Ubuntu 16.04 LTS : AppArmor update (USN-4008-2)

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-4008-2. The text 
# itself is copyright (C) Canonical, Inc. See 
# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
# trademark of Canonical, Inc.
#

include('compat.inc');

if (description)
{
  script_id(125767);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/10/20");

  script_cve_id("CVE-2019-11190");
  script_xref(name:"USN", value:"4008-2");

  script_name(english:"Ubuntu 16.04 LTS : AppArmor update (USN-4008-2)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Ubuntu host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"USN-4008-1 fixed multiple security issues in the Linux kernel. This
update provides the corresponding changes to AppArmor policy for
correctly operating under the Linux kernel with fixes for
CVE-2019-11190. Without these changes, some profile transitions may be
unintentionally denied due to missing mmap ('m') rules.

Original advisory details :

Robert Swiecki discovered that the Linux kernel did not properly
apply Address Space Layout Randomization (ASLR) in some situations for
setuid elf binaries. A local attacker could use this to improve the
chances of exploiting an existing vulnerability in a setuid elf
binary. (CVE-2019-11190)

It was discovered that a NULL pointer dereference
vulnerability existed in the LSI Logic MegaRAID driver in
the Linux kernel. A local attacker could use this to cause a
denial of service (system crash). (CVE-2019-11810)

It was discovered that a race condition leading to a
use-after-free existed in the Reliable Datagram Sockets
(RDS) protocol implementation in the Linux kernel. The RDS
protocol is blacklisted by default in Ubuntu. If enabled, a
local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code.
(CVE-2019-11815)

Federico Manuel Bento discovered that the Linux kernel did
not properly apply Address Space Layout Randomization (ASLR)
in some situations for setuid a.out binaries. A local
attacker could use this to improve the chances of exploiting
an existing vulnerability in a setuid a.out binary.
(CVE-2019-11191)

As a hardening measure, this update disables a.out support.

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.");
  script_set_attribute(attribute:"see_also", value:"https://ubuntu.com/security/notices/USN-4008-2");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-11190");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/04/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/06/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/06/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:apparmor-profiles");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:apparmor-utils");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:dh-apparmor");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libapache2-mod-apparmor");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libapparmor-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libapparmor-perl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libapparmor1");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libpam-apparmor");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python-apparmor");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python-libapparmor");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python3-apparmor");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python3-libapparmor");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:apparmor");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:apparmor-easyprof");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:apparmor-notify");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Ubuntu Local Security Checks");

  script_copyright(english:"Ubuntu Security Notice (C) 2019-2023 Canonical, Inc. / NASL script (C) 2019-2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/Ubuntu/release');
if ( isnull(os_release) ) audit(AUDIT_OS_NOT, 'Ubuntu');
os_release = chomp(os_release);
if (! ('16.04' >< os_release)) audit(AUDIT_OS_NOT, 'Ubuntu 16.04', 'Ubuntu ' + os_release);
if ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);

var pkgs = [
    {'osver': '16.04', 'pkgname': 'apparmor', 'pkgver': '2.10.95-0ubuntu2.11'},
    {'osver': '16.04', 'pkgname': 'apparmor-easyprof', 'pkgver': '2.10.95-0ubuntu2.11'},
    {'osver': '16.04', 'pkgname': 'apparmor-notify', 'pkgver': '2.10.95-0ubuntu2.11'},
    {'osver': '16.04', 'pkgname': 'apparmor-profiles', 'pkgver': '2.10.95-0ubuntu2.11'},
    {'osver': '16.04', 'pkgname': 'apparmor-utils', 'pkgver': '2.10.95-0ubuntu2.11'},
    {'osver': '16.04', 'pkgname': 'dh-apparmor', 'pkgver': '2.10.95-0ubuntu2.11'},
    {'osver': '16.04', 'pkgname': 'libapache2-mod-apparmor', 'pkgver': '2.10.95-0ubuntu2.11'},
    {'osver': '16.04', 'pkgname': 'libapparmor-dev', 'pkgver': '2.10.95-0ubuntu2.11'},
    {'osver': '16.04', 'pkgname': 'libapparmor-perl', 'pkgver': '2.10.95-0ubuntu2.11'},
    {'osver': '16.04', 'pkgname': 'libapparmor1', 'pkgver': '2.10.95-0ubuntu2.11'},
    {'osver': '16.04', 'pkgname': 'libpam-apparmor', 'pkgver': '2.10.95-0ubuntu2.11'},
    {'osver': '16.04', 'pkgname': 'python-apparmor', 'pkgver': '2.10.95-0ubuntu2.11'},
    {'osver': '16.04', 'pkgname': 'python-libapparmor', 'pkgver': '2.10.95-0ubuntu2.11'},
    {'osver': '16.04', 'pkgname': 'python3-apparmor', 'pkgver': '2.10.95-0ubuntu2.11'},
    {'osver': '16.04', 'pkgname': 'python3-libapparmor', 'pkgver': '2.10.95-0ubuntu2.11'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var osver = NULL;
  var pkgname = NULL;
  var pkgver = NULL;
  if (!empty_or_null(package_array['osver'])) osver = package_array['osver'];
  if (!empty_or_null(package_array['pkgname'])) pkgname = package_array['pkgname'];
  if (!empty_or_null(package_array['pkgver'])) pkgver = package_array['pkgver'];
  if (osver && pkgname && pkgver) {
    if (ubuntu_check(osver:osver, pkgname:pkgname, pkgver:pkgver)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : ubuntu_report_get()
  );
  exit(0);
}
else
{
  var tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'apparmor / apparmor-easyprof / apparmor-notify / apparmor-profiles / etc');
}