OracleVM 3.1 : xen (OVMSA-2014-0002)

#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
# The package checks in this plugin were extracted from OracleVM
# Security Advisory OVMSA-2014-0002.
#

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(79530);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2021/01/04");

  script_cve_id("CVE-2014-1892", "CVE-2014-1893");
  script_bugtraq_id(65419);

  script_name(english:"OracleVM 3.1 : xen (OVMSA-2014-0002)");
  script_summary(english:"Checks the RPM output for the updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote OracleVM host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote OracleVM system is missing necessary patches to address
critical security updates :

  - flask: restrict allocations done by hypercall interface
    Other than in 4.2 and newer, we're not having an
    overflow issue here, but uncontrolled exposure of the
    operations opens the host to be driven out of memory by
    an arbitrary guest. Since all operations other than
    FLASK_LOAD simply deal with ASCII strings, limiting the
    allocations (and incoming buffer sizes) to a page worth
    of memory seems like the best thing we can do.
    Consequently, in order to not expose the larger
    allocation to arbitrary guests, the permission check for
    FLASK_LOAD needs to be pulled ahead of the allocation
    (and it's perhaps worth noting that - afaict - it was
    pointlessly done with the sel_sem spin lock held). Note
    that this breaks FLASK_AVC_CACHESTATS on systems with
    sufficiently many CPUs (as requiring a buffer bigger
    than PAGE_SIZE there). No attempt is made to address
    this here, as it would needlessly complicate this fix
    with rather little gain. This is XSA-84.

    The index of boolean variables in FLASK_[GET,SET]BOOL
    was not always checked against the bounds of the array.

18205387] (CVE-2014-1892, CVE-2014-1893)

  - libxc: Fix out-of-memory error handling in
    xc_cpupool_getinfo Avoid freeing info then returning it
    to the caller. This is XSA-88. Coverity-ID: 1056192

18206144] [CVE-2014-XXXX]"
  );
  # https://oss.oracle.com/pipermail/oraclevm-errata/2014-February/000204.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?07271db1"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected xen / xen-devel / xen-tools packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:A/AC:M/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:vm:xen");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:vm:xen-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:vm:xen-tools");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:vm_server:3.1");

  script_set_attribute(attribute:"vuln_publication_date", value:"2014/04/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2014/02/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/11/26");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2014-2021 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"OracleVM Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/OracleVM/release", "Host/OracleVM/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/OracleVM/release");
if (isnull(release) || "OVS" >!< release) audit(AUDIT_OS_NOT, "OracleVM");
if (! preg(pattern:"^OVS" + "3\.1" + "(\.[0-9]|$)", string:release)) audit(AUDIT_OS_NOT, "OracleVM 3.1", "OracleVM " + release);
if (!get_kb_item("Host/OracleVM/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "OracleVM", cpu);
if ("x86_64" >!< cpu) audit(AUDIT_ARCH_NOT, "x86_64", cpu);

flag = 0;
if (rpm_check(release:"OVS3.1", reference:"xen-4.1.2-18.el5.118")) flag++;
if (rpm_check(release:"OVS3.1", reference:"xen-devel-4.1.2-18.el5.118")) flag++;
if (rpm_check(release:"OVS3.1", reference:"xen-tools-4.1.2-18.el5.118")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "xen / xen-devel / xen-tools");
}