Mandriva Update for libotr MDVSA-2012:131 (libotr)

# SPDX-FileCopyrightText: 2012 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if(description)
{
  script_xref(name:"URL", value:"http://www.mandriva.com/en/support/security/advisories/?name=MDVSA-2012:131");
  script_oid("1.3.6.1.4.1.25623.1.0.831719");
  script_version("2026-04-24T15:56:23+0000");
  script_tag(name:"last_modification", value:"2026-04-24 15:56:23 +0000 (Fri, 24 Apr 2026)");
  script_tag(name:"creation_date", value:"2012-08-14 10:41:59 +0530 (Tue, 14 Aug 2012)");
  script_cve_id("CVE-2012-3461");
  script_tag(name:"cvss_base", value:"4.3");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:N/C:N/I:N/A:P");
  script_xref(name:"MDVSA", value:"2012:131");
  script_name("Mandriva Update for libotr MDVSA-2012:131 (libotr)");

  script_tag(name:"summary", value:"The remote host is missing an update for the 'libotr'
  package(s) announced via the referenced advisory.");
  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2012 Greenbone AG");
  script_family("Mandrake Local Security Checks");
  script_dependencies("gather-package-list.nasl");
  script_mandatory_keys("ssh/login/mandriva_mandrake_linux", "ssh/login/release", re:"ssh/login/release=MNDK_2011\.0");
  script_tag(name:"affected", value:"libotr on Mandriva Linux 2011.0");
  script_tag(name:"solution", value:"Please Install the Updated Packages.");
  script_tag(name:"insight", value:"A vulnerability was found and corrected in libotr:

  Just Ferguson discovered that libotr, an off-the-record (OTR) messaging
  library, can be forced to perform zero-length allocations for heap
  buffers that are used in base64 decoding routines. An attacker can
  exploit this flaw by sending crafted messages to an application that
  is using libotr to perform denial of service attacks or potentially
  execute arbitrary code (CVE-2012-3461).

  The updated packages have been patched to correct this issue.");
  script_tag(name:"qod_type", value:"package");
  script_tag(name:"solution_type", value:"VendorFix");

  exit(0);
}

include("revisions-lib.inc");
include("pkg-lib-rpm.inc");

release = rpm_get_ssh_release();
if(!release) exit(0);

res = "";

if(release == "MNDK_2011.0")
{

  if ((res = isrpmvuln(pkg:"libotr2", rpm:"libotr2~3.2.0~5.1", rls:"MNDK_2011.0")) != NULL)
  {
    security_message(data:res);
    exit(0);
  }

  if ((res = isrpmvuln(pkg:"libotr-devel", rpm:"libotr-devel~3.2.0~5.1", rls:"MNDK_2011.0")) != NULL)
  {
    security_message(data:res);
    exit(0);
  }

  if ((res = isrpmvuln(pkg:"libotr-utils", rpm:"libotr-utils~3.2.0~5.1", rls:"MNDK_2011.0")) != NULL)
  {
    security_message(data:res);
    exit(0);
  }

  if ((res = isrpmvuln(pkg:"lib64otr2", rpm:"lib64otr2~3.2.0~5.1", rls:"MNDK_2011.0")) != NULL)
  {
    security_message(data:res);
    exit(0);
  }

  if ((res = isrpmvuln(pkg:"lib64otr-devel", rpm:"lib64otr-devel~3.2.0~5.1", rls:"MNDK_2011.0")) != NULL)
  {
    security_message(data:res);
    exit(0);
  }

  if (__pkg_match) exit(99);
  exit(0);
}