TencentOS Server 3: tar (TSSA-2026:1146)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2026:1146.
##

include('compat.inc');

if (description)
{
  script_id(365139);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/12");

  script_cve_id(
    "CVE-2025-45582",
    "CVE-2026-5704",
    "CVE-2026-18477",
    "CVE-2026-18508"
  );

  script_name(english:"TencentOS Server 3: tar (TSSA-2026:1146)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 3 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1146 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2025-45582:
    GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain
    two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical
    directory. Second, the victim must extract an archive that contains a critical file, specified via a
    relative pathname that begins with the symlink name and ends with that critical file's name. Here, the
    extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of
    Member name contains '..' that would occur for a single TAR archive that attempted to specify the
    critical file via a ../ approach. For example, the first archive can contain x ->
    ../../../../../home/victim/.ssh and the second archive can contain x/authorized_keys. This can affect
    server applications that automatically extract any number of user-supplied TAR archives, and were relying
    on the blocking of traversal. This can also affect software installation processes in which tar xf is
    run more than once (e.g., when installing a package can automatically install two dependencies that are
    set up as untrusted tarballs instead of official packages).

    CVE-2026-5704:
    A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious
    archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-
    extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a
    system without detection.

    CVE-2026-18477:
    A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling
    allows a local attacker with write access to a directory being backed up to influence the restore process
    if the attacker has access to the system where the restore is being performed. During restoration, files
    or directories may be created, renamed or overwritten outside the intended extraction directory. This
    could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does
    not require the attacker to modify or craft the archive, and standard backup and restore
    workflowsincluding extracting into a newly created directory without using the -P option do not
    mitigate the issue.

    CVE-2026-18508:
    A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets
    are not confined to the designated top-level directory and may resolve relative to the extraction working
    directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined
    with a preexisting symbolic link under the working directory, may allow writing outside that boundary
    during a single extraction.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20261146.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-5704");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:tar");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^3([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 3.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '3',
    'pkgs': [
      {'reference':'tar-1.30-13.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'tar-1.30-13.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'tar-debuginfo-1.30-13.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'tar-debuginfo-1.30-13.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'tar-debugsource-1.30-13.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'tar-debugsource-1.30-13.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'tar / tar-debuginfo / tar-debugsource');
}