Erlang/OTP (Erlang OTP) DoS Vulnerability (Feb 2025) - Windows

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:erlang:erlang%2fotp";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.105282");
  script_version("2025-04-25T15:41:53+0000");
  script_tag(name:"last_modification", value:"2025-04-25 15:41:53 +0000 (Fri, 25 Apr 2025)");
  script_tag(name:"creation_date", value:"2025-04-25 11:58:37 +0000 (Fri, 25 Apr 2025)");
  script_tag(name:"cvss_base", value:"5.4");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:H/Au:N/C:N/I:N/A:C");
  script_cve_id("CVE-2025-26618");
  script_name("Erlang/OTP (Erlang OTP) DoS Vulnerability (Feb 2025) - Windows");
  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("Denial of Service");
  script_dependencies("gb_erlang_otp_ssh_banner_detect.nasl", "os_detection.nasl");
  script_mandatory_keys("erlang/otp/detected", "Host/runs_windows");

  script_xref(name:"URL", value:"https://github.com/erlang/otp/security/advisories/GHSA-78cv-45vx-q6fr");

  script_tag(name:"summary", value:"Erlang/OTP (Erlang OTP) is prone to a denial of service (DoS)
  vulnerability in the SSH component.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"Packet size is not verified properly for SFTP packets.");

  script_tag(name:"impact", value:"As a result when multiple SSH packets (conforming to max SSH
  packet size) are received by ssh, they might be combined into SFTP packet which will exceed the
  max allowed packet size and potentially cause large amount of memory to be allocated.

  Note that situation described above can only happen for successfully authenticated users after
  completing the SSH handshake.");

  script_tag(name:"affected", value:"Erlang/OTP (Erlang OTP) versions prior to 25.3.2.18, 26.x prior
  to 26.2.5.9 and 27.x prior to 27.2.4.");

  script_tag(name:"solution", value:"Update to version 25.3.2.18, 26.2.5.9, 27.2.4 or later.");

  script_tag(name:"qod_type", value:"remote_banner");
  script_tag(name:"solution_type", value:"VendorFix");

  exit(0);
}

include("version_func.inc");
include("host_details.inc");

if( isnull( port = get_app_port( cpe:CPE ) ) )
  exit( 0 );

if( ! infos = get_app_version_and_location( cpe:CPE, port:port, exit_no_version:TRUE ) )
  exit( 0 );

version = infos["version"];
location = infos["location"];

if( version_is_less( version:version, test_version:"25.3.2.18" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"25.3.2.18", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

if( version_in_range_exclusive( version:version, test_version_lo:"26.0", test_version_up:"26.2.5.9" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"26.2.5.9", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

if( version_in_range_exclusive( version:version, test_version_lo:"27.0", test_version_up:"27.2.4" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"27.2.4", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

exit( 99 );