openSUSE 16 Security Update : 389-ds (openSUSE-SU-2026:21691-1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# openSUSE Security Update openSUSE-SU-2026:21691-1. The text itself
# is copyright (C) SUSE.
##

include('compat.inc');

if (description)
{
  script_id(342105);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/01");

  script_cve_id(
    "CVE-2026-11610",
    "CVE-2026-11611",
    "CVE-2026-11774",
    "CVE-2026-11785",
    "CVE-2026-11786",
    "CVE-2026-11787",
    "CVE-2026-11788",
    "CVE-2026-11789",
    "CVE-2026-11790",
    "CVE-2026-11791",
    "CVE-2026-11792",
    "CVE-2026-11793",
    "CVE-2026-11884",
    "CVE-2026-12528"
  );

  script_name(english:"openSUSE 16 Security Update : 389-ds (openSUSE-SU-2026:21691-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote openSUSE host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the
openSUSE-SU-2026:21691-1 advisory.

    Update to version 3.0.6~git382.7a51ea5f5.

    Security issues fixed:

    - CVE-2026-11610: heap buffer overflow in the SASL I/O layer via a crafted oversized LDAP UNBIND packet
    (bsc#1270695).
    - CVE-2026-11611: unbounded memory growth allowed by the Content Synchronization persistent search plugin
    when an
      authenticated client stops reading sync responses (bsc#1267975).
    - CVE-2026-11774: integer overflow in the SASL I/O layer leading to heap buffer overflow via crafted SASL
    packet
      length prefixes  (bsc#1268298).
    - CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information
    disclosure
      in LDAP responses to authenticated users (bsc#1268065).
    - CVE-2026-11786: out-of-bounds read in the LDIF parser when processing attribute types with trailing
    semicolons
      during database import (bsc#1268064).
    - CVE-2026-11787: heap buffer overread due to missing checks in string filter parsing (bsc#1268062).
    - CVE-2026-11788: server crash due to missing allocation failure checks in the dereference control plugin
      (bsc#1268057).
    - CVE-2026-11789: integer underflow in the SMD5 password storage plugin leading to a buffer overflow via a
    crafted
      password hash (bsc#1268058).
    - CVE-2026-11790: excessive CPU consumption during authentication due to improper upper bounds enforcement
    in the
      PBKDF2-SHA256 password storage plugin (bsc#1268060).
    - CVE-2026-11791: use-after-free in the schema reload mechanism can be triggered while concurrent LDAP
    query traffic
      is active (bsc#1268047).
    - CVE-2026-11792: heap buffer overflow when audit logging is enabled and short cleartext passwords are
    logged
      (bsc#1268046).
    - CVE-2026-11793: stack buffer overflow leading to crash via crafted credentials with an oversized
    algorithm ID
      (bsc#1268041).
    - CVE-2026-11884: heap buffer overflow leading to crash when serializing objectclass definitions
    (bsc#1268115).
    - CVE-2026-12528: heap buffer overflow during ACI parsing via malformed ACI strings (bsc#1268491).

    Other updates and bugfixes:

    - Version 3.0.6~git382.7a51ea5f5:
      * Issue 7711 - Fix typo in accountpolicy --login-history-size help text (#7713)
      * Issue 7688 - BUG - partial address leak in sso token (#7689)
      * Issue 7705 - With memberOfEntryScope set, deferred memberOf skips MODIFY operations (#7706)
      * Issue 7698 - Fix silent entry loss in LMDB bulk import waiter handling (#7699)
      * Issue 7666 - Replication performance degradation during total init on high-latency storage (#7667)
      * Issue 7201 - Syscall overhead in LMDB import writer thread (#7204)
      * Issue 7645 - Add runtime LeakSanitizer leak check (#7646)
      * Issue 7714 - UI - sass import rules are deprecated
      * Issue 7658 - Heap Buffer Overflow in sasl_io_recv() via Padded SASL UNBIND
      * Issue 7710 - MemberOf deferred update - Use condvar instead of sleep loop
      * Issue 7637 - UI - Using Arrow Keys in New Object Wizard Resulted in DOM Reload
      * Issue 7578 - schema - attribute refcount is not maintained properly
      * Issue 7605 - Harden CI test ports against ephemeral allocation (#7692)
      * Issue 7528 - Retry the CI image pull instead of failing the job (#7691)
      * Backport Issue 7519 -- ignore obsolete entrydn when entryrdn is in use (#7657)
      * Issue 7460 - MOD_REPLACE on groups/link attributes modifies overlap targets (#7461)
      * Issue 7505 - RFE - CLI - add feature to determine which password policy applies to a user
      * Issue 7670 - BDB range searches intermittently fail with err=1 under write load (#7671)
      * Issue 7108 - Fix shutdown crash in entry cache destruction (#7163)
      * Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value (#7662)
      * Issue 7284 - Automated test for creating local password policy with incorrect passwordInHistory value
    (#7608)
      * Issue 7200 - repl-agmt create doesn't set some parameters (#7663)
      * Issue 7573 - Post-import cache autotuning does not recompute entry cache size (#7574)

    - Version 3.0.6~git359.953dc780a:
      * Issue 7470 - dsctl localhost tls import-server-key-cert fails with 'expected str, bytes or os.PathLike
    object, not NoneType' (#7477)

    - Version 3.0.6~git356.e6c148b60:
      * Issue 7611 - PBKDF2 password verification should reject invalid iteration count (#7613)
      * Issue 7558 - Total init sends the suffix entry twice (#7640)
      * Issue 7635 - Integer Underflow in {SMD5} Password Comparison (#7636)
      * Issue 7406 - Fix ldap-agent SNMP stats file loading (#7630)
      * Issue 7621 - Stack Buffer Overflow in Password checkPrefix
      * Issue 7623 - Heap Buffer Overflow in 389-ds-base Audit Log Password Masking
      * Issue 7602 - CI - lib389 user compare fails due to parentid mismatch (#7603)
      * Issue 7537 - CI - Fix replication log monitoring parser/timing failures (#7592)
      * Issue 7593 - Fix testimony docstring for SASL overflow test (#7606)
      * Issue 7530 - CI - Stabilize DNA plugin replication tests timing out in CI (#7572)
      * Issue 7593 - Reject invalid SASL packet length values in sasl_io_start_packet (#7594)
      * Issue 3555 - UI - Fix audit issue with npm - ws, js-yaml, babel/core (#7599)
      * Bump fast-uri from 3.1.0 to 3.1.2 in /src/cockpit/389-console (#7487)
      * Update dependency uuid to v14 [SECURITY] (#7456)
      * Update cockpit-389-ds-npm (major) (#7448)
      * Issue 7263 - UI - Use cockpit.file API for temporary file writes (#7590)
      * Issue 7541 - Add invalid ACL text header regression test (#7591)
      * Issue 7554 - UI - Revise local password policy layout
      * Issue 7521 - UI - make changes for cockpit API updates

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1267975");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1268041");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1268046");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1268047");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1268057");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1268058");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1268060");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1268062");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1268064");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1268065");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1268115");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1268298");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1268491");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1269120");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1270695");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-11610");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-11611");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-11774");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-11785");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-11786");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-11787");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-11788");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-11789");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-11790");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-11791");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-11792");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-11793");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-11884");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-12528");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-11786");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:389-ds");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:389-ds-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:389-ds-snmp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:lib389");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libsvrcore0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:16.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SuSE Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include('rpm.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/SuSE/release');
if (isnull(os_release) || os_release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, 'openSUSE');
var _os_ver = pregmatch(pattern: "^SUSE([\d.]+)", string:os_release);
if (isnull(_os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'openSUSE');
_os_ver = _os_ver[1];
if (os_release !~ "^(SUSE16\.0)$") audit(AUDIT_OS_RELEASE_NOT, 'openSUSE', '16.0', os_release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'openSUSE ' + _os_ver, cpu);

var pkgs = [
    {'reference':'389-ds-3.0.6~git382.7a51ea5f5-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'389-ds-devel-3.0.6~git382.7a51ea5f5-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'389-ds-snmp-3.0.6~git382.7a51ea5f5-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'lib389-3.0.6~git382.7a51ea5f5-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsvrcore0-3.0.6~git382.7a51ea5f5-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var _cpu = NULL;
  var rpm_spec_vers_cmp = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (reference && _release) {
    if (rpm_check(release:_release, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, '389-ds / 389-ds-devel / 389-ds-snmp / lib389 / libsvrcore0');
}