RHEL 6 : chromium-browser (Unpatched Vulnerability)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Red Hat Security Advisory chromium-browser. The text
# itself is copyright (C) Red Hat, Inc.
##

include('compat.inc');

if (description)
{
  script_id(196882);
  script_version("1.0");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/05/11");

  script_cve_id(
    "CVE-2016-1683",
    "CVE-2016-1684",
    "CVE-2017-7000",
    "CVE-2017-15422",
    "CVE-2020-16014",
    "CVE-2020-16015",
    "CVE-2020-16018",
    "CVE-2020-16019",
    "CVE-2020-16020",
    "CVE-2020-16021",
    "CVE-2020-16022",
    "CVE-2020-16023",
    "CVE-2020-16024",
    "CVE-2020-16025",
    "CVE-2020-16026",
    "CVE-2020-16027",
    "CVE-2020-16028",
    "CVE-2020-16029",
    "CVE-2020-16030",
    "CVE-2020-16031",
    "CVE-2020-16032",
    "CVE-2020-16033",
    "CVE-2020-16034",
    "CVE-2020-16035",
    "CVE-2020-16036",
    "CVE-2020-16042",
    "CVE-2021-30547"
  );

  script_name(english:"RHEL 6 : chromium-browser (Unpatched Vulnerability)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Red Hat 6 host is affected by multiple vulnerabilities that will not be patched.");
  script_set_attribute(attribute:"description", value:
"The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple
vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - chromium-browser: Heap buffer overflow in clipboard (CVE-2020-16025)

  - chromium-browser: Out of bounds write in ANGLE (CVE-2021-30547)

  - numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles namespace
    nodes, which allows remote attackers to cause a denial of service (out-of-bounds heap memory access) or
    possibly have unspecified other impact via a crafted document. (CVE-2016-1683)

  - numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles the i format
    token for xsl:number data, which allows remote attackers to cause a denial of service (integer overflow or
    resource consumption) or possibly have unspecified other impact via a crafted document. (CVE-2016-1684)

  - Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++
    before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote
    attacker to perform an out of bounds memory read via a crafted HTML page. (CVE-2017-15422)

  - An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is
    affected. The issue involves the SQLite component. It allows remote attackers to execute arbitrary code
    or cause a denial of service (memory corruption and application crash) via a crafted web site.
    (CVE-2017-7000)

  - Use after free in PPAPI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had
    compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16014)

  - Insufficient data validation in WASM in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to
    potentially exploit heap corruption via a crafted HTML page. (CVE-2020-16015)

  - Use after free in payments in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had
    compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16018)

  - Inappropriate implementation in filesystem in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a
    remote attacker who had compromised the browser process to bypass noexec restrictions via a malicious
    file. (CVE-2020-16019)

  - Inappropriate implementation in cryptohome in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a
    remote attacker who had compromised the browser process to bypass discretionary access control via a
    malicious file. (CVE-2020-16020)

  - Race in image burner in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had
    compromised the browser process to perform OS-level privilege escalation via a malicious file.
    (CVE-2020-16021)

  - Insufficient policy enforcement in networking in Google Chrome prior to 87.0.4280.66 allowed a remote
    attacker to potentially bypass firewall controls via a crafted HTML page. (CVE-2020-16022)

  - Use after free in WebCodecs in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to
    potentially exploit heap corruption via a crafted HTML page. (CVE-2020-16023)

  - Heap buffer overflow in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had
    compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16024)

  - Use after free in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially
    exploit heap corruption via a crafted HTML page. (CVE-2020-16026)

  - Insufficient policy enforcement in developer tools in Google Chrome prior to 87.0.4280.66 allowed an
    attacker who convinced a user to install a malicious extension to obtain potentially sensitive information
    from the user's disk via a crafted Chrome Extension. (CVE-2020-16027)

  - Heap buffer overflow in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to
    potentially exploit heap corruption via a crafted HTML page. (CVE-2020-16028)

  - Inappropriate implementation in PDFium in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to
    bypass navigation restrictions via a crafted PDF file. (CVE-2020-16029)

  - Insufficient data validation in Blink in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to
    inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (CVE-2020-16030)

  - Insufficient data validation in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to
    spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2020-16031)

  - Insufficient data validation in sharing in Google Chrome prior to 87.0.4280.66 allowed a remote attacker
    to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2020-16032)

  - Inappropriate implementation in WebUSB in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to
    spoof security UI via a crafted HTML page. (CVE-2020-16033)

  - Inappropriate implementation in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a local attacker to
    bypass policy restrictions via a crafted HTML page. (CVE-2020-16034)

  - Insufficient data validation in cros-disks in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a
    remote attacker who had compromised the browser process to bypass noexec restrictions via a malicious
    file. (CVE-2020-16035)

  - Inappropriate implementation in cookies in Google Chrome prior to 87.0.4280.66 allowed a remote attacker
    to bypass cookie restrictions via a crafted HTML page. (CVE-2020-16036)

  - Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain
    potentially sensitive information from process memory via a crafted HTML page. (CVE-2020-16042)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package
is installed.");
  script_set_attribute(attribute:"solution", value:
"The vendor has acknowledged the vulnerabilities but no solution has been provided. Refer to the vendor for remediation
guidance.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-30547");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2020-16025");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/05/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/05/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:chromium-browser");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:firefox");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:icu");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libxslt");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mingw-virt-viewer");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:sqlite");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:thunderbird");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Red Hat Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl", "redhat_repos.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm.inc');
include('rhel.inc');

if (!get_kb_item("global_settings/vendor_unpatched"))
exit(0, "Unpatched Vulnerabilities Detection not active.");

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/RedHat/release');
if (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');
var os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');
os_ver = os_ver[1];
if (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '6')) audit(AUDIT_OS_NOT, 'Red Hat 6.x', 'Red Hat ' + os_ver);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);

var constraints = [
  {
    'pkgs': [
      {'reference':'chromium-browser', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE, 'unpatched_pkg':'chromium-browser', 'cves':['CVE-2020-16014', 'CVE-2020-16015', 'CVE-2020-16018', 'CVE-2020-16019', 'CVE-2020-16020', 'CVE-2020-16021', 'CVE-2020-16022', 'CVE-2020-16023', 'CVE-2020-16024', 'CVE-2020-16025', 'CVE-2020-16026', 'CVE-2020-16027', 'CVE-2020-16028', 'CVE-2020-16029', 'CVE-2020-16030', 'CVE-2020-16031', 'CVE-2020-16032', 'CVE-2020-16033', 'CVE-2020-16034', 'CVE-2020-16035', 'CVE-2020-16036']},
      {'reference':'firefox', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE, 'unpatched_pkg':'firefox', 'cves':['CVE-2020-16042', 'CVE-2021-30547']},
      {'reference':'icu', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'unpatched_pkg':'icu', 'cves':['CVE-2017-15422']},
      {'reference':'libxslt', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'unpatched_pkg':'libxslt', 'cves':['CVE-2016-1683', 'CVE-2016-1684']},
      {'reference':'sqlite', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'unpatched_pkg':'sqlite', 'cves':['CVE-2017-7000']},
      {'reference':'thunderbird', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE, 'unpatched_pkg':'thunderbird', 'cves':['CVE-2020-16042', 'CVE-2021-30547']}
    ]
  }
];


var flag = 0;
foreach var constraint_array ( constraints ) {
  var repo_relative_urls = NULL;
  var enterprise_linux_flag = rhel_repo_urls_has_content_dist_rhel(repo_urls:repo_relative_urls);
  foreach var pkg ( constraint_array['pkgs'] ) {
    var unpatched_pkg = NULL;
    var _release = NULL;
    var sp = NULL;
    var el_string = NULL;
    var rpm_spec_vers_cmp = NULL;
    var exists_check = NULL;
    var cves = NULL;
    if (!empty_or_null(pkg['unpatched_pkg'])) unpatched_pkg = pkg['unpatched_pkg'];
    if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (unpatched_pkg &&
        _release &&
        (!exists_check || rpm_exists(release:_release, rpm:exists_check)) &&
        unpatched_package_exists(release:_release, package:unpatched_pkg, cves: cves)) flag++;
  }
}

if (flag)
{
  var extra = NULL;
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : unpatched_packages_report()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'chromium-browser / firefox / icu / libxslt / sqlite / thunderbird');
}