Ubuntu 26.10 : OpenSSH vulnerabilities (USN-8937-1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-8937-1. The text
# itself is copyright (C) Canonical, Inc. See
# <https://ubuntu.com/security/notices>. Ubuntu(R) is a registered
# trademark of Canonical, Inc.
##

include('compat.inc');

if (description)
{
  script_id(367750);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/20");

  script_cve_id(
    "CVE-2026-106552",
    "CVE-2026-106553",
    "CVE-2026-106555",
    "CVE-2026-106582",
    "CVE-2026-106583",
    "CVE-2026-106584",
    "CVE-2026-106585",
    "CVE-2026-106586",
    "CVE-2026-106587"
  );
  script_xref(name:"IAVA", value:"2026-A-1103");
  script_xref(name:"USN", value:"8937-1");

  script_name(english:"Ubuntu 26.10 : OpenSSH vulnerabilities (USN-8937-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Ubuntu host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Ubuntu 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the
USN-8937-1 advisory.

    It was discovered that OpenSSH's sftp client incorrectly handled paths returned by the server during a
    recursive copy operation. A remote attacker controlling the server could possibly use this issue to write
    files to unintended locations. (CVE-2026-106552)

    It was discovered that OpenSSH's sshd server incorrectly handled GSSAPIAuthentication state across
    authentication attempts. An attacker could possibly use this issue to obtain credentials from a previous
    failed authentication attempt. (CVE-2026-106553, CVE-2026-106555)

    It was discovered that OpenSSH incorrectly used an LZ77 dictionary coder during compression. An attacker
    could possibly use this issue to obtain sensitive information. (CVE-2026-106582)

    It was discovered that OpenSSH's ssh client incorrectly allowed special characters in command-line
    usernames. An attacker could possibly use this issue to inject arbitrary commands via specially crafted
    usernames. (CVE-2026-106583)

    It was discovered that OpenSSH's ssh-keygen incorrectly handled Daylight Saving Time when converting
    dates. An attacker could possibly use this issue to cause certificates to have incorrect expiration times.
    (CVE-2026-106584)

    It was discovered that OpenSSH did not check whether the maximum packet length was exceeded during
    decompression. A remote attacker could possibly use this issue to cause a denial of service.
    (CVE-2026-106585)

    It was discovered that OpenSSH's sshd server incorrectly applied the restrict keyword from authorized_keys
    to tunnel forwarding requests. A local attacker with an authorized key could possibly use this issue to
    bypass intended tunnel forwarding restrictions. (CVE-2026-106586)

    It was discovered that OpenSSH's sshd server incorrectly handled certain configuration options that accept
    a none value. An attacker could possibly use this issue to cause OpenSSH to behave unexpectedly.
    (CVE-2026-106587)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://ubuntu.com/security/notices/USN-8937-1");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-106555");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-106583");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/20");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:26.10");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:openssh-client");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:openssh-client-gssapi");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:openssh-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:openssh-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:openssh-server-gssapi");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:openssh-sftp-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:openssh-tests");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:ssh");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:ssh-askpass-gnome");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Ubuntu Local Security Checks");

  script_copyright(english:"Ubuntu Security Notice (C) 2026 Canonical, Inc. / NASL script (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/Ubuntu/release');
if ( isnull(os_release) ) audit(AUDIT_OS_NOT, 'Ubuntu');
os_release = chomp(os_release);
if (! ('26.10' >< os_release)) audit(AUDIT_OS_NOT, 'Ubuntu 26.10', 'Ubuntu ' + os_release);
if ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);

var pkgs = [
    {'osver': '26.10', 'pkgname': 'openssh-client', 'pkgver': '1:10.5p1-1ubuntu3.1'},
    {'osver': '26.10', 'pkgname': 'openssh-client-gssapi', 'pkgver': '1:10.5p1-1ubuntu3.1'},
    {'osver': '26.10', 'pkgname': 'openssh-common', 'pkgver': '1:10.5p1-1ubuntu3.1'},
    {'osver': '26.10', 'pkgname': 'openssh-server', 'pkgver': '1:10.5p1-1ubuntu3.1'},
    {'osver': '26.10', 'pkgname': 'openssh-server-gssapi', 'pkgver': '1:10.5p1-1ubuntu3.1'},
    {'osver': '26.10', 'pkgname': 'openssh-sftp-server', 'pkgver': '1:10.5p1-1ubuntu3.1'},
    {'osver': '26.10', 'pkgname': 'openssh-tests', 'pkgver': '1:10.5p1-1ubuntu3.1'},
    {'osver': '26.10', 'pkgname': 'ssh', 'pkgver': '1:10.5p1-1ubuntu3.1'},
    {'osver': '26.10', 'pkgname': 'ssh-askpass-gnome', 'pkgver': '1:10.5p1-1ubuntu3.1'}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var osver = NULL;
  var pkgname = NULL;
  var pkgver = NULL;
  if (!empty_or_null(package_array['osver'])) osver = package_array['osver'];
  if (!empty_or_null(package_array['pkgname'])) pkgname = package_array['pkgname'];
  if (!empty_or_null(package_array['pkgver'])) pkgver = package_array['pkgver'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (osver && pkgname && pkgver) {
    if (deb_check(release:osver, prefix:pkgname, reference:pkgver, cves:cves)) flag++;
  }
}

if (flag)
{
  var extra = '';
  extra += ubuntu_report_get();
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : extra
  );
  exit(0);
}
else
{
  var tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'openssh-client / openssh-client-gssapi / openssh-common / etc');
}