CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
92.0%
According to the versions of the gstreamer packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :
Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(103064);
script_version("3.80");
script_set_attribute(attribute:"plugin_modification_date", value:"2021/01/06");
script_cve_id(
"CVE-2016-10198",
"CVE-2016-10199",
"CVE-2016-9446",
"CVE-2016-9810",
"CVE-2016-9811",
"CVE-2017-5837",
"CVE-2017-5838",
"CVE-2017-5839",
"CVE-2017-5840",
"CVE-2017-5841",
"CVE-2017-5842",
"CVE-2017-5843",
"CVE-2017-5844",
"CVE-2017-5845",
"CVE-2017-5848"
);
script_name(english:"EulerOS 2.0 SP2 : gstreamer (EulerOS-SA-2017-1206)");
script_summary(english:"Checks the rpm output for the updated packages.");
script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
script_set_attribute(attribute:"description", value:
"According to the versions of the gstreamer packages installed, the
EulerOS installation on the remote host is affected by the following
vulnerabilities :
- Multiple flaws were found in gstreamer1,
gstreamer1-plugins-base, gstreamer1-plugins-good, and
gstreamer1-plugins-bad-free packages. An attacker could
potentially use these flaws to crash applications which
use the GStreamer framework. (CVE-2016-9446,
CVE-2016-9810, CVE-2016-9811, CVE-2016-10198,
CVE-2016-10199, CVE-2017-5837, CVE-2017-5838,
CVE-2017-5839, CVE-2017-5840, CVE-2017-5841,
CVE-2017-5842, CVE-2017-5843, CVE-2017-5844,
CVE-2017-5845, CVE-2017-5848)
Note that Tenable Network Security has extracted the preceding
description block directly from the EulerOS security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.");
# https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2017-1206
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?688399e1");
script_set_attribute(attribute:"solution", value:
"Update the affected gstreamer packages.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"patch_publication_date", value:"2017/08/25");
script_set_attribute(attribute:"plugin_publication_date", value:"2017/09/11");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:gstreamer1");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:gstreamer1-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:gstreamer1-plugins-bad-free");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:gstreamer1-plugins-base");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:gstreamer1-plugins-base-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:gstreamer1-plugins-good");
script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Huawei Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
script_exclude_keys("Host/EulerOS/uvp_version");
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("rpm.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/EulerOS/release");
if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");
sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(2)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP2");
uvp = get_kb_item("Host/EulerOS/uvp_version");
if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP2", "EulerOS UVP " + uvp);
if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);
flag = 0;
pkgs = ["gstreamer1-1.10.4-2",
"gstreamer1-devel-1.10.4-2",
"gstreamer1-plugins-bad-free-1.10.4-2",
"gstreamer1-plugins-base-1.10.4-1",
"gstreamer1-plugins-base-devel-1.10.4-1",
"gstreamer1-plugins-good-1.10.4-2"];
foreach (pkg in pkgs)
if (rpm_check(release:"EulerOS-2.0", sp:"2", reference:pkg)) flag++;
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_WARNING,
extra : rpm_report_get()
);
exit(0);
}
else
{
tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, "gstreamer");
}
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10198
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10199
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9446
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9810
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9811
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5837
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5838
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5839
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5840
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5841
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5842
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5843
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5844
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5845
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5848
www.nessus.org/u?688399e1
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
92.0%