RHEL 5 : openssh (Unpatched Vulnerability)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Red Hat Security Advisory openssh. The text
# itself is copyright (C) Red Hat, Inc.
##

include('compat.inc');

if (description)
{
  script_id(195388);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/05/13");

  script_cve_id(
    "CVE-2016-1908",
    "CVE-2016-3115",
    "CVE-2016-6210",
    "CVE-2016-6515",
    "CVE-2016-10009",
    "CVE-2016-10011",
    "CVE-2016-10012",
    "CVE-2016-10708",
    "CVE-2018-15473",
    "CVE-2018-20685",
    "CVE-2019-6109",
    "CVE-2019-6110",
    "CVE-2019-6111",
    "CVE-2020-14145",
    "CVE-2020-15778"
  );

  script_name(english:"RHEL 5 : openssh (Unpatched Vulnerability)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Red Hat 5 host is affected by multiple vulnerabilities that will not be patched.");
  script_set_attribute(attribute:"description", value:
"The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple
vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - openssh: possible fallback from untrusted to trusted X11 forwarding (CVE-2016-1908)

  - Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote
    attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.
    (CVE-2016-10009)

  - authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer
    contents, which might allow local users to obtain sensitive private-key information by leveraging access
    to a privilege-separated child process. (CVE-2016-10011)

  - The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4
    does not ensure that a bounds check is enforced by all compilers, which might allows local users to gain
    privileges by leveraging access to a sandboxed privilege-separation process, related to the m_zback and
    m_zlib data structures. (CVE-2016-10012)

  - sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference
    and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c
    and packet.c. (CVE-2016-10708)

  - Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote
    authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related
    to the (1) do_authenticated1 and (2) session_x11_req functions. (CVE-2016-3115)

  - sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH
    hashing on a static password when the username does not exist, which allows remote attackers to enumerate
    users by leveraging the timing difference between responses when a large password is provided.
    (CVE-2016-6210)

  - The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths
    for password authentication, which allows remote attackers to cause a denial of service (crypt CPU
    consumption) via a long string. (CVE-2016-6515)

  - OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an
    invalid authenticating user until after the packet containing the request has been fully parsed, related
    to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. (CVE-2018-15473)

  - In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions
    via the filename of . or an empty filename. The impact is modifying the permissions of the target
    directory on the client side. (CVE-2018-20685)

  - An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a
    malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client
    output, e.g., by using ANSI control codes to hide additional files being transferred. This affects
    refresh_progress_meter() in progressmeter.c. (CVE-2019-6109)

  - In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious
    server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control
    codes to hide additional files being transferred. (CVE-2019-6110)

  - An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the
    server chooses which files/directories are sent to the client. However, the scp client only performs
    cursory validation of the object name returned (only directory traversal attacks are prevented). A
    malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client
    target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as
    well (for example, to overwrite the .ssh/authorized_keys file). (CVE-2019-6111)

  - The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in
    the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts
    (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and
    8.6 are also affected. (CVE-2020-14145)

  - scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by
    backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they
    intentionally omit validation of anomalous argument transfers because that could stand a great chance
    of breaking existing workflows. (CVE-2020-15778)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package
is installed.");
  script_set_attribute(attribute:"solution", value:
"The vendor has acknowledged the vulnerabilities but no solution has been provided. Refer to the vendor for remediation
guidance.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-1908");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:"CANVAS");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/01/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/05/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:openssh");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Red Hat Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl", "redhat_repos.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm.inc');
include('rhel.inc');

if (!get_kb_item("global_settings/vendor_unpatched"))
exit(0, "Unpatched Vulnerabilities Detection not active.");

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/RedHat/release');
if (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');
var os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');
os_ver = os_ver[1];
if (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '5')) audit(AUDIT_OS_NOT, 'Red Hat 5.x', 'Red Hat ' + os_ver);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);

var constraints = [
  {
    'pkgs': [
      {'reference':'openssh', 'release':'5', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE, 'unpatched_pkg':'openssh'}
    ]
  }
];


var flag = 0;
foreach var constraint_array ( constraints ) {
  var repo_relative_urls = NULL;
  var enterprise_linux_flag = rhel_repo_urls_has_content_dist_rhel(repo_urls:repo_relative_urls);
  foreach var pkg ( constraint_array['pkgs'] ) {
    var unpatched_pkg = NULL;
    var _release = NULL;
    var sp = NULL;
    var el_string = NULL;
    var rpm_spec_vers_cmp = NULL;
    var exists_check = NULL;
    var cves = NULL;
    if (!empty_or_null(pkg['unpatched_pkg'])) unpatched_pkg = pkg['unpatched_pkg'];
    if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (unpatched_pkg &&
        _release &&
        (!exists_check || rpm_exists(release:_release, rpm:exists_check)) &&
        unpatched_package_exists(release:_release, package:unpatched_pkg, cves: cves)) flag++;
  }
}

if (flag)
{
  var extra = NULL;
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : unpatched_packages_report()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'openssh');
}