8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.8 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
49.2%
The version of libcue installed on the remote host is prior to 2.2.1. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-283-01 advisory.
~/Downloads
, it is then automatically scanned by tracker-miners. And because it has a .cue filename extension, tracker-miners use libcue to parse the file. The file exploits the vulnerability in libcue to gain code execution.Note that Nessus has not tested for this issue but has instead relied only on the application’s self-reported version number.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
#
# The descriptive text and package checks in this plugin were
# extracted from Slackware Security Advisory SSA:2023-283-01. The text
# itself is copyright (C) Slackware Linux, Inc.
##
include('compat.inc');
if (description)
{
script_id(182871);
script_version("1.1");
script_set_attribute(attribute:"plugin_modification_date", value:"2023/10/30");
script_cve_id("CVE-2023-43641");
script_name(english:"Slackware Linux 15.0 / current libcue Vulnerability (SSA:2023-283-01)");
script_set_attribute(attribute:"synopsis", value:
"The remote Slackware Linux host is missing a security update to libcue.");
script_set_attribute(attribute:"description", value:
"The version of libcue installed on the remote host is prior to 2.2.1. It is, therefore, affected by a vulnerability as
referenced in the SSA:2023-283-01 advisory.
- libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are
vulnerable to out-of-bounds array access. A user of the GNOME desktop environment can be exploited by
downloading a cue sheet from a malicious webpage. Because the file is saved to `~/Downloads`, it is then
automatically scanned by tracker-miners. And because it has a .cue filename extension, tracker-miners use
libcue to parse the file. The file exploits the vulnerability in libcue to gain code execution.
(CVE-2023-43641)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
# http://www.slackware.com/security/viewer.php?l=slackware-security&y=2023&m=slackware-security.339569
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?baf81b83");
script_set_attribute(attribute:"solution", value:
"Upgrade the affected libcue package.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-43641");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2023/10/09");
script_set_attribute(attribute:"patch_publication_date", value:"2023/10/10");
script_set_attribute(attribute:"plugin_publication_date", value:"2023/10/10");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:slackware:slackware_linux:libcue");
script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux");
script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:15.0");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Slackware Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/Slackware/release", "Host/Slackware/packages");
exit(0);
}
include("slackware.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Slackware/release")) audit(AUDIT_OS_NOT, "Slackware");
if (!get_kb_item("Host/Slackware/packages")) audit(AUDIT_PACKAGE_LIST_MISSING);
var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Slackware", cpu);
var flag = 0;
var constraints = [
{ 'fixed_version' : '2.2.1', 'product' : 'libcue', 'os_name' : 'Slackware Linux', 'os_version' : '15.0', 'service_pack' : '4_slack15.0', 'arch' : 'i586' },
{ 'fixed_version' : '2.2.1', 'product' : 'libcue', 'os_name' : 'Slackware Linux', 'os_version' : '15.0', 'service_pack' : '4_slack15.0', 'arch' : 'x86_64' },
{ 'fixed_version' : '2.2.1', 'product' : 'libcue', 'os_name' : 'Slackware Linux', 'os_version' : 'current', 'service_pack' : '4', 'arch' : 'i586' },
{ 'fixed_version' : '2.2.1', 'product' : 'libcue', 'os_name' : 'Slackware Linux', 'os_version' : 'current', 'service_pack' : '4', 'arch' : 'x86_64' }
];
foreach var constraint (constraints) {
var pkg_arch = constraint['arch'];
var arch = NULL;
if (pkg_arch == "x86_64") {
arch = pkg_arch;
}
if (slackware_check(osver:constraint['os_version'],
arch:arch,
pkgname:constraint['product'],
pkgver:constraint['fixed_version'],
pkgarch:pkg_arch,
pkgnum:constraint['service_pack'])) flag++;
}
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : slackware_report_get()
);
exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");
Vendor | Product | Version | CPE |
---|---|---|---|
slackware | slackware_linux | libcue | p-cpe:/a:slackware:slackware_linux:libcue |
slackware | slackware_linux | cpe:/o:slackware:slackware_linux | |
slackware | slackware_linux | 15.0 | cpe:/o:slackware:slackware_linux:15.0 |
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.8 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
49.2%