Erlang/OTP (Erlang OTP) Adaptive Chosen Ciphertext Vulnerability (GHSA-mhm2-354q-3277) - Linux

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:erlang:erlang%2fotp";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.119101");
  script_version("2025-09-16T05:38:45+0000");
  script_tag(name:"last_modification", value:"2025-09-16 05:38:45 +0000 (Tue, 16 Sep 2025)");
  script_tag(name:"creation_date", value:"2025-09-15 13:03:57 +0000 (Mon, 15 Sep 2025)");
  script_tag(name:"cvss_base", value:"4.3");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:N/C:P/I:N/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2018-01-04 18:08:06 +0000 (Thu, 04 Jan 2018)");
  script_cve_id("CVE-2017-1000385");
  script_name("Erlang/OTP (Erlang OTP) Adaptive Chosen Ciphertext Vulnerability (GHSA-mhm2-354q-3277) - Linux");
  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("General");
  script_dependencies("gb_erlang_otp_ssh_banner_detect.nasl", "os_detection.nasl");
  script_mandatory_keys("erlang/otp/detected", "Host/runs_unixoide");

  script_xref(name:"URL", value:"https://github.com/erlang/otp/security/advisories/GHSA-mhm2-354q-3277");

  script_tag(name:"summary", value:"Erlang/OTP (Erlang OTP) is prone to an adaptive chosen
  ciphertext vulnerability in the ssl component.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"An erlang TLS server configured with cipher suites using rsa key
  exchange, may be vulnerable to an Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack)
  against RSA, which when exploited, may result in plaintext recovery of encrypted messages and/or a
  Man-in-the-middle (MiTM) attack, despite the attacker not having gained access to the server's
  private key itself.");

  script_tag(name:"impact", value:"Exploiting this vulnerability to perform plaintext recovery of
  encrypted messages will, in most practical cases, allow an attacker to read the plaintext only
  after the session has completed.");

  script_tag(name:"affected", value:"Erlang/OTP (Erlang OTP) versions prior to 18.3.4.7, 19.x prior
  to 19.3.6.4 and 20.x prior to 20.1.7.

  Notes:

  - Only TLS sessions established using RSA key exchange are vulnerable to this attack.

  - While the advisory initially states that versions >= 17.0 are affected it also include the
  following note:

  > In the case of this vulnerability, versions prior to OTP 17.0 are likely also affected.");

  script_tag(name:"solution", value:"Update to version 18.3.4.7, 19.3.6.4, 20.1.7 or later.");

  script_tag(name:"qod_type", value:"remote_banner_unreliable");
  script_tag(name:"solution_type", value:"VendorFix");

  exit(0);
}

include("version_func.inc");
include("host_details.inc");

if( isnull( port = get_app_port( cpe:CPE ) ) )
  exit( 0 );

if( ! infos = get_app_version_and_location( cpe:CPE, port:port, exit_no_version:TRUE ) )
  exit( 0 );

version = infos["version"];
location = infos["location"];

if( version_is_less( version:version, test_version:"18.3.4.7" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"18.3.4.7", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

if( version_in_range_exclusive( version:version, test_version_lo:"19.0", test_version_up:"19.3.6.4" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"19.3.6.4", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

if( version_in_range_exclusive( version:version, test_version_lo:"20.0", test_version_up:"20.1.7" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"20.1.7", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

exit( 99 );