Vulnerabilities > CVE-2005-3011 - Link Following vulnerability in GNU Texinfo 4.8

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Red Hat Security Advisory RHSA-2006:0727 and 
# CentOS Errata and Security Advisory 2006:0727 respectively.
#

include("compat.inc");

if (description)
{
  script_id(37714);
  script_version("1.13");
  script_cvs_date("Date: 2019/10/25 13:36:03");

  script_cve_id("CVE-2005-3011", "CVE-2006-4810");
  script_bugtraq_id(14854, 20959);
  script_xref(name:"RHSA", value:"2006:0727");

  script_name(english:"CentOS 3 / 4 : texinfo (CESA-2006:0727)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote CentOS host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"New Texinfo packages that fix various security vulnerabilities are now
available.

This update has been rated as having moderate security impact by the
Red Hat Security Response Team.

Texinfo is a documentation system that can produce both online
information and printed output from a single source file.

A buffer overflow flaw was found in Texinfo's texindex command. An
attacker could construct a carefully crafted Texinfo file that could
cause texindex to crash or possibly execute arbitrary code when
opened. (CVE-2006-4810)

A flaw was found in the way Texinfo's texindex command creates
temporary files. A local user could leverage this flaw to overwrite
files the user executing texindex has write access to. (CVE-2005-3011)

Users of Texinfo should upgrade to these updated packages which
contain backported patches and are not vulnerable to these issues."
  );
  # https://lists.centos.org/pipermail/centos-announce/2006-November/013356.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?f91cdb2f"
  );
  # https://lists.centos.org/pipermail/centos-announce/2006-November/013372.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?44952730"
  );
  # https://lists.centos.org/pipermail/centos-announce/2006-November/013373.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?cec4dedf"
  );
  # https://lists.centos.org/pipermail/centos-announce/2006-November/013385.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?db022d1e"
  );
  # https://lists.centos.org/pipermail/centos-announce/2006-November/013386.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?8813b5bb"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected texinfo packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:info");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:texinfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:4");

  script_set_attribute(attribute:"vuln_publication_date", value:"2005/09/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2006/11/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/04/23");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"CentOS Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/CentOS/release");
if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS");
os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS");
os_ver = os_ver[1];
if (! preg(pattern:"^(3|4)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 3.x / 4.x", "CentOS " + os_ver);

if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && "ia64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu);


flag = 0;
if (rpm_check(release:"CentOS-3", reference:"info-4.5-3.el3.1")) flag++;
if (rpm_check(release:"CentOS-3", reference:"texinfo-4.5-3.el3.1")) flag++;

if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"info-4.7-5.el4.2")) flag++;
if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"info-4.7-5.el4.2")) flag++;
if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"texinfo-4.7-5.el4.2")) flag++;
if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"texinfo-4.7-5.el4.2")) flag++;


if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "info / texinfo");
}

#%NASL_MIN_LEVEL 80502

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2006-1203.
#

if (NASL_LEVEL < 3000) exit(0);

include("compat.inc");

if (description)
{
  script_id(24049);
  script_version ("1.14");
  script_cvs_date("Date: 2019/08/02 13:32:24");

  script_xref(name:"FEDORA", value:"2006-1203");

  script_name(english:"Fedora Core 6 : texinfo-4.8-14.fc6 (2006-1203)");
  script_summary(english:"Checks rpm output for the updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora Core host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"  - Sun Nov 5 2006 Miloslav Trmac <mitr at redhat.com> -
    4.8-14

    - Remove off-line sorting from texindex (fixes
      CVE-2006-4810)

    - Mon Oct 9 2006 Miloslav Trmac <mitr at redhat.com> -
      4.8-13

    - Don't use mode 0666 for the texindex temporary files

    - Mon Oct 9 2006 Miloslav Trmac <mitr at redhat.com> -
      4.8-12

    - Don't leave around temporary files used by texindex

    - Add missing error handling to
      texinfo-CVE-2005-3011.patch

    - Wed Jul 12 2006 Jesse Keating <jkeating at redhat.com>
      - 4.8-11.1

    - rebuild

    - Sat Mar 25 2006 Miloslav Trmac <mitr at redhat.com> -
      4.8-11

    - Split texinfo-tex from the texinfo package (#178406)

    - Ship COPYING, don't ship INSTALL

    - Sun Mar 19 2006 Miloslav Trmac <mitr at redhat.com> -
      4.8-10

    - Remove incorrect Prefix :

    - Drop info/README

    - Convert change log to UTF-8

    - Fri Feb 10 2006 Jesse Keating <jkeating at redhat.com>
      - 4.8-9.2

    - bump again for double-long bug on ppc(64)

    - Tue Feb 7 2006 Jesse Keating <jkeating at redhat.com>
      - 4.8-9.1

    - rebuilt for new gcc4.1 snapshot and glibc changes

    - Mon Jan 16 2006 Miloslav Trmac <mitr at redhat.com> -
      4.8-9

    - Fix handling of bzip2'ed files (#128637)

    - Mon Jan 16 2006 Miloslav Trmac <mitr at redhat.com> -
      4.8-8

    - Ignore scriptlet failures with --excludedocs (#166958)

    - Don't link texindex to zlib, don't pretend to link to
      zlib statically

    - Fri Dec 9 2005 Jesse Keating <jkeating at redhat.com>

    - rebuilt

    - Fri Oct 14 2005 Tim Waugh <twaugh at redhat.com> 4.8-7

    - Apply patch to fix CVE-2005-3011 (bug #169585).

    - Thu Jun 9 2005 Tim Waugh <twaugh at redhat.com> 4.8-6

    - Ship texi2pdf man page, taken from tetex-2.0.2 RPM.

    - Tue Jun 7 2005 Tim Waugh <twaugh at redhat.com> 4.8-5

    - Ship texi2pdf (bug #147271).

    - Mon Mar 14 2005 Tim Waugh <twaugh at redhat.com> 4.8-4

    - Requires tetex (bug #151075).

    - Wed Mar 2 2005 Tim Waugh <twaugh at redhat.com> 4.8-3

    - Rebuild for new GCC.

    - Mon Feb 7 2005 Tim Waugh <twaugh at redhat.com> 4.8-2

    - Don't ship texi2pdf (bug #147271).

    - Thu Feb 3 2005 Tim Waugh <twaugh at redhat.com> 4.8-1

    - 4.8.

    - Thu Dec 30 2004 Tim Waugh <twaugh at redhat.com> 4.7-6

    - Fixed URL (bug #143729).

    - Thu Aug 12 2004 Tim Waugh <twaugh at redhat.com> 4.7-5

    - Rebuilt.

    - Wed Jul 7 2004 Tim Waugh <twaugh at redhat.com> 4.7-4

    - Build for FC2.

    - Tue Jun 29 2004 Tim Waugh <twaugh at redhat.com> 4.7-3

    - Fix grouping in user-defined macros.

    - Mon Jun 28 2004 Tim Waugh <twaugh at redhat.com> 4.7-2

[plus 162 lines in the Changelog]

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2006-November/000852.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?fb19d12c"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:info");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:texinfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:texinfo-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:texinfo-tex");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora_core:6");

  script_set_attribute(attribute:"patch_publication_date", value:"2006/11/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2007/01/17");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2007-2019 Tenable Network Security, Inc.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 6.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC6", reference:"info-4.8-14.fc6")) flag++;
if (rpm_check(release:"FC6", reference:"texinfo-4.8-14.fc6")) flag++;
if (rpm_check(release:"FC6", reference:"texinfo-debuginfo-4.8-14.fc6")) flag++;
if (rpm_check(release:"FC6", reference:"texinfo-tex-4.8-14.fc6")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "info / texinfo / texinfo-debuginfo / texinfo-tex");
}

#%NASL_MIN_LEVEL 80502

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2005-991.
#

include("compat.inc");

if (description)
{
  script_id(20026);
  script_version ("1.14");
  script_cvs_date("Date: 2019/08/02 13:32:24");

  script_xref(name:"FEDORA", value:"2005-991");

  script_name(english:"Fedora Core 4 : texinfo-4.8-4.1 (2005-991)");
  script_summary(english:"Checks rpm output for the updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora Core host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This package fixes a temporary file name vulnerability in the texindex
program (CVE-2005-3011).

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  # https://lists.fedoraproject.org/pipermail/announce/2005-October/001484.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?e5d1efbd"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected info, texinfo and / or texinfo-debuginfo packages."
  );
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:info");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:texinfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:texinfo-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora_core:4");

  script_set_attribute(attribute:"patch_publication_date", value:"2005/10/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2005/10/19");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2005-2019 Tenable Network Security, Inc.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^4([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 4.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC4", reference:"info-4.8-4.1")) flag++;
if (rpm_check(release:"FC4", reference:"texinfo-4.8-4.1")) flag++;
if (rpm_check(release:"FC4", reference:"texinfo-debuginfo-4.8-4.1")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "info / texinfo / texinfo-debuginfo");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 200510-04.
#
# The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike 
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#

include("compat.inc");

if (description)
{
  script_id(19974);
  script_version("1.17");
  script_cvs_date("Date: 2019/08/02 13:32:42");

  script_cve_id("CVE-2005-3011");
  script_bugtraq_id(14854);
  script_xref(name:"GLSA", value:"200510-04");

  script_name(english:"GLSA-200510-04 : Texinfo: Insecure temporary file creation");
  script_summary(english:"Checks for updated package(s) in /var/db/pkg");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Gentoo host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote host is affected by the vulnerability described in GLSA-200510-04
(Texinfo: Insecure temporary file creation)

    Frank Lichtenheld has discovered that the 'sort_offline()'
    function in texindex insecurely creates temporary files with
    predictable filenames.
  
Impact :

    A local attacker could create symbolic links in the temporary
    files directory, pointing to a valid file somewhere on the filesystem.
    When texindex is executed, this would result in the file being
    overwritten with the rights of the user running the application.
  
Workaround :

    There is no known workaround at this time."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security.gentoo.org/glsa/200510-04"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"All Texinfo users should upgrade to the latest version:
    # emerge --sync
    # emerge --ask --oneshot --verbose '>=sys-apps/texinfo-4.8-r1'"
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:texinfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2005/10/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2005/10/11");
  script_set_attribute(attribute:"vuln_publication_date", value:"2005/09/14");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2005-2019 Tenable Network Security, Inc.");
  script_family(english:"Gentoo Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("qpkg.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (qpkg_check(package:"sys-apps/texinfo", unaffected:make_list("ge 4.8-r1"), vulnerable:make_list("lt 4.8-r1"))) flag++;

if (flag)
{
  if (report_verbosity > 0) security_note(port:0, extra:qpkg_report_get());
  else security_note(0);
  exit(0);
}
else
{
  tested = qpkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Texinfo");
}