openSUSE 16: libBasicUsageEnvironment2 / libUsageEnvironment3 / libgroupsock33 / etc (openSUSE-SU-2026:21863-1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# openSUSE Security Update openSUSE-SU-2026:21863-1. The text itself
# is copyright (C) SUSE.
##

include('compat.inc');

if (description)
{
  script_id(347914);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/18");

  script_cve_id("CVE-2026-38998", "CVE-2026-41470");

  script_name(english:"openSUSE 16: libBasicUsageEnvironment2 / libUsageEnvironment3 / libgroupsock33 / etc (openSUSE-SU-2026:21863-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote openSUSE host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the
openSUSE-SU-2026:21863-1 advisory.

    Changes in live555:

    - Update to version 2026.08.25:
      * Fixed a bug in VorbisAudioRTPSource that could have caused a
        malicious SDP description to crash a RTP client.

    - update to 2026.08.14:
      * Fixed a bug that could cause a problem with subclassed variants
        of H.264 or H.265 RTP sinks.
      * Fixed old code in GroupsockHelper.cpp that was using
        hardcoded numeric error numbers
      * Fixed a memory leak that could occur when parsing a SDP
        description that contains two or more
      * When adding protection against the use of 'stolen' RTSP session
        ids we forgot to do so for every SETUP command.  This release
        fixes that.
      * Fixed a typo in RTSPCommon.cpp: smtpe -> smpte.
      * Updated the RTSP server implementation to return a Unsupported
        Transport error if a SETUP request does not include a
        Transport: header.
      * Added -std=c++20 to the CPLUSPLUS_FLAGS line in each
        config.* file, so that std::atomic_flag::test will compile
        with compilers that support
      * Made the parsing of MP3 audio files more robust to protect
        against malformed MP3 data.
      * Minor change to testProgs/testRTSPClient.cpp to make
        compiling on Mac OS X happier.

    - Update to version 2026.06.01:
      * Updated the RTSPServer implementation of the SETUP command
        to make it more robust if subclassed code reimplements
        lookupServerMediaSession() as an asynchronous operation.

    - update to 2026.05.30:
      * Updated the RTSPServer implementation some more to make it
        more robust if subclassed code reimplements
        lookpServerMediaSession() as an asynchronous operation.
      * Added an (integer) index to identify each server's
        'client connection', and changed the fClientConnections table
        to be indexed by this id.
      * In the RTSPServer implementation, removed the
        fOurClientConnection member variable.
        This had been left over from when the RTSP SETUP command had
        been implemented as a single, synchronous function.
        Now that SETUP is implemented using multiple functions,
        possibly asynchronously (depending upon how
        lookpServerMediaSession() is implemented), this member
        variable was potentially dangerous if more than one SETUP is
        performed concurrently on the same client connection, or on
        separate client connections.

    - update to 2026.05.28:
      * fix use-after-free memory corruption introduced in fix
        for CVE-2026-41470

    - Update to version 2026.04.22 (CVE-2026-41470, boo#1265856):
      * Added extra checking to the handling of the RTSP server's
        PLAY, PAUSE, TEARDOWN, and SET_PARAMETER commands, to
        ensure that, if the session is authenticated, then a proper
        authentication check is done before these commands are handled.
        This protects against the use of a 'stolen' RTSP session id to
        send these commands.  (Note, however, that if the session is
        not authenticated (i.e., no username,password is needed), then no
        such protection is possible.)
    - Changes from version 2026-04-01:
      * Updated the way that the RTSP server generates successive RTSP
        'session ids' to make it less likely that an attacker could
        guess a session id.
      * Updated the RTSP server implementation to make it possible for
        a client to request both interleaved (i.e., RTP/RTCP-over-TCP)
        and non-interleaved (i.e., RTP/RTCP-over-UDP) delivery within
        the same session.

    - Update to version 2026.03.23 (boo#1279932):
      * CVE-2026-38998: Fixed a bug in the RTSP server code that caused
        it to improperly handle non-interleaved SETUPs that were sent
        for a session where interleaving (i.e., RTP/RTCP-over-TCP) had
        already been SETUP.  (This could cause a 'use-after-free'
        error.
      * For changes between 2024.08.01 to today, please refer to
        https://download.live555.com/changelog.txt

    - update to 2024-08-01:
      * Updated ServerMediaSession::generateSDPDescription() to
        treat time_t as (long long).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1265856");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1279932");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-38998");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-41470");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-38998");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-41470");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libBasicUsageEnvironment2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libUsageEnvironment3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libgroupsock33");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libliveMedia120");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:live555");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:live555-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:16.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SuSE Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include('rpm.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/SuSE/release');
if (isnull(os_release) || os_release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, 'openSUSE');
var _os_ver = pregmatch(pattern: "^SUSE([\d.]+)", string:os_release);
if (isnull(_os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'openSUSE');
_os_ver = _os_ver[1];
if (os_release !~ "^(SUSE16\.0)$") audit(AUDIT_OS_RELEASE_NOT, 'openSUSE', '16.0', os_release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'openSUSE ' + _os_ver, cpu);

var pkgs = [
    {'reference':'libBasicUsageEnvironment2-2026.08.25-bp160.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libUsageEnvironment3-2026.08.25-bp160.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libgroupsock33-2026.08.25-bp160.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libliveMedia120-2026.08.25-bp160.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'live555-2026.08.25-bp160.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'live555-devel-2026.08.25-bp160.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var _cpu = NULL;
  var rpm_spec_vers_cmp = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (reference && _release) {
    if (rpm_check(release:_release, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libBasicUsageEnvironment2 / libUsageEnvironment3 / libgroupsock33 / etc');
}