openSUSE');
var _os_ver = pregmatch(pattern: "^SUSE([\d.]+)", string:os_release);
if (isnull(_os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'openSUSE');
_os_ver = _os_ver[1];
if (os_release !~ "^(SUSE16\.0)$") audit(AUDIT_OS_RELEASE_NOT, 'openSUSE', '16.0', os_release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'openSUSE ' + _os_ver, cpu);

var pkgs = [
    {'reference':'cups-2.4.16-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'cups-client-2.4.16-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'cups-config-2.4.16-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'cups-ddk-2.4.16-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'cups-devel-2.4.16-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libcups2-2.4.16-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libcupsimage2-2.4.16-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var _cpu = NULL;
  var rpm_spec_vers_cmp = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (reference && _release) {
    if (rpm_check(release:_release, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'cups / cups-client / cups-config / cups-ddk / cups-devel / libcups2 / etc');
}