Mageia: Security Advisory (MGASA-2021-0431)

# SPDX-FileCopyrightText: 2022 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.1.10.2021.0431");
  script_cve_id("CVE-2021-21834", "CVE-2021-21836", "CVE-2021-21837", "CVE-2021-21838", "CVE-2021-21839", "CVE-2021-21840", "CVE-2021-21841", "CVE-2021-21842", "CVE-2021-21843", "CVE-2021-21844", "CVE-2021-21845", "CVE-2021-21846", "CVE-2021-21847", "CVE-2021-21848", "CVE-2021-21849", "CVE-2021-21850", "CVE-2021-21853", "CVE-2021-21854", "CVE-2021-21855", "CVE-2021-21857", "CVE-2021-21858", "CVE-2021-21859", "CVE-2021-21860", "CVE-2021-21861");
  script_tag(name:"creation_date", value:"2022-01-28 10:58:44 +0000 (Fri, 28 Jan 2022)");
  script_version("2024-02-02T05:06:09+0000");
  script_tag(name:"last_modification", value:"2024-02-02 05:06:09 +0000 (Fri, 02 Feb 2024)");
  script_tag(name:"cvss_base", value:"6.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2021-08-24 17:30:44 +0000 (Tue, 24 Aug 2021)");

  script_name("Mageia: Security Advisory (MGASA-2021-0431)");
  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2022 Greenbone AG");
  script_family("Mageia Linux Local Security Checks");
  script_dependencies("gather-package-list.nasl");
  script_mandatory_keys("ssh/login/mageia_linux", "ssh/login/release", re:"ssh/login/release=MAGEIA8");

  script_xref(name:"Advisory-ID", value:"MGASA-2021-0431");
  script_xref(name:"URL", value:"https://advisories.mageia.org/MGASA-2021-0431.html");
  script_xref(name:"URL", value:"https://bugs.mageia.org/show_bug.cgi?id=29432");
  script_xref(name:"URL", value:"https://www.debian.org/security/2021/dsa-4966");

  script_tag(name:"summary", value:"The remote host is missing an update for the 'gpac' package(s) announced via the MGASA-2021-0431 advisory.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable package version is present on the target host.");

  script_tag(name:"insight", value:"A specially crafted MPEG-4 input when decoding the atom for the 'co64'
FOURCC can cause an integer overflow due to unchecked arithmetic resulting
in a heap-based buffer overflow that causes memory corruption. (CVE-2021-21834)

A specially crafted MPEG-4 input using the 'ctts' FOURCC code can cause
an integer overflow due to unchecked arithmetic resulting in a
heap-based buffer overflow that causes memory corruption. (CVE-2021-21836)

A specially crafted MPEG-4 input can cause an integer overflow due to
unchecked arithmetic resulting in a heap-based buffer overflow that
causes memory corruption. (CVE-2021-21837, CVE-2021-21838, CVE-2021-21839)

A specially crafted MPEG-4 input used to process an atom using the 'saio'
FOURCC code cause an integer overflow due to unchecked arithmetic
resulting in a heap-based buffer overflow that causes memory corruption.
(CVE-2021-21840)

A specially crafted MPEG-4 input when reading an atom using the 'sbgp'
FOURCC code can cause an integer overflow due to unchecked arithmetic
resulting in a heap-based buffer overflow that causes memory corruption.
(CVE-2021-21841)

A specially crafted MPEG-4 input can cause an integer overflow when
processing an atom using the 'ssix' FOURCC code, due to unchecked
arithmetic resulting in a heap-based buffer overflow that causes memory
corruption. (CVE-2021-21842)

A specially crafted MPEG-4 input can cause an integer overflow due to
unchecked arithmetic resulting in a heap-based buffer overflow that
causes memory corruption. After validating the number of ranges, at [41]
the library will multiply the count by the size of the
GF_SubsegmentRangeInfo structure. On a 32-bit platform, this
multiplication can result in an integer overflow causing the space of the
array being allocated to be less than expected. (CVE-2021-21843)

A specially crafted MPEG-4 input when encountering an atom using the
'stco' FOURCC code, can cause an integer overflow due to unchecked
arithmetic resulting in a heap-based buffer overflow that causes memory
corruption. (CVE-2021-21844)

A specially crafted MPEG-4 input in 'stsc' decoder can cause an integer
overflow due to unchecked arithmetic resulting in a heap-based buffer
overflow that causes memory corruption. (CVE-2021-21845)

A specially crafted MPEG-4 input in 'stsz&' decoder can cause an integer
overflow due to unchecked arithmetic resulting in a heap-based buffer
overflow that causes memory corruption. (CVE-2021-21846)

A specially crafted MPEG-4 input in 'stts' decoder can cause an integer
overflow due to unchecked arithmetic resulting in a heap-based buffer
overflow that causes memory corruption. (CVE-2021-21847)

The library will actually reuse the parser for atoms with the 'stsz'
FOURCC code when parsing atoms that use the 'stz2' FOURCC code and can
cause an integer overflow due to unchecked arithmetic resulting in a
heap-based buffer overflow that causes memory ... [Please see the references for more information on the vulnerabilities]");

  script_tag(name:"affected", value:"'gpac' package(s) on Mageia 8.");

  script_tag(name:"solution", value:"Please install the updated package(s).");

  script_tag(name:"solution_type", value:"VendorFix");
  script_tag(name:"qod_type", value:"package");

  exit(0);
}

include("revisions-lib.inc");
include("pkg-lib-rpm.inc");

release = rpm_get_ssh_release();
if(!release)
  exit(0);

res = "";
report = "";

if(release == "MAGEIA8") {

  if(!isnull(res = isrpmvuln(pkg:"gpac", rpm:"gpac~1.0.1~1.1.mga8.tainted", rls:"MAGEIA8"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"lib64gpac-devel", rpm:"lib64gpac-devel~1.0.1~1.1.mga8.tainted", rls:"MAGEIA8"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"lib64gpac10", rpm:"lib64gpac10~1.0.1~1.1.mga8.tainted", rls:"MAGEIA8"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"libgpac-devel", rpm:"libgpac-devel~1.0.1~1.1.mga8.tainted", rls:"MAGEIA8"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"libgpac10", rpm:"libgpac10~1.0.1~1.1.mga8.tainted", rls:"MAGEIA8"))) {
    report += res;
  }

  if(report != "") {
    security_message(data:report);
  } else if(__pkg_match) {
    exit(99);
  }
  exit(0);
}

exit(0);