RHEL 5 : libxml2 (Unpatched Vulnerability)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Red Hat Security Advisory libxml2. The text
# itself is copyright (C) Red Hat, Inc.
##

include('compat.inc');

if (description)
{
  script_id(195433);
  script_version("1.0");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/05/11");

  script_cve_id(
    "CVE-2016-1762",
    "CVE-2016-1833",
    "CVE-2016-1834",
    "CVE-2016-1835",
    "CVE-2016-1836",
    "CVE-2016-1837",
    "CVE-2016-1838",
    "CVE-2016-1839",
    "CVE-2016-1840",
    "CVE-2016-3627",
    "CVE-2016-3705",
    "CVE-2016-4447",
    "CVE-2016-4448",
    "CVE-2016-4449",
    "CVE-2016-4483",
    "CVE-2016-4658",
    "CVE-2016-5131",
    "CVE-2016-9318",
    "CVE-2017-0663",
    "CVE-2017-5969",
    "CVE-2017-7375",
    "CVE-2017-8872",
    "CVE-2017-9047",
    "CVE-2017-9048",
    "CVE-2017-9049",
    "CVE-2017-9050",
    "CVE-2017-16931",
    "CVE-2017-16932",
    "CVE-2018-14404",
    "CVE-2019-19956",
    "CVE-2020-7595",
    "CVE-2020-24977"
  );

  script_name(english:"RHEL 5 : libxml2 (Unpatched Vulnerability)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Red Hat 5 host is affected by multiple vulnerabilities that will not be patched.");
  script_set_attribute(attribute:"description", value:
"The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple
vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libxml2: Use after free via namespace node in XPointer ranges (CVE-2016-4658)

  - libxml2: Missing validation for external entities in xmlParsePEReference (CVE-2017-7375)

  - The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service
    (heap-based buffer over-read) via a crafted XML document. (CVE-2016-1762)

  - The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before
    10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service
    (heap-based buffer over-read) via a crafted XML document. (CVE-2016-1833)

  - Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before
    9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to
    execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.
    (CVE-2016-1834)

  - Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before 2.9.4, as used in Apple
    iOS before 9.3.2 and OS X before 10.11.5, allows remote attackers to cause a denial of service via a
    crafted XML document. (CVE-2016-1835)

  - Use-after-free vulnerability in the xmlDictComputeFastKey function in libxml2 before 2.9.4, as used in
    Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote
    attackers to cause a denial of service via a crafted XML document. (CVE-2016-1836)

  - Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral
    functions in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before
    9.2.1, and watchOS before 2.2.1, allow remote attackers to cause a denial of service via a crafted XML
    document. (CVE-2016-1837)

  - The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2,
    OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a
    denial of service (heap-based buffer over-read) via a crafted XML document. (CVE-2016-1838)

  - The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before
    10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service
    (heap-based buffer over-read) via a crafted XML document. (CVE-2016-1839)

  - Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in
    Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote
    attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML
    document. (CVE-2016-1840)

  - The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode,
    allows context-dependent attackers to cause a denial of service (infinite recursion, stack consumption,
    and application crash) via a crafted XML document. (CVE-2016-3627)

  - The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not
    properly keep track of the recursion depth, which allows context-dependent attackers to cause a denial of
    service (stack consumption and application crash) via a crafted XML document containing a large number of
    nested entity references. (CVE-2016-3705)

  - The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to
    cause a denial of service (heap-based buffer underread and application crash) via a crafted file,
    involving xmlParseName. (CVE-2016-4447)

  - Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format
    string specifiers in unknown vectors. (CVE-2016-4448)

  - XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2
    before 2.9.4, when not in validating mode, allows context-dependent attackers to read arbitrary files or
    cause a denial of service (resource consumption) via unspecified vectors. (CVE-2016-4449)

  - The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to
    cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value,
    related to serialization. NOTE: this vulnerability may be a duplicate of CVE-2016-3627. (CVE-2016-4483)

  - Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82,
    allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors
    related to the XPointer range-to function. (CVE-2016-5131)

  - libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag
    directly indicating that the current document may be read but other files may not be opened, which makes
    it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.
    (CVE-2016-9318)

  - A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file
    to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due
    to the possibility of remote code execution in an application that uses this library. Product: Android.
    Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170. (CVE-2017-0663)

  - parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the
    xmlParserHandlePEReference function in the case of a '%' character in a DTD name. (CVE-2017-16931)

  - parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
    (CVE-2017-16932)

  - libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL
    pointer dereference) via a crafted XML document. NOTE: The maintainer states I would disagree of a CVE
    with the Recover parsing option which should only be used for manual recovery at least for XML parser.
    (CVE-2017-5969)

  - The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of
    service (buffer over-read) or information disclosure. (CVE-2017-8872)

  - A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function
    xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a
    char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is
    XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits)
    whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name
    actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write
    about size many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2,
    such as PHP, to crash. (CVE-2017-9047)

  - libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function
    xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a
    char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters
    without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use
    libxml2, such as PHP, to crash. (CVE-2017-9048)

  - libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the
    xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as
    PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.
    (CVE-2017-9049)

  - libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString
    function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This
    vulnerability exists because of an incomplete fix for CVE-2016-1839. (CVE-2017-9050)

  - A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2
    through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case.
    Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable
    to a denial of service attack due to a crash of the application. (CVE-2018-14404)

  - xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to
    newDoc->oldNs. (CVE-2019-19956)

  - GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at
    libxml2/entities.c. The issue has been fixed in commit 50f06b3e. (CVE-2020-24977)

  - xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file
    situation. (CVE-2020-7595)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package
is installed.");
  script_set_attribute(attribute:"solution", value:
"The vendor has acknowledged the vulnerabilities but no solution has been provided. Refer to the vendor for remediation
guidance.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-4658");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2017-7375");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/03/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/05/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libxml2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mingw-libxml2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mingw-virt-viewer");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Red Hat Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl", "redhat_repos.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm.inc');
include('rhel.inc');

if (!get_kb_item("global_settings/vendor_unpatched"))
exit(0, "Unpatched Vulnerabilities Detection not active.");

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/RedHat/release');
if (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');
var os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');
os_ver = os_ver[1];
if (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '5')) audit(AUDIT_OS_NOT, 'Red Hat 5.x', 'Red Hat ' + os_ver);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);

var constraints = [
  {
    'pkgs': [
      {'reference':'libxml2', 'release':'5', 'rpm_spec_vers_cmp':TRUE, 'unpatched_pkg':'libxml2'}
    ]
  }
];


var flag = 0;
foreach var constraint_array ( constraints ) {
  var repo_relative_urls = NULL;
  var enterprise_linux_flag = rhel_repo_urls_has_content_dist_rhel(repo_urls:repo_relative_urls);
  foreach var pkg ( constraint_array['pkgs'] ) {
    var unpatched_pkg = NULL;
    var _release = NULL;
    var sp = NULL;
    var el_string = NULL;
    var rpm_spec_vers_cmp = NULL;
    var exists_check = NULL;
    var cves = NULL;
    if (!empty_or_null(pkg['unpatched_pkg'])) unpatched_pkg = pkg['unpatched_pkg'];
    if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (unpatched_pkg &&
        _release &&
        (!exists_check || rpm_exists(release:_release, rpm:exists_check)) &&
        unpatched_package_exists(release:_release, package:unpatched_pkg, cves: cves)) flag++;
  }
}

if (flag)
{
  var extra = NULL;
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : unpatched_packages_report()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libxml2');
}