AlmaLinux 9.6 [TuxCare] Security Update: ipa-client / ipa-client-common / ipa-client-encrypted-dns / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791364402)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(363876);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/07");

  script_cve_id(
    "CVE-2026-11861",
    "CVE-2026-13097",
    "CVE-2026-18147",
    "CVE-2026-19550",
    "CVE-2026-73197",
    "CVE-2026-73198",
    "CVE-2026-76578",
    "CVE-2026-79678"
  );
  script_xref(name:"CLSA", value:"2026:1791364402");

  script_name(english:"AlmaLinux 9.6 [TuxCare] Security Update: ipa-client / ipa-client-common / ipa-client-encrypted-dns / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791364402)");

  script_set_attribute(attribute:"synopsis", value:
"The AlmaLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare
ALMALINUX9.6:CLSA-2026:1791364402 advisory.

  - A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory,
    Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server,
    and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS)
    due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This
    vulnerability could allow an authenticated Active Directory user to escalate their privileges within the
    FreeIPA domain. (CVE-2026-11861)

  - A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal
    name attributes in the 389-ds directory server does not properly account for equivalent representations of
    the same principal name, allowing a user with sufficient LDAP write privileges to create a service
    principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of
    Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.
    (CVE-2026-13097)

  - A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting
    (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a
    specially crafted link and complete a password reset, the attacker could inject and execute arbitrary
    JavaScript code. This allows the attacker to perform actions within the victim's authenticated session,
    potentially leading to full administrative control if an IdM administrator is targeted. (CVE-2026-18147)

  - A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the
    trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA
    user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and
    credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range
    identity data in the IPA LDAP directory. (CVE-2026-19550)

  - A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending
    oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration
    handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage,
    slower request handling, and potential service disruption or denial of service. (CVE-2026-73197)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/tuxcare9.6esu/advisories/2026/clsa-2026_1791364402.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?89432467");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1791364402");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory ALMALINUX9.6:CLSA-2026:1791364402.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-11861");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_severity", value:"Critical");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Alma Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/AlmaLinux/release", "Host/AlmaLinux/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'AlmaLinux' >!< os_product) audit(AUDIT_OS_NOT, 'AlmaLinux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'AlmaLinux');
if (! preg(pattern:"^9.6([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'AlmaLinux 9.6', 'AlmaLinux ' + os_version);

if (!get_kb_item('Host/AlmaLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && cpu !~ "^i[3-6]86$" && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'AlmaLinux', cpu);


var constraints = [
  {
    'release': '9',
    'sp': '6',
    'pkgs': [
      {'reference':'ipa-client-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'cpu':'aarch64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ipa-client-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'cpu':'i686', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ipa-client-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'cpu':'x86_64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ipa-client-common-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ipa-client-encrypted-dns-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'cpu':'aarch64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ipa-client-encrypted-dns-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'cpu':'i686', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ipa-client-encrypted-dns-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'cpu':'x86_64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ipa-client-epn-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'cpu':'aarch64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ipa-client-epn-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'cpu':'i686', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ipa-client-epn-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'cpu':'x86_64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ipa-client-samba-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'cpu':'aarch64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ipa-client-samba-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'cpu':'i686', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ipa-client-samba-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'cpu':'x86_64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ipa-common-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ipa-python-compat-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ipa-selinux-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ipa-selinux-luna-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ipa-selinux-nfast-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ipa-server-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'cpu':'aarch64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ipa-server-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'cpu':'x86_64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ipa-server-common-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ipa-server-dns-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ipa-server-encrypted-dns-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'cpu':'aarch64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ipa-server-encrypted-dns-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'cpu':'x86_64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ipa-server-trust-ad-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'cpu':'aarch64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ipa-server-trust-ad-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'cpu':'x86_64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-ipaclient-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-ipalib-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-ipaserver-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-ipatests-4.12.2-14.0.1.el9_6.5.tuxcare.els3', 'sp':'6', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'ipa-client / ipa-client-common / ipa-client-encrypted-dns / etc');
}