TencentOS Server 3: 389-ds:1.4 (TSSA-2026:0909)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2026:0909.
##

include('compat.inc');

if (description)
{
  script_id(341139);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/27");

  script_cve_id("CVE-2026-11770", "CVE-2026-11788", "CVE-2026-15722");

  script_name(english:"TencentOS Server 3: 389-ds:1.4 (TSSA-2026:0909)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 3 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0909 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-11770:
    A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search
    filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the
    search against cn=config with elevated replication plugin privileges and returns a boolean match result,
    the attacker can extract sensitive server configuration metadata, including replication bind DNs and
    password storage scheme information.

    CVE-2026-11788:
    A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation
    failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server
    when the system is under memory pressure.

    CVE-2026-15722:
    A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The
    get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV
    berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can
    crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a
    replica ID field with more than 16 digit characters. The overflow occurs during payload decoding, before
    any authorization check. Stack protectors limit impact to denial of service.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20260909.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-11788");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/27");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:389-ds-base");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^3([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 3.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '3',
    'pkgs': [
      {'reference':'389-ds-base-1.4.3.39-26.module+el8.10.0+957+d581abb0', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-1.4.3.39-26.module+el8.10.0+957+d581abb0', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-debuginfo-1.4.3.39-26.module+el8.10.0+957+d581abb0', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-debuginfo-1.4.3.39-26.module+el8.10.0+957+d581abb0', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-debugsource-1.4.3.39-26.module+el8.10.0+957+d581abb0', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-debugsource-1.4.3.39-26.module+el8.10.0+957+d581abb0', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-devel-1.4.3.39-26.module+el8.10.0+957+d581abb0', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-devel-1.4.3.39-26.module+el8.10.0+957+d581abb0', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-legacy-tools-1.4.3.39-26.module+el8.10.0+957+d581abb0', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-legacy-tools-1.4.3.39-26.module+el8.10.0+957+d581abb0', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-legacy-tools-debuginfo-1.4.3.39-26.module+el8.10.0+957+d581abb0', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-legacy-tools-debuginfo-1.4.3.39-26.module+el8.10.0+957+d581abb0', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-libs-1.4.3.39-26.module+el8.10.0+957+d581abb0', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-libs-1.4.3.39-26.module+el8.10.0+957+d581abb0', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-libs-debuginfo-1.4.3.39-26.module+el8.10.0+957+d581abb0', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-libs-debuginfo-1.4.3.39-26.module+el8.10.0+957+d581abb0', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-snmp-1.4.3.39-26.module+el8.10.0+957+d581abb0', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-snmp-1.4.3.39-26.module+el8.10.0+957+d581abb0', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-snmp-debuginfo-1.4.3.39-26.module+el8.10.0+957+d581abb0', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-snmp-debuginfo-1.4.3.39-26.module+el8.10.0+957+d581abb0', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-lib389-1.4.3.39-26.module+el8.10.0+957+d581abb0', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, '389-ds-base / 389-ds-base-debuginfo / 389-ds-base-debugsource / etc');
}