Vulnerabilities > CVE-2017-15227 - Use After Free vulnerability in Irssi

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update openSUSE-2017-1189.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(104114);
  script_version("3.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");

  script_cve_id("CVE-2017-15227", "CVE-2017-15228", "CVE-2017-15721", "CVE-2017-15722", "CVE-2017-15723");

  script_name(english:"openSUSE Security Update : irssi (openSUSE-2017-1189)");
  script_summary(english:"Check for the openSUSE-2017-1189 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This security update for irssi to version 1.0.5 addresses the
following security issues :

  - CVE-2017-15228: When installing themes with unterminated
    colour formatting sequences, Irssi may access data
    beyond the end of the string. This issue could have
    resulted in denial of service (remote crash) when
    installing a malicious or broken theme file.

  - CVE-2017-15227: While waiting for the channel
    synchronisation, Irssi may incorrectly fail to remove
    destroyed channels from the query list, resulting in use
    after free conditions when updating the state later on.
    This issue could have caused denial of service (remote
    crash) when connecting to a malicious or broken ircd.

  - CVE-2017-15721: Certain incorrectly formatted DCC CTCP
    messages could cause NULL pointer dereference. This
    issue could have caused denial of service (remote crash)
    when connecting to a malicious or broken ircd.

  - CVE-2017-15723: Overlong nicks or targets may result in
    a NULL pointer dereference while splitting the message.
    This issue could have caused denial of service (remote
    crash) when connecting to a malicious or broken ircd.

  - CVE-2017-15722: In certain cases Irssi may fail to
    verify that a Safe channel ID is long enough, causing
    reads beyond the end of the string."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1064540"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected irssi packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:irssi");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:irssi-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:irssi-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:irssi-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.3");

  script_set_attribute(attribute:"patch_publication_date", value:"2017/10/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/10/24");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2017-2020 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE42\.2|SUSE42\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "42.2 / 42.3", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE42.2", reference:"irssi-1.0.5-14.14.1") ) flag++;
if ( rpm_check(release:"SUSE42.2", reference:"irssi-debuginfo-1.0.5-14.14.1") ) flag++;
if ( rpm_check(release:"SUSE42.2", reference:"irssi-debugsource-1.0.5-14.14.1") ) flag++;
if ( rpm_check(release:"SUSE42.2", reference:"irssi-devel-1.0.5-14.14.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"irssi-1.0.5-17.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"irssi-debuginfo-1.0.5-17.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"irssi-debugsource-1.0.5-17.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"irssi-devel-1.0.5-17.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "irssi / irssi-debuginfo / irssi-debugsource / irssi-devel");
}