openSUSE 16 Security Update : libpcap (openSUSE-SU-2026:21940-1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# openSUSE Security Update openSUSE-SU-2026:21940-1. The text itself
# is copyright (C) SUSE.
##

include('compat.inc');

if (description)
{
  script_id(350769);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/28");

  script_cve_id(
    "CVE-2026-0799",
    "CVE-2026-6244",
    "CVE-2026-6554",
    "CVE-2026-18238",
    "CVE-2026-18313",
    "CVE-2026-31911",
    "CVE-2026-31912"
  );
  script_xref(name:"IAVA", value:"2026-A-0971");

  script_name(english:"openSUSE 16 Security Update : libpcap (openSUSE-SU-2026:21940-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote openSUSE host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the
openSUSE-SU-2026:21940-1 advisory.

    - CVE-2026-0799: the BPF interpreter does not validate values in BPF instructions that load/store a value
    from/to a
      scratch memory register and allows for OOB access (bsc#1279782).
    - CVE-2026-6244: libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check
    whether the
      immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division
    by zero
      (bsc#1279595).
    - CVE-2026-6554: libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction implements
    looping via backward
      jumps, but it does not limit the number of loop iterations. Can cause infinite loop (bsc#1279584).
    - CVE-2026-18238: `rpcap` client code that processes a `RPCAP_MSG_PACKET` message received from the server
    incorrectly
      validates its headers and allows for an OOB access (bsc#1279783).
    - CVE-2026-18313: `rpcapd` allocates up to 65536 bytes per each `RPCAP_MSG_UPDATEFILTER_REQ` or
    `RPCAP_MSG_STARTCAP_REQ`
      message received from the client and never frees the memory (bsc#1279784).
    - CVE-2026-31911: libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an
    invalid opcode.
      In particular uncommon use cases a crafted filter program can terminate the OS process (bsc#1279588).
    - CVE-2026-31912: libpcap BPF interpreter detects neither reaching the end of the filter program buffer
    due to lack of a
      return instruction nor executing a jump instruction with an offset that translates to a pointer outside
    of the buff
      (bsc#1279593).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1279584");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1279588");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1279593");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1279595");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1279782");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1279783");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1279784");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-0799");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-18238");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-18313");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-31911");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-31912");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-6244");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-6554");
  script_set_attribute(attribute:"solution", value:
"Update the affected libpcap-devel, libpcap-devel-static and / or libpcap1 packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:P/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-0799");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpcap-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpcap-devel-static");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpcap1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:16.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SuSE Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include('rpm.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/SuSE/release');
if (isnull(os_release) || os_release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, 'openSUSE');
var _os_ver = pregmatch(pattern: "^SUSE([\d.]+)", string:os_release);
if (isnull(_os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'openSUSE');
_os_ver = _os_ver[1];
if (os_release !~ "^(SUSE16\.0)$") audit(AUDIT_OS_RELEASE_NOT, 'openSUSE', '16.0', os_release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'openSUSE ' + _os_ver, cpu);

var pkgs = [
    {'reference':'libpcap-devel-1.10.5-160000.5.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libpcap-devel-static-1.10.5-160000.5.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libpcap1-1.10.5-160000.5.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var _cpu = NULL;
  var rpm_spec_vers_cmp = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (reference && _release) {
    if (rpm_check(release:_release, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libpcap-devel / libpcap-devel-static / libpcap1');
}