Vulnerabilities > CVE-2016-9594 - Improper Initialization vulnerability in Haxx Curl

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 201701-47.
#
# The advisory text is Copyright (C) 2001-2017 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike 
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#

include("compat.inc");

if (description)
{
  script_id(96644);
  script_version("$Revision: 3.1 $");
  script_cvs_date("$Date: 2017/01/20 15:01:13 $");

  script_cve_id("CVE-2014-8150", "CVE-2014-8151", "CVE-2016-0755", "CVE-2016-3739", "CVE-2016-5419", "CVE-2016-5420", "CVE-2016-5421", "CVE-2016-7141", "CVE-2016-7167", "CVE-2016-8615", "CVE-2016-8616", "CVE-2016-8617", "CVE-2016-8618", "CVE-2016-8619", "CVE-2016-8620", "CVE-2016-8621", "CVE-2016-8622", "CVE-2016-8623", "CVE-2016-8624", "CVE-2016-8625", "CVE-2016-9586", "CVE-2016-9594");
  script_xref(name:"GLSA", value:"201701-47");

  script_name(english:"GLSA-201701-47 : cURL: Multiple vulnerabilities");
  script_summary(english:"Checks for updated package(s) in /var/db/pkg");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Gentoo host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote host is affected by the vulnerability described in GLSA-201701-47
(cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the
      CVE identifiers and bug reports referenced for details.
  
Impact :

    Remote attackers could conduct a Man-in-the-Middle attack to obtain
      sensitive information, cause a Denial of Service condition, or execute
      arbitrary code.
  
Workaround :

    There is no known workaround at this time."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security.gentoo.org/glsa/201701-47"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"All cURL users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=net-misc/curl-7.52.1'"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:curl");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2017/01/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/01/20");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2017 Tenable Network Security, Inc.");
  script_family(english:"Gentoo Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("qpkg.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (qpkg_check(package:"net-misc/curl", unaffected:make_list("ge 7.52.1"), vulnerable:make_list("lt 7.52.1"))) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = qpkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "cURL");
}

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from the FreeBSD VuXML database :
#
# Copyright 2003-2018 Jacques Vidrine and contributors
#
# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
# HTML, PDF, PostScript, RTF and so forth) with or without modification,
# are permitted provided that the following conditions are met:
# 1. Redistributions of source code (VuXML) must retain the above
#    copyright notice, this list of conditions and the following
#    disclaimer as the first lines of this file unmodified.
# 2. Redistributions in compiled form (transformed to other DTDs,
#    published online in any format, converted to PDF, PostScript,
#    RTF and other formats) must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer
#    in the documentation and/or other materials provided with the
#    distribution.
# 
# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#

include("compat.inc");

if (description)
{
  script_id(96120);
  script_version("3.5");
  script_cvs_date("Date: 2018/12/19 13:21:18");

  script_cve_id("CVE-2016-9594");

  script_name(english:"FreeBSD : cURL -- uninitialized random vulnerability (c40ca16c-4d9f-4d70-8b6c-4d53aeb8ead4)");
  script_summary(english:"Checks for updated package in pkg_info output");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote FreeBSD host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Project curl Security Advisory :

libcurl's (new) internal function that returns a good 32bit random
value was implemented poorly and overwrote the pointer instead of
writing the value into the buffer the pointer pointed to.

This random value is used to generate nonces for Digest and NTLM
authentication, for generating boundary strings in HTTP formposts and
more. Having a weak or virtually non-existent random there makes these
operations vulnerable.

This function is brand new in 7.52.0 and is the result of an overhaul
to make sure libcurl uses strong random as much as possible - provided
by the backend TLS crypto libraries when present. The faulty function
was introduced in this commit.

We are not aware of any exploit of this flaw."
  );
  # https://curl.haxx.se/docs/adv_20161223.html
  script_set_attribute(
    attribute:"see_also",
    value:"https://curl.haxx.se/docs/CVE-2016-9594.html"
  );
  # https://vuxml.freebsd.org/freebsd/c40ca16c-4d9f-4d70-8b6c-4d53aeb8ead4.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?eef2180d"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:curl");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/12/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/12/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/12/27");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"FreeBSD Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");

  exit(0);
}


include("audit.inc");
include("freebsd_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (pkg_test(save_report:TRUE, pkg:"curl>=7.52.0<7.52.1")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(97726);
  script_version("1.12");
  script_cvs_date("Date: 2019/03/27 13:17:50");

  script_cve_id(
    "CVE-2016-0736",
    "CVE-2016-2161",
    "CVE-2016-5387",
    "CVE-2016-7055",
    "CVE-2016-8740",
    "CVE-2016-8743",
    "CVE-2016-9594",
    "CVE-2016-10158",
    "CVE-2016-10159",
    "CVE-2016-10160",
    "CVE-2016-10161",
    "CVE-2016-10167",
    "CVE-2016-1000102",
    "CVE-2016-1000104",
    "CVE-2017-3731",
    "CVE-2017-3732"
);
  script_bugtraq_id(
    91816,
    91822,
    94242,
    94650,
    95076,
    95077,
    95078,
    95094,
    95764,
    95768,
    95774,
    95783,
    95813,
    95814,
    95869
  );
  script_xref(name:"CERT", value:"797896");
  script_xref(name:"EDB-ID", value:"40961");

  script_name(english:"Tenable SecurityCenter 5.x < 5.4.3 Multiple Vulnerabilities (TNS-2017-04) (httpoxy)");
  script_summary(english:"Checks the SecurityCenter version.");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote host is affected by multiple
vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its version, the installation of Tenable SecurityCenter
on the remote host is affected by multiple vulnerabilities :

  - A flaw exists in the mod_session_crypto module due to
    encryption for data and cookies using the configured
    ciphers with possibly either CBC or ECB modes of
    operation (AES256-CBC by default). An unauthenticated,
    remote attacker can exploit this, via a padding oracle
    attack, to decrypt information without knowledge of the
    encryption key, resulting in the disclosure of
    potentially sensitive information. (CVE-2016-0736)

  - A denial of service vulnerability exists in the
    mod_auth_digest module during client entry allocation.
    An unauthenticated, remote attacker can exploit this,
    via specially crafted input, to exhaust shared memory
    resources, resulting in a server crash. (CVE-2016-2161)

  - The Apache HTTP Server is affected by a
    man-in-the-middle vulnerability known as 'httpoxy' due
    to a failure to properly resolve namespace conflicts in
    accordance with RFC 3875 section 4.1.18. The HTTP_PROXY
    environment variable is set based on untrusted user data
    in the 'Proxy' header of HTTP requests. The HTTP_PROXY
    environment variable is used by some web client
    libraries to specify a remote proxy server. An
    unauthenticated, remote attacker can exploit this, via a
    crafted 'Proxy' header in an HTTP request, to redirect
    an application's internal HTTP traffic to an arbitrary
    proxy server where it may be observed or manipulated.
    (CVE-2016-5387, CVE-2016-1000102, CVE-2016-1000104)

  - A carry propagation error exists in the
    Broadwell-specific Montgomery multiplication procedure
    when handling input lengths divisible by but longer than
    256 bits. This can result in transient authentication
    and key negotiation failures or reproducible erroneous
    outcomes of public-key operations with specially crafted
    input. A man-in-the-middle attacker can possibly exploit
    this issue to compromise ECDH key negotiations that
    utilize Brainpool P-512 curves. (CVE-2016-7055)

  - A denial of service vulnerability exists in the
    mod_http2 module due to improper handling of the
    LimitRequestFields directive. An unauthenticated, remote
    attacker can exploit this, via specially crafted
    CONTINUATION frames in an HTTP/2 request, to inject
    unlimited request headers into the server, resulting in
    the exhaustion of memory resources. (CVE-2016-8740)

  - A flaw exists due to improper handling of whitespace
    patterns in user-agent headers. An unauthenticated,
    remote attacker can exploit this, via a specially
    crafted user-agent header, to cause the program to
    incorrectly process sequences of requests, resulting in
    interpreting responses incorrectly, polluting the cache,
    or disclosing the content from one request to a second
    downstream user-agent. (CVE-2016-8743)

  - A flaw exits in libcurl in the randit() function within
    file lib/rand.c due to improper initialization of the
    32-bit random value, which is used, for example, to
    generate Digest and NTLM authentication nonces,
    resulting in weaker cryptographic operations than
    expected. (CVE-2016-9594)

  - A floating pointer exception flaw exists in the
    exif_convert_any_to_int() function in exif.c that is
    triggered when handling TIFF and JPEG image tags. An
    unauthenticated, remote attacker can exploit this to
    cause a crash, resulting in a denial of service
    condition. (CVE-2016-10158)

  - An integer overflow condition exists in the
    phar_parse_pharfile() function in phar.c due to improper
    validation when handling phar archives. An
    unauthenticated, remote attacker can exploit this to
    cause a crash, resulting in a denial of service
    condition. (CVE-2016-10159)

  - An off-by-one overflow condition exists in the
    phar_parse_pharfile() function in phar.c due to improper
    parsing of phar archives. An unauthenticated, remote
    attacker can exploit this to cause a crash, resulting in
    a denial of service condition. (CVE-2016-10160)

  - An out-of-bounds read error exists in the
    finish_nested_data() function in var_unserializer.c due
    to improper validation of unserialized data. An
    unauthenticated, remote attacker can exploit this to
    cause a crash, resulting in a denial of service
    condition or the disclosure of memory contents.
    (CVE-2016-10161)

  - A denial of service vulnerability exists in the
    gdImageCreateFromGd2Ctx() function within file gd_gd2.c
    in the GD Graphics Library (LibGD) when handling images
    claiming to contain more image data than they actually
    do. An unauthenticated, remote attacker can exploit this
    to crash a process linked against the library.
    (CVE-2016-10167)

  - An out-of-bounds read error exists when handling packets
    using the CHACHA20/POLY1305 or RC4-MD5 ciphers. An
    unauthenticated, remote attacker can exploit this, via
    specially crafted truncated packets, to cause a denial
    of service condition. (CVE-2017-3731)

  - A carry propagating error exists in the x86_64
    Montgomery squaring implementation that may cause the
    BN_mod_exp() function to produce incorrect results. An
    unauthenticated, remote attacker with sufficient
    resources can exploit this to obtain sensitive
    information regarding private keys. Note that this issue
    is very similar to CVE-2015-3193. Moreover, the attacker
    would additionally need online access to an unpatched
    system using the target private key in a scenario with
    persistent DH parameters and a private key that is
    shared between multiple clients. For example, this can
    occur by default in OpenSSL DHE based SSL/TLS cipher
    suites. (CVE-2017-3732)

  - An out-of-bounds read error exists in the
    phar_parse_pharfile() function in phar.c due to improper
    parsing of phar archives. An unauthenticated, remote
    attacker can exploit this to cause a crash, resulting in
    a denial of service condition.

  - Multiple stored cross-site scripting (XSS)
    vulnerabilities exist in unspecified scripts due to a
    failure to validate input before returning it to users.
    An authenticated, remote authenticated attacker can
    exploit these, via a specially crafted request, to
    execute arbitrary script code in a user's browser
    session.

Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.");
  script_set_attribute(attribute:"see_also", value:"https://www.tenable.com/security/tns-2017-04");
  script_set_attribute(attribute:"see_also", value:"https://httpoxy.org");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Tenable SecurityCenter version 5.4.3 or later.
Alternatively, apply the appropriate patch according to the vendor
advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"manual");
  script_set_attribute(attribute:"cvss_score_rationale", value:"Score based on analysis of the vendor advisory.");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");


  script_set_attribute(attribute:"vuln_publication_date", value:"2016/07/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/02/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/03/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:tenable:securitycenter");
  script_set_attribute(attribute:"in_the_news", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("securitycenter_installed.nbin", "securitycenter_detect.nbin");
  script_require_ports("Host/SecurityCenter/Version", "installed_sw/SecurityCenter");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("install_func.inc");
include("misc_func.inc");
include("install_func.inc");

version = get_kb_item("Host/SecurityCenter/Version");
port = 0;
if(empty_or_null(version))
{
  port = 443;
  install = get_single_install(app_name:"SecurityCenter", combined:TRUE, exit_if_unknown_ver:TRUE);
  version = install["version"];
}
fix = "5.4.3";

# Affects 5.0.2, 5.1.0, 5.2.0, 5.3.1, 5.3.2, 5.4.0, 5.4.1, 5.4.2
if ( version =~ "^5\.(0\.2|1\.0|2\.0|3\.[12]|4\.[0-2])([^0-9]|$)" )
{
  items = make_array(
    "Installed version", version,
    "Fixed version", fix
  );

  order = make_list("Installed version", "Fixed version");
  report = report_items_str(report_items:items, ordered_fields:order);

  security_report_v4(severity:SECURITY_WARNING, port:port, extra:report, xss:TRUE);
}
else
  audit(AUDIT_INST_VER_NOT_VULN, 'SecurityCenter', version);

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(101957);
  script_version("1.7");
  script_cvs_date("Date: 2019/11/12");

  script_cve_id(
    "CVE-2016-9586",
    "CVE-2016-9594",
    "CVE-2017-2629",
    "CVE-2017-7008",
    "CVE-2017-7009",
    "CVE-2017-7010",
    "CVE-2017-7013",
    "CVE-2017-7014",
    "CVE-2017-7015",
    "CVE-2017-7016",
    "CVE-2017-7017",
    "CVE-2017-7021",
    "CVE-2017-7022",
    "CVE-2017-7023",
    "CVE-2017-7024",
    "CVE-2017-7025",
    "CVE-2017-7026",
    "CVE-2017-7027",
    "CVE-2017-7028",
    "CVE-2017-7029",
    "CVE-2017-7031",
    "CVE-2017-7032",
    "CVE-2017-7033",
    "CVE-2017-7035",
    "CVE-2017-7036",
    "CVE-2017-7044",
    "CVE-2017-7045",
    "CVE-2017-7047",
    "CVE-2017-7050",
    "CVE-2017-7051",
    "CVE-2017-7054",
    "CVE-2017-7062",
    "CVE-2017-7067",
    "CVE-2017-7068",
    "CVE-2017-7069",
    "CVE-2017-7468",
    "CVE-2017-9417"
  );
  script_bugtraq_id(
    95019,
    95094,
    96382,
    97962,
    99482,
    99879,
    99880,
    99882,
    99883,
    99889
  );
  script_xref(name:"APPLE-SA", value:"APPLE-SA-2017-05-15-1");

  script_name(english:"macOS and Mac OS X Multiple Vulnerabilities (Security Update 2017-003)");
  script_summary(english:"Checks for the presence of Security Update 2017-003.");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a macOS or Mac OS X security update that
fixes multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote host is running Mac OS X 10.10.5, Mac OS X 10.11.6, or
macOS 10.12.5 and is missing a security update. It is therefore,
affected by multiple vulnerabilities :

  - An overflow condition exists in the curl component in
    the dprintf_formatf() function that is triggered when
    handling floating point conversion. An unauthenticated,
    remote attacker can exploit this to cause a denial of
    service condition or the execution of arbitrary code.
    (CVE-2016-9586)

  - A flaw exits in the curl component in the randit()
    function within file lib/rand.c due to improper
    initialization of the 32-bit random value, which is
    used, for example, to generate Digest and NTLM
    authentication nonces, resulting in weaker cryptographic
    operations than expected. (CVE-2016-9594)

  - A flaw exists in the curl component in the
    allocate_conn() function in lib/url.c when using the
    OCSP stapling feature for checking a X.509 certificate
    revocation status. The issue is triggered as the request
    option for OCSP stapling is not properly passed to the
    TLS library, resulting in no error being returned even
    when no proof of the validity of the certificate could
    be provided. A man-in-the-middle attacker can exploit
    this to provide a revoked certificate. (CVE-2017-2629)

  - A remote code execution vulnerability exists in the
    CoreAudio component due to improper validation of
    user-supplied input when handling movie files. An
    unauthenticated, remote attacker can exploit this, by
    convincing a user to play a specially crafted movie
    file, to cause a denial of service condition or the
    execution of arbitrary code. (CVE-2017-7008)

  - A memory corruption issue exists in the IOUSBFamily
    component due to improper validation of user-supplied
    input. A local attacker can exploit this, via a
    specially crafted application, to cause a denial of
    service condition or the execution of arbitrary code.
    (CVE-2017-7009)

  - Multiple out-of-bounds read errors exist in the libxml2
    component due to improper handling of specially crafted
    XML documents. An unauthenticated, remote attacker can
    exploit these to disclose user information.
    (CVE-2017-7010, CVE-2017-7013)

  - Multiple memory corruption issues exist in the Intel
    Graphics Driver component due to improper validation of
    input. A local attacker can exploit these issues to
    execute arbitrary code with elevated privileges.
    (CVE-2017-7014, CVE-2017-7017, CVE-2017-7035,
    CVE-2017-7044)

  - A remote code execution vulnerability exists in the
    Audio component due to improper validation of
    user-supplied input when handling audio files. An
    unauthenticated, remote attacker can exploit this, by
    convincing a user to play a specially crafted audio
    file, to execute arbitrary code. (CVE-2017-7015)

  - Multiple remote code execution vulnerabilities exist in
    the afclip component due to improper validation of
    user-supplied input when handling audio files. An
    unauthenticated, remote attacker can exploit these
    vulnerabilities, by convincing a user to play a
    specially crafted audio file, to execute arbitrary
    code. (CVE-2017-7016, CVE-2017-7033)

  - A memory corruption issue exists in the
    AppleGraphicsPowerManagement component due to improper
    validation of input. A local attacker can exploit this
    to cause a denial of service condition or the execution
    of arbitrary code with system privileges.
    (CVE-2017-7021)

  - Multiple memory corruption issues exist in the kernel
    due to improper validation of input. A local attacker
    can exploit these issues to cause a denial of service
    condition or the execution of arbitrary code with system
    privileges. (CVE-2017-7022, CVE-2017-7024,
    CVE-2017-7026)

  - Multiple memory corruption issues exist in the kernel
    due to improper validation of input. A local attacker
    can exploit these issues to cause a denial of service
    condition or the execution of arbitrary code with kernel
    privileges. (CVE-2017-7023, CVE-2017-7025,
    CVE-2017-7027, CVE-2017-7069)

  - Multiple unspecified flaws exist in the kernel due to a
    failure to properly sanitize input. A local attacker can
    exploit these issues, via a specially crafted
    application, to disclose restricted memory contents.
    (CVE-2017-7028, CVE-2017-7029, CVE-2017-7067)

  - A flaw exists in the Foundation component due to
    improper validation of input. A unauthenticated, remote
    attacker can exploit this, by convincing a user to open
    specially crafted file, to execute arbitrary code.
    (CVE-2017-7031)

  - A memory corruption issue exists in the 'kext tools'
    component due to improper validation of input. A local
    attacker can exploit this to execute arbitrary code with
    elevated privileges. (CVE-2017-7032)

  - Multiple unspecified flaws exist in the Intel Graphics
    Driver component due to a failure to properly sanitize
    input. A local attacker can exploit these issues, via a
    specially crafted application, to disclose restricted
    memory contents. (CVE-2017-7036, CVE-2017-7045)

  - A memory corruption issue exists in the libxpc component
    due to improper validation of input. A local attacker
    can exploit this issue, via a specifically crafted
    application, to cause a denial of service condition or
    the execution of arbitrary code with system privileges.
    (CVE-2017-7047)

  - Multiple memory corruption issues exist in the
    Bluetooth component due to improper validation of input.
    A local attacker can exploit these issues to execute
    arbitrary code with system privileges. (CVE-2017-7050,
    CVE-2017-7051)

  - A memory corruption issue exists in the Bluetooth
    component due to improper validation of input. A local
    attacker can exploit these issues to execute arbitrary
    code with system privileges. (CVE-2017-7054)

  - A buffer overflow condition exists in the Contacts
    component due to improper validation of user-supplied
    input. An unauthenticated, remote attacker can exploit
    this to cause a denial of service condition or the
    execution of arbitrary code. (CVE-2017-7062)

  - A buffer overflow condition exists in the libarchive
    component due to improper validation of user-supplied
    input. An unauthenticated, remote attacker can exploit
    this, via a specially crafted archive file, to cause a
    denial of service condition or the execution of
    arbitrary code. (CVE-2017-7068)

  - A certificate validation bypass vulnerability exists in
    the curl component due to the program attempting to
    resume TLS sessions even if the client certificate
    fails. An unauthenticated, remote attacker can exploit
    this to bypass validation mechanisms. (CVE-2017-7468)

  - A memory corruption issue exists in the Broadcom BCM43xx
    family Wi-Fi Chips component that allows an
    unauthenticated, remote attacker to execute arbitrary
    code. (CVE-2017-9417)");
  script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/HT207922");
  script_set_attribute(attribute:"see_also", value:"http://seclists.org/fulldisclosure/2017/May/47");
  script_set_attribute(attribute:"solution", value:
"Install Security Update 2017-003 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-7069");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/07/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/07/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/07/25");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:macos");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/MacOSX/Version", "Host/MacOSX/packages/boms");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");

# Compare 2 patch numbers to determine if patch requirements are satisfied.
# Return true if this patch or a later patch is applied
# Return false otherwise
function check_patch(year, number)
{
  local_var p_split = split(patch, sep:"-");
  local_var p_year  = int( p_split[0]);
  local_var p_num   = int( p_split[1]);

  if (year >  p_year) return TRUE;
  else if (year <  p_year) return FALSE;
  else if (number >=  p_num) return TRUE;
  else return FALSE;
}

get_kb_item_or_exit("Host/local_checks_enabled");
os = get_kb_item_or_exit("Host/MacOSX/Version");

if (!preg(pattern:"Mac OS X 10\.(10\.5|11\.6|12\.5)([^0-9]|$)", string:os))
  audit(AUDIT_OS_NOT, "Mac OS X 10.10.5 or Mac OS X 10.11.6 or Mac OS X 10.12.5");

if ("10.10.5" >< os || "10.11.6" >< os || "10.12.5" >< os) patch = "2017-003";

packages = get_kb_item_or_exit("Host/MacOSX/packages/boms", exit_code:1);
sec_boms_report = pgrep(
  pattern:"^com\.apple\.pkg\.update\.(security\.|os\.SecUpd).*bom$",
  string:packages
);
sec_boms = split(sec_boms_report, sep:'\n');

foreach package (sec_boms)
{
  # Grab patch year and number
  match = eregmatch(pattern:"[^0-9](20[0-9][0-9])[-.]([0-9]{3})[^0-9]", string:package);
  if (empty_or_null(match[1]) || empty_or_null(match[2]))
    continue;

  patch_found = check_patch(year:int(match[1]), number:int(match[2]));
  if (patch_found) exit(0, "The host has Security Update " + patch + " or later installed and is therefore not affected.");
}

report =  '\n  Missing security update : ' + patch;
report += '\n  Installed security BOMs : ';
if (sec_boms_report) report += str_replace(find:'\n', replace:'\n                            ', string:sec_boms_report);
else report += 'n/a';
report += '\n';

security_report_v4(port:0, severity:SECURITY_HOLE, extra:report);