openSUSE 16 Security Update : rsync (openSUSE-SU-2026:21650-1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# openSUSE Security Update openSUSE-SU-2026:21650-1. The text itself
# is copyright (C) SUSE.
##

include('compat.inc');

if (description)
{
  script_id(341163);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/31");

  script_cve_id(
    "CVE-2026-43617",
    "CVE-2026-43618",
    "CVE-2026-43619",
    "CVE-2026-43620",
    "CVE-2026-53783",
    "CVE-2026-53784",
    "CVE-2026-53785",
    "CVE-2026-53786",
    "CVE-2026-53788",
    "CVE-2026-53789",
    "CVE-2026-53790",
    "CVE-2026-53791",
    "CVE-2026-53792",
    "CVE-2026-53793",
    "CVE-2026-53794",
    "CVE-2026-53795",
    "CVE-2026-53796",
    "CVE-2026-53797",
    "CVE-2026-53798",
    "CVE-2026-53799",
    "CVE-2026-53800",
    "CVE-2026-53801",
    "CVE-2026-53802",
    "CVE-2026-53803",
    "CVE-2026-70452",
    "CVE-2026-70453",
    "CVE-2026-70454",
    "CVE-2026-70455",
    "CVE-2026-70456",
    "CVE-2026-70457",
    "CVE-2026-70458",
    "CVE-2026-70459",
    "CVE-2026-70460",
    "CVE-2026-70461",
    "CVE-2026-70462",
    "CVE-2026-70463",
    "CVE-2026-70464"
  );
  script_xref(name:"IAVA", value:"2026-A-0502");
  script_xref(name:"IAVA", value:"2026-A-0906");

  script_name(english:"openSUSE 16 Security Update : rsync (openSUSE-SU-2026:21650-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote openSUSE host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the
openSUSE-SU-2026:21650-1 advisory.

    - CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist)
    (bsc#1269041).
    - CVE-2026-53784: Daemon module-root chdir escape under use chroot = no (bsc#1269042).
    - CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
    - CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
    - CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol
    (bsc#1269046).
    - CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent
    (bsc#1269047).
    - CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
    - CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address
    (bsc#1269049).
    - CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative
    (bsc#1269050).
    - CVE-2026-53793: Chroot /./ inner-module escape via a parent-component symlink (bsc#1269051).
    - CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
    - CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link
    confinement
      (bsc#1269053).
    - CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
    - CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure
    (bsc#1269055).
    - CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
    - CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set
    (bsc#1269056).
    - CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary
    file deletion
      outside the source tree (bsc#1269057).
    - CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-
    tree disclosure
      (bsc#1269058).
    - CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files
    (bsc#1269039).
    - CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths
      (bsc#1269040).
    - CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the
    host it was meant
      to block (bsc#1273441).
    - CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain
    (bsc#1273440).
    - CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
    - CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
    - CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on
    maxargs
      (bsc#1273437).
    - CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
    - CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
    - CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-
    directory
      transfer root (bsc#1273434).
    - CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving
    via an in-
      module symlink (bsc#1273433).
    - CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
    - CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
    - CVE-2026-70463: auth users ignores documented comma-only parsing, silently skipping a deny/read-only
    rule
      (bsc#1273430).
    - CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module
    (bsc#1273429).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1269039");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1269040");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1269041");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1269042");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1269043");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1269044");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1269045");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1269046");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1269047");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1269048");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1269049");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1269050");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1269051");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1269052");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1269053");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1269054");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1269055");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1269056");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1269057");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1269058");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1269060");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1271931");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1271932");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1271933");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1271934");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1273429");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1273430");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1273431");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1273432");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1273433");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1273434");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1273435");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1273436");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1273437");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1273438");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1273439");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1273440");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1273441");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-43617");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-43618");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-43619");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-43620");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-53783");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-53784");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-53785");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-53786");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-53788");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-53789");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-53790");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-53791");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-53792");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-53793");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-53794");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-53795");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-53796");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-53797");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-53798");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-53799");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-53800");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-53801");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-53802");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-53803");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-70452");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-70453");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-70454");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-70455");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-70456");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-70457");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-70458");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-70459");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-70460");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-70461");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-70462");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-70463");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-70464");
  script_set_attribute(attribute:"solution", value:
"Update the affected rsync package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-43620");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-70460");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/28");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:rsync");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:16.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SuSE Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include('rpm.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/SuSE/release');
if (isnull(os_release) || os_release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, 'openSUSE');
var _os_ver = pregmatch(pattern: "^SUSE([\d.]+)", string:os_release);
if (isnull(_os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'openSUSE');
_os_ver = _os_ver[1];
if (os_release !~ "^(SUSE16\.0)$") audit(AUDIT_OS_RELEASE_NOT, 'openSUSE', '16.0', os_release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'openSUSE ' + _os_ver, cpu);

var pkgs = [
    {'reference':'rsync-3.4.1-160000.6.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var _cpu = NULL;
  var rpm_spec_vers_cmp = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (reference && _release) {
    if (rpm_check(release:_release, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'rsync');
}