Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : rabbitmq-c vulnerabilities (USN-8724-1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-8724-1. The text
# itself is copyright (C) Canonical, Inc. See
# <https://ubuntu.com/security/notices>. Ubuntu(R) is a registered
# trademark of Canonical, Inc.
##

include('compat.inc');

if (description)
{
  script_id(344621);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/10");

  script_cve_id(
    "CVE-2023-35789",
    "CVE-2026-44235",
    "CVE-2026-44236",
    "CVE-2026-59986",
    "CVE-2026-61547"
  );
  script_xref(name:"USN", value:"8724-1");

  script_name(english:"Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : rabbitmq-c vulnerabilities (USN-8724-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Ubuntu host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro
Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the
USN-8724-1 advisory.

    It was discovered that the rabbitmq-c command-line tools only accepted credentials on the command line,
    making them visible to other local users through the process list. An attacker could possibly use this to
    obtain sensitive credentials. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04
    LTS, and Ubuntu 20.04 LTS. (CVE-2023-35789)

    It was discovered that rabbitmq-c did not correctly compute AMQP frame lengths, leading to a size_t
    underflow. A remote attacker could possibly use this to cause rabbitmq-c to crash, resulting in a denial
    of service, or possibly expose sensitive information. This issue only affected Ubuntu 14.04 LTS, Ubuntu
    16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-44235)

    It was discovered that rabbitmq-c did not properly validate the frame size during the AMQP login
    handshake. A remote attacker could possibly use this to cause a heap buffer overflow, resulting in a
    denial of service or possibly the execution of arbitrary code. This issue only affected Ubuntu 14.04 LTS,
    Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-44236)

    It was discovered that rabbitmq-c did not correctly validate the length of decoded bytes fields, leading
    to an integer overflow in a bounds check on 32-bit systems. A remote attacker controlling a broker, or
    able to intercept an unencrypted connection, could possibly use this to cause an out-of-bounds read,
    resulting in a denial of service or the exposure of sensitive information. (CVE-2026-59986)

    It was discovered that rabbitmq-c did not validate the body fragment length when serialising an AMQP body
    frame with the amqp_send_frame() API. An attacker could possibly use this to cause a heap buffer overflow,
    resulting in a denial of service (application crash) or possibly the execution of arbitrary code. This
    issue did not affect Ubuntu 14.04 LTS. (CVE-2026-61547)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://ubuntu.com/security/notices/USN-8724-1");
  script_set_attribute(attribute:"solution", value:
"Update the affected amqp-tools, librabbitmq1 and / or librabbitmq4 packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-35789");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/06/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/10");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:20.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:22.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:24.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:26.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:Pro:-:lts");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:amqp-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:librabbitmq1");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:librabbitmq4");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Ubuntu Local Security Checks");

  script_copyright(english:"Ubuntu Security Notice (C) 2026 Canonical, Inc. / NASL script (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/Ubuntu/release');
if ( isnull(os_release) ) audit(AUDIT_OS_NOT, 'Ubuntu');
os_release = chomp(os_release);
if (! ('14.04' >< os_release || '18.04' >< os_release || '20.04' >< os_release || '22.04' >< os_release || '24.04' >< os_release || '26.04' >< os_release || 'Pro' >< os_release)) audit(AUDIT_OS_NOT, 'Ubuntu 14.04 / 18.04 / 20.04 / 22.04 / 24.04 / 26.04 / Pro', 'Ubuntu ' + os_release);
if ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);

var pkgs = [
    {'osver': '14.04', 'pkgname': 'amqp-tools', 'pkgver': '0.4.1-1ubuntu0.1~esm2', 'cves': ['CVE-2023-35789', 'CVE-2026-44235', 'CVE-2026-44236', 'CVE-2026-59986', 'CVE-2026-61547']},
    {'osver': '14.04', 'pkgname': 'librabbitmq1', 'pkgver': '0.4.1-1ubuntu0.1~esm2', 'cves': ['CVE-2023-35789', 'CVE-2026-44235', 'CVE-2026-44236', 'CVE-2026-59986', 'CVE-2026-61547']},
    {'osver': '18.04', 'pkgname': 'amqp-tools', 'pkgver': '0.8.0-1ubuntu0.18.04.2+esm1', 'cves': ['CVE-2023-35789', 'CVE-2026-44235', 'CVE-2026-44236', 'CVE-2026-59986', 'CVE-2026-61547']},
    {'osver': '18.04', 'pkgname': 'librabbitmq4', 'pkgver': '0.8.0-1ubuntu0.18.04.2+esm1', 'cves': ['CVE-2023-35789', 'CVE-2026-44235', 'CVE-2026-44236', 'CVE-2026-59986', 'CVE-2026-61547']},
    {'osver': '20.04', 'pkgname': 'amqp-tools', 'pkgver': '0.10.0-1ubuntu0.20.04.1~esm1', 'cves': ['CVE-2023-35789', 'CVE-2026-44235', 'CVE-2026-44236', 'CVE-2026-59986', 'CVE-2026-61547']},
    {'osver': '20.04', 'pkgname': 'librabbitmq4', 'pkgver': '0.10.0-1ubuntu0.20.04.1~esm1', 'cves': ['CVE-2023-35789', 'CVE-2026-44235', 'CVE-2026-44236', 'CVE-2026-59986', 'CVE-2026-61547']},
    {'osver': '22.04', 'pkgname': 'amqp-tools', 'pkgver': '0.10.0-1ubuntu2.2', 'cves': ['CVE-2026-59986', 'CVE-2026-61547']},
    {'osver': '22.04', 'pkgname': 'librabbitmq4', 'pkgver': '0.10.0-1ubuntu2.2', 'cves': ['CVE-2026-59986', 'CVE-2026-61547']},
    {'osver': '24.04', 'pkgname': 'amqp-tools', 'pkgver': '0.11.0-1ubuntu0.2', 'cves': ['CVE-2026-59986', 'CVE-2026-61547']},
    {'osver': '24.04', 'pkgname': 'librabbitmq4', 'pkgver': '0.11.0-1ubuntu0.2', 'cves': ['CVE-2026-59986', 'CVE-2026-61547']},
    {'osver': '26.04', 'pkgname': 'amqp-tools', 'pkgver': '0.15.0-1ubuntu0.26.04.2', 'cves': ['CVE-2026-59986', 'CVE-2026-61547']},
    {'osver': '26.04', 'pkgname': 'librabbitmq4', 'pkgver': '0.15.0-1ubuntu0.26.04.2', 'cves': ['CVE-2026-59986', 'CVE-2026-61547']},
    {'osver': 'Pro', 'pkgname': 'amqp-tools', 'pkgver': '0.10.0-1ubuntu2.2', 'cves': ['CVE-2026-59986', 'CVE-2026-61547']},
    {'osver': 'Pro', 'pkgname': 'librabbitmq4', 'pkgver': '0.10.0-1ubuntu2.2', 'cves': ['CVE-2026-59986', 'CVE-2026-61547']},
    {'osver': 'Pro', 'pkgname': 'amqp-tools', 'pkgver': '0.11.0-1ubuntu0.2', 'cves': ['CVE-2026-59986', 'CVE-2026-61547']},
    {'osver': 'Pro', 'pkgname': 'librabbitmq4', 'pkgver': '0.11.0-1ubuntu0.2', 'cves': ['CVE-2026-59986', 'CVE-2026-61547']}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var osver = NULL;
  var pkgname = NULL;
  var pkgver = NULL;
  if (!empty_or_null(package_array['osver'])) osver = package_array['osver'];
  if (!empty_or_null(package_array['pkgname'])) pkgname = package_array['pkgname'];
  if (!empty_or_null(package_array['pkgver'])) pkgver = package_array['pkgver'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (osver && pkgname && pkgver) {
    if (deb_check(release:osver, prefix:pkgname, reference:pkgver, cves:cves)) flag++;
  }
}

if (flag)
{
  var extra = '';
  extra += ubuntu_report_get();
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : extra
  );
  exit(0);
}
else
{
  var tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'amqp-tools / librabbitmq1 / librabbitmq4');
}