TencentOS Server 3: 389-ds:1.4 (TSSA-2026:1144)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2026:1144.
##

include('compat.inc');

if (description)
{
  script_id(365122);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/12");

  script_cve_id(
    "CVE-2026-18355",
    "CVE-2026-18453",
    "CVE-2026-18922",
    "CVE-2026-76560"
  );

  script_name(english:"TencentOS Server 3: 389-ds:1.4 (TSSA-2026:1144)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 3 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1144 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-18355:
    A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In
    sasl_io_start_packet(), the wrapped-record length read from the wire is validated only against an upper
    bound. A small wire length (0, 1, or 2) produces an encrypted_buffer_count below the already-consumed
    encrypted_buffer_offset, causing an unsigned subtraction underflow in sasl_io_read_packet(). PR_Recv is
    then requested to read approximately 4 GiB into a 1024-byte heap buffer, resulting in a heap buffer
    overflow with attacker-controlled content. After a successful SASL bind with integrity protection (SSF >
    0), a remote authenticated attacker can cause a denial of service or potentially achieve remote code
    execution. This flaw is distinct from CVE-2026-11774, whose fix only guards against upper-bound overflow.

    CVE-2026-18453:
    A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of
    op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted
    sequence of search requests using the USE_ONE_BACKEND control, resulting in denial of service.

    CVE-2026-18922:
    A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a
    Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following
    a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An
    attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a
    SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority
    without any valid credentials. A variant using a valid low-privileged account's own successful bind
    instead of an anonymous one is also possible.

    CVE-2026-76560:
    A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an
    anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated
    client to satisfy access control checks intended to require a matching authenticated identity. This can
    allow an anonymous LDAP client to perform an operation, such as adding or modifying a directory entry,
    that a SELFDN-based ACI intended to restrict to a specific authenticated user.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20261144.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-18922");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:389-ds-base");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^3([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 3.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '3',
    'pkgs': [
      {'reference':'389-ds-base-1.4.3.39-28.module+el8.10.0+968+b91a6a3d', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-1.4.3.39-28.module+el8.10.0+968+b91a6a3d', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-debuginfo-1.4.3.39-28.module+el8.10.0+968+b91a6a3d', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-debuginfo-1.4.3.39-28.module+el8.10.0+968+b91a6a3d', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-debugsource-1.4.3.39-28.module+el8.10.0+968+b91a6a3d', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-debugsource-1.4.3.39-28.module+el8.10.0+968+b91a6a3d', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-devel-1.4.3.39-28.module+el8.10.0+968+b91a6a3d', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-devel-1.4.3.39-28.module+el8.10.0+968+b91a6a3d', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-legacy-tools-1.4.3.39-28.module+el8.10.0+968+b91a6a3d', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-legacy-tools-1.4.3.39-28.module+el8.10.0+968+b91a6a3d', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-legacy-tools-debuginfo-1.4.3.39-28.module+el8.10.0+968+b91a6a3d', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-legacy-tools-debuginfo-1.4.3.39-28.module+el8.10.0+968+b91a6a3d', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-libs-1.4.3.39-28.module+el8.10.0+968+b91a6a3d', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-libs-1.4.3.39-28.module+el8.10.0+968+b91a6a3d', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-libs-debuginfo-1.4.3.39-28.module+el8.10.0+968+b91a6a3d', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-libs-debuginfo-1.4.3.39-28.module+el8.10.0+968+b91a6a3d', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-snmp-1.4.3.39-28.module+el8.10.0+968+b91a6a3d', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-snmp-1.4.3.39-28.module+el8.10.0+968+b91a6a3d', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-snmp-debuginfo-1.4.3.39-28.module+el8.10.0+968+b91a6a3d', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'389-ds-base-snmp-debuginfo-1.4.3.39-28.module+el8.10.0+968+b91a6a3d', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-lib389-1.4.3.39-28.module+el8.10.0+968+b91a6a3d', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, '389-ds-base / 389-ds-base-debuginfo / 389-ds-base-debugsource / etc');
}