Debian DSA-5511-1 : mosquitto - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dsa-5511. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(182418);
  script_version("1.0");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/10/02");

  script_cve_id(
    "CVE-2021-34434",
    "CVE-2021-41039",
    "CVE-2023-0809",
    "CVE-2023-3592",
    "CVE-2023-28366"
  );

  script_name(english:"Debian DSA-5511-1 : mosquitto - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dsa-5511 advisory.

  - In Eclipse Mosquitto versions 2.0 to 2.0.11, when using the dynamic security plugin, if the ability for a
    client to make subscriptions on a topic is revoked when a durable client is offline, then existing
    subscriptions for that client are not revoked. (CVE-2021-34434)

  - In versions 1.6 to 2.0.11 of Eclipse Mosquitto, an MQTT v5 client connecting with a large number of user-
    property properties could cause excessive CPU usage, leading to a loss of performance and possible denial
    of service. (CVE-2021-41039)

  - The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused
    remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to
    PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function.
    (CVE-2023-28366)

  - 2.0.17  Broker:  * Fix `max_queued_messages 0` stopping clients from receiving messages * Fix
    `max_inflight_messages` not being set correctly.  Apps:  * Fix `mosquitto_passwd -U` backup file creation.
    2.0.16  Security:  * CVE-2023-28366: Fix memory leak in broker when clients send multiple QoS 2 messages
    with the same message ID, but then never respond to the PUBREC commands. * CVE-2023-0809: Fix excessive
    memory being allocated based on malicious initial packets that are not CONNECT packets. * CVE-2023-3592:
    Fix memory leak when clients send v5 CONNECT packets with a will message that contains invalid property
    types. * Broker will now reject Will messages that attempt to publish to $CONTROL/. * Broker now validates
    usernames provided in a TLS certificate or TLS-PSK identity are valid UTF-8. * Fix potential crash when
    loading invalid persistence file. * Library will no longer allow single level wildcard certificates, e.g.
    *.com  Broker:  * Fix $SYS messages being expired after 60 seconds and hence unchanged values
    disappearing. * Fix some retained topic memory not being cleared immediately after used. * Fix error
    handling related to the `bind_interface` option. * Fix std* files not being redirected when daemonising,
    when built with assertions removed. * Fix default settings incorrectly allowing TLS v1.1. * Use line
    buffered mode for stdout. Closes #2354. * Fix bridges with non-matching cleansession/local_cleansession
    being expired on start after restoring from persistence. * Fix connections being limited to 2048 on
    Windows. The limit is now 8192, where supported. * Broker will log warnings if sensitive files are world
    readable/writable, or if the owner/group is not the same as the user/group the broker is running as. In
    future versions the broker will refuse to open these files.  * mosquitto_memcmp_const is now more constant
    time. * Only register with DLT if DLT logging is enabled. * Fix any possible case where a json string
    might be incorrectly loaded. This could have caused a crash if a textname or textdescription field of a
    role was not a string, when loading the dynsec config from file only. * Dynsec plugin will not allow
    duplicate clients/groups/roles when loading config from file, which matches the behaviour for when
    creating them. * Fix heap overflow when reading corrupt config with log_dest file.  Client library:  *
    Use CLOCK_BOOTTIME when available, to keep track of time. This solves the problem of the client OS
    sleeping and the client hence not being able to calculate the actual time for keepalive purposes. * Fix
    default settings incorrectly allowing TLS v1.1. * Fix high CPU use on slow TLS connect.  Clients:  * Fix
    incorrect topic-alias property value in mosquitto_sub json output. * Fix confusing message on TLS
    certificate verification.  Apps:  * mosquitto_passwd uses mkstemp() for backup files. * `mosquitto_ctrl
    dynsec init` will refuse to overwrite an existing file, without a race-condition.   (CVE-2023-0809,
    CVE-2023-3592)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993400");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/mosquitto");
  script_set_attribute(attribute:"see_also", value:"https://www.debian.org/security/2023/dsa-5511");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2021-34434");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2021-41039");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2023-0809");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2023-28366");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2023-3592");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bullseye/mosquitto");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bookworm/mosquitto");
  script_set_attribute(attribute:"solution", value:
"Upgrade the mosquitto packages.

For the stable distribution (bookworm), these problems have been fixed in version 2.0.11-1.2+deb12u1.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-34434");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/08/30");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/10/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/10/02");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmosquitto-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmosquitto1");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmosquittopp-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmosquittopp1");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:mosquitto");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:mosquitto-clients");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:mosquitto-dev");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(11)\.[0-9]+|^(12)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 11.0 / 12.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '11.0', 'prefix': 'libmosquitto-dev', 'reference': '2.0.11-1+deb11u1'},
    {'release': '11.0', 'prefix': 'libmosquitto1', 'reference': '2.0.11-1+deb11u1'},
    {'release': '11.0', 'prefix': 'libmosquittopp-dev', 'reference': '2.0.11-1+deb11u1'},
    {'release': '11.0', 'prefix': 'libmosquittopp1', 'reference': '2.0.11-1+deb11u1'},
    {'release': '11.0', 'prefix': 'mosquitto', 'reference': '2.0.11-1+deb11u1'},
    {'release': '11.0', 'prefix': 'mosquitto-clients', 'reference': '2.0.11-1+deb11u1'},
    {'release': '11.0', 'prefix': 'mosquitto-dev', 'reference': '2.0.11-1+deb11u1'},
    {'release': '12.0', 'prefix': 'libmosquitto-dev', 'reference': '2.0.11-1.2+deb12u1'},
    {'release': '12.0', 'prefix': 'libmosquitto1', 'reference': '2.0.11-1.2+deb12u1'},
    {'release': '12.0', 'prefix': 'libmosquittopp-dev', 'reference': '2.0.11-1.2+deb12u1'},
    {'release': '12.0', 'prefix': 'libmosquittopp1', 'reference': '2.0.11-1.2+deb12u1'},
    {'release': '12.0', 'prefix': 'mosquitto', 'reference': '2.0.11-1.2+deb12u1'},
    {'release': '12.0', 'prefix': 'mosquitto-clients', 'reference': '2.0.11-1.2+deb12u1'},
    {'release': '12.0', 'prefix': 'mosquitto-dev', 'reference': '2.0.11-1.2+deb12u1'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libmosquitto-dev / libmosquitto1 / libmosquittopp-dev / etc');
}