Vulnerabilities > CVE-2014-1236 - Buffer Errors vulnerability in Graphviz 2.34.0

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 201702-06.
#
# The advisory text is Copyright (C) 2001-2018 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike 
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#

include("compat.inc");

if (description)
{
  script_id(97112);
  script_version("$Revision: 3.2 $");
  script_cvs_date("$Date: 2018/01/26 17:15:57 $");

  script_cve_id("CVE-2014-0978", "CVE-2014-1235", "CVE-2014-1236");
  script_xref(name:"GLSA", value:"201702-06");

  script_name(english:"GLSA-201702-06 : Graphviz: Multiple vulnerabilities");
  script_summary(english:"Checks for updated package(s) in /var/db/pkg");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Gentoo host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote host is affected by the vulnerability described in GLSA-201702-06
(Graphviz: Multiple vulnerabilities)

    Multiple vulnerabilities in Graphviz were discovered. Please review the
      CVE identifiers referenced below for details.
  
Impact :

    A remote attacker, able to control input matched against a regular
      expression or by enticing a user to process a specially crafted file,
      could cause unspecified impacts.
  
Workaround :

    There is no known workaround at this time."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security.gentoo.org/glsa/201702-06"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"All Graphviz users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=media-gfx/graphviz-2.36.0'"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:graphviz");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2017/02/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/02/13");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2017-2018 Tenable Network Security, Inc.");
  script_family(english:"Gentoo Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("qpkg.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (qpkg_check(package:"media-gfx/graphviz", unaffected:make_list("ge 2.36.0"), vulnerable:make_list("lt 2.36.0"))) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = qpkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Graphviz");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-2843. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(71934);
  script_version("1.9");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");

  script_cve_id("CVE-2014-0978", "CVE-2014-1236");
  script_bugtraq_id(64674, 64737);
  script_xref(name:"DSA", value:"2843");

  script_name(english:"Debian DSA-2843-1 : graphviz - buffer overflow");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Two buffer overflow vulnerabilities were reported in Graphviz, a rich
collection of graph drawing tools. The Common Vulnerabilities and
Exposures project identifies the following issues :

  - CVE-2014-0978
    It was discovered that user-supplied input used in the
    yyerror() function in lib/cgraph/scan.l is not
    bound-checked before beeing copied into an
    insufficiently sized memory buffer. A context-dependent
    attacker could supply a specially crafted input file
    containing a long line to cause a stack-based buffer
    overlow, resulting in a denial of service (application
    crash) or potentially allowing the execution of
    arbitrary code.

  - CVE-2014-1236
    Sebastian Krahmer reported an overflow condition in the
    chkNum() function in lib/cgraph/scan.l that is triggered
    as the used regular expression accepts an arbitrary long
    digit list. With a specially crafted input file, a
    context-dependent attacker can cause a stack-based
    buffer overflow, resulting in a denial of service
    (application crash) or potentially allowing the
    execution of arbitrary code."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734745"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2014-0978"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2014-1236"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://packages.debian.org/source/squeeze/graphviz"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://packages.debian.org/source/wheezy/graphviz"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.debian.org/security/2014/dsa-2843"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade the graphviz packages.

For the oldstable distribution (squeeze), these problems have been
fixed in version 2.26.3-5+squeeze2.

For the stable distribution (wheezy), these problems have been fixed
in version 2.26.3-14+deb7u1."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:graphviz");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:6.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:7.0");

  script_set_attribute(attribute:"patch_publication_date", value:"2014/01/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/01/14");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"6.0", prefix:"graphviz", reference:"2.26.3-5+squeeze2")) flag++;
if (deb_check(release:"6.0", prefix:"graphviz-dev", reference:"2.26.3-5+squeeze2")) flag++;
if (deb_check(release:"6.0", prefix:"graphviz-doc", reference:"2.26.3-5+squeeze2")) flag++;
if (deb_check(release:"6.0", prefix:"libcdt4", reference:"2.26.3-5+squeeze2")) flag++;
if (deb_check(release:"6.0", prefix:"libcgraph5", reference:"2.26.3-5+squeeze2")) flag++;
if (deb_check(release:"6.0", prefix:"libgraph4", reference:"2.26.3-5+squeeze2")) flag++;
if (deb_check(release:"6.0", prefix:"libgraphviz-dev", reference:"2.26.3-5+squeeze2")) flag++;
if (deb_check(release:"6.0", prefix:"libgv-guile", reference:"2.26.3-5+squeeze2")) flag++;
if (deb_check(release:"6.0", prefix:"libgv-lua", reference:"2.26.3-5+squeeze2")) flag++;
if (deb_check(release:"6.0", prefix:"libgv-ocaml", reference:"2.26.3-5+squeeze2")) flag++;
if (deb_check(release:"6.0", prefix:"libgv-perl", reference:"2.26.3-5+squeeze2")) flag++;
if (deb_check(release:"6.0", prefix:"libgv-php5", reference:"2.26.3-5+squeeze2")) flag++;
if (deb_check(release:"6.0", prefix:"libgv-python", reference:"2.26.3-5+squeeze2")) flag++;
if (deb_check(release:"6.0", prefix:"libgv-ruby", reference:"2.26.3-5+squeeze2")) flag++;
if (deb_check(release:"6.0", prefix:"libgv-tcl", reference:"2.26.3-5+squeeze2")) flag++;
if (deb_check(release:"6.0", prefix:"libgvc5", reference:"2.26.3-5+squeeze2")) flag++;
if (deb_check(release:"6.0", prefix:"libgvc5-plugins-gtk", reference:"2.26.3-5+squeeze2")) flag++;
if (deb_check(release:"6.0", prefix:"libgvpr1", reference:"2.26.3-5+squeeze2")) flag++;
if (deb_check(release:"6.0", prefix:"libpathplan4", reference:"2.26.3-5+squeeze2")) flag++;
if (deb_check(release:"6.0", prefix:"libxdot4", reference:"2.26.3-5+squeeze2")) flag++;
if (deb_check(release:"7.0", prefix:"graphviz", reference:"2.26.3-14+deb7u1")) flag++;
if (deb_check(release:"7.0", prefix:"graphviz-dev", reference:"2.26.3-14+deb7u1")) flag++;
if (deb_check(release:"7.0", prefix:"graphviz-doc", reference:"2.26.3-14+deb7u1")) flag++;
if (deb_check(release:"7.0", prefix:"libcdt4", reference:"2.26.3-14+deb7u1")) flag++;
if (deb_check(release:"7.0", prefix:"libcgraph5", reference:"2.26.3-14+deb7u1")) flag++;
if (deb_check(release:"7.0", prefix:"libgraph4", reference:"2.26.3-14+deb7u1")) flag++;
if (deb_check(release:"7.0", prefix:"libgraphviz-dev", reference:"2.26.3-14+deb7u1")) flag++;
if (deb_check(release:"7.0", prefix:"libgv-guile", reference:"2.26.3-14+deb7u1")) flag++;
if (deb_check(release:"7.0", prefix:"libgv-lua", reference:"2.26.3-14+deb7u1")) flag++;
if (deb_check(release:"7.0", prefix:"libgv-perl", reference:"2.26.3-14+deb7u1")) flag++;
if (deb_check(release:"7.0", prefix:"libgv-php5", reference:"2.26.3-14+deb7u1")) flag++;
if (deb_check(release:"7.0", prefix:"libgv-python", reference:"2.26.3-14+deb7u1")) flag++;
if (deb_check(release:"7.0", prefix:"libgv-ruby", reference:"2.26.3-14+deb7u1")) flag++;
if (deb_check(release:"7.0", prefix:"libgv-tcl", reference:"2.26.3-14+deb7u1")) flag++;
if (deb_check(release:"7.0", prefix:"libgvc5", reference:"2.26.3-14+deb7u1")) flag++;
if (deb_check(release:"7.0", prefix:"libgvc5-plugins-gtk", reference:"2.26.3-14+deb7u1")) flag++;
if (deb_check(release:"7.0", prefix:"libgvpr1", reference:"2.26.3-14+deb7u1")) flag++;
if (deb_check(release:"7.0", prefix:"libpathplan4", reference:"2.26.3-14+deb7u1")) flag++;
if (deb_check(release:"7.0", prefix:"libxdot4", reference:"2.26.3-14+deb7u1")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2014-0602.
#

include("compat.inc");

if (description)
{
  script_id(72441);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");

  script_cve_id("CVE-2014-0978", "CVE-2014-1235", "CVE-2014-1236");
  script_bugtraq_id(64674, 64736, 64737);
  script_xref(name:"FEDORA", value:"2014-0602");

  script_name(english:"Fedora 20 : graphviz-2.34.0-8.fc20 (2014-0602)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This is an update fixing CVE-2014-1235 and CVE-2014-1236. This is an
update that fixes overflow in yyerror.

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=1049165"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=1050871"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=1050872"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2014-February/128085.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?bae5472d"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected graphviz package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:graphviz");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:20");

  script_set_attribute(attribute:"patch_publication_date", value:"2014/01/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/02/12");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2014-2020 Tenable Network Security, Inc.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^20([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 20.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC20", reference:"graphviz-2.34.0-8.fc20")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "graphviz");
}

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux AMI Security Advisory ALAS-2014-297.
#

include("compat.inc");

if (description)
{
  script_id(72945);
  script_version("1.5");
  script_cvs_date("Date: 2018/04/18 15:09:35");

  script_cve_id("CVE-2014-0978", "CVE-2014-1235", "CVE-2014-1236");
  script_xref(name:"ALAS", value:"2014-297");

  script_name(english:"Amazon Linux AMI : graphviz-php (ALAS-2014-297)");
  script_summary(english:"Checks rpm output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Amazon Linux AMI host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Stack-based buffer overflow in the chkNum function in
lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have
unspecified impact via vectors related to a 'badly formed number' and
a 'long digit list.'

Stack-based buffer overflow in the yyerror function in
lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have
unspecified impact via a long line in a dot file.

Graphviz was recently reported to be affected by a buffer overflow
vulnerability, which seem to have introduced in the fix for
CVE-2014-0978 ."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://alas.aws.amazon.com/ALAS-2014-297.html"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Run 'yum update graphviz-php' to update your system."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:graphviz-php");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2014/03/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/03/12");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2014-2018 Tenable Network Security, Inc.");
  script_family(english:"Amazon Linux Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item("Host/AmazonLinux/release");
if (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, "Amazon Linux");
os_ver = pregmatch(pattern: "^AL(A|\d)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "A")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux AMI", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (rpm_check(release:"ALA", reference:"graphviz-php-2.30.1-12.37.amzn1")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "graphviz-php");
}