Vulnerabilities > CVE-2017-5209 - Out-of-bounds Read vulnerability in Libimobiledevice Libplist

047910
CVSS 6.4 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
PARTIAL
network
low complexity
libimobiledevice
CWE-125
nessus

Summary

The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data.

Vulnerable Configurations

Part Description Count
Application
Libimobiledevice
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Overread Buffers
    An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.

Nessus

  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2017-D8173AACFF.NASL
    description - Update to upstream 2.0.0 - Fixes the following CVEs plus others - CVE-2017-6440 CVE-2017-6439 CVE-2017-6438 CVE-2017-6437 CVE-2017-6436 CVE-2017-6435 CVE-2017-5836 CVE-2017-5835 CVE-2017-5834 CVE-2017-5545 CVE-2017-5209 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2017-07-17
    plugin id101732
    published2017-07-17
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/101732
    titleFedora 26 : libplist (2017-d8173aacff)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory FEDORA-2017-d8173aacff.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(101732);
      script_version("3.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2017-5209", "CVE-2017-5545", "CVE-2017-5834", "CVE-2017-5835", "CVE-2017-5836", "CVE-2017-6435", "CVE-2017-6436", "CVE-2017-6437", "CVE-2017-6438", "CVE-2017-6439", "CVE-2017-6440");
      script_xref(name:"FEDORA", value:"2017-d8173aacff");
    
      script_name(english:"Fedora 26 : libplist (2017-d8173aacff)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "  - Update to upstream 2.0.0
    
      - Fixes the following CVEs plus others
    
      - CVE-2017-6440 CVE-2017-6439 CVE-2017-6438 CVE-2017-6437
        CVE-2017-6436 CVE-2017-6435 CVE-2017-5836 CVE-2017-5835
        CVE-2017-5834 CVE-2017-5545 CVE-2017-5209
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora update system website.
    Tenable has attempted to automatically clean and format it as much as
    possible without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bodhi.fedoraproject.org/updates/FEDORA-2017-d8173aacff"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected libplist package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:libplist");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:26");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/01/11");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/05/02");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/07/17");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! preg(pattern:"^26([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 26", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"FC26", reference:"libplist-2.0.0-1.fc26")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libplist");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2017-627.NASL
    descriptionThis update for libplist fixes the following issues : - CVE-2017-5209: The base64decode function in libplist allowed attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data (bsc#1019531). - CVE-2017-5545: The main function in plistutil.c in libimobiledevice libplist allowed attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short. (bsc#1021610). - CVE-2017-5836: A type inconsistency in bplist.c was fixed. (bsc#1023807) - CVE-2017-5835: A memory allocation error leading to DoS was fixed. (bsc#1023822) - CVE-2017-5834: A heap-buffer overflow in parse_dict_node was fixed. (bsc#1023848) - CVE-2017-6440: Ensure that sanity checks work on 32-bit platforms. (bsc#1029631) - CVE-2017-7982: Add some safety checks, backported from upstream (bsc#1035312). - CVE-2017-5836: A maliciously crafted file could cause the application to crash. (bsc#1023807). - CVE-2017-5835: Malicious crafted file could cause libplist to allocate large amounts of memory and consume lots of CPU (bsc#1023822) - CVE-2017-5834: Maliciou crafted file could cause a heap buffer overflow or segmentation fault (bsc#1023848) This update was imported from the SUSE:SLE-12-SP2:Update update project.
    last seen2020-06-05
    modified2017-05-30
    plugin id100502
    published2017-05-30
    reporterThis script is Copyright (C) 2017-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/100502
    titleopenSUSE Security Update : libplist (openSUSE-2017-627)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2017-627.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(100502);
      script_version("3.2");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2017-5209", "CVE-2017-5545", "CVE-2017-5834", "CVE-2017-5835", "CVE-2017-5836", "CVE-2017-6440", "CVE-2017-7982");
    
      script_name(english:"openSUSE Security Update : libplist (openSUSE-2017-627)");
      script_summary(english:"Check for the openSUSE-2017-627 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update for libplist fixes the following issues :
    
      - CVE-2017-5209: The base64decode function in libplist
        allowed attackers to obtain sensitive information from
        process memory or cause a denial of service (buffer
        over-read) via split encoded Apple Property List data
        (bsc#1019531).
    
      - CVE-2017-5545: The main function in plistutil.c in
        libimobiledevice libplist allowed attackers to obtain
        sensitive information from process memory or cause a
        denial of service (buffer over-read) via Apple Property
        List data that is too short. (bsc#1021610).
    
      - CVE-2017-5836: A type inconsistency in bplist.c was
        fixed. (bsc#1023807)
    
      - CVE-2017-5835: A memory allocation error leading to DoS
        was fixed. (bsc#1023822)
    
      - CVE-2017-5834: A heap-buffer overflow in parse_dict_node
        was fixed. (bsc#1023848)
    
      - CVE-2017-6440: Ensure that sanity checks work on 32-bit
        platforms. (bsc#1029631)
    
      - CVE-2017-7982: Add some safety checks, backported from
        upstream (bsc#1035312). 
    
      - CVE-2017-5836: A maliciously crafted file could cause
        the application to crash. (bsc#1023807).
    
      - CVE-2017-5835: Malicious crafted file could cause
        libplist to allocate large amounts of memory and consume
        lots of CPU (bsc#1023822) 
    
      - CVE-2017-5834: Maliciou crafted file could cause a heap
        buffer overflow or segmentation fault (bsc#1023848) This
        update was imported from the SUSE:SLE-12-SP2:Update
        update project."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1019531"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1021610"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1023807"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1023822"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1023848"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1029631"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1035312"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected libplist packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libplist++-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libplist++3");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libplist++3-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libplist++3-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libplist++3-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libplist-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libplist-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libplist3");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libplist3-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libplist3-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libplist3-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:plistutil");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:plistutil-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-plist");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-plist-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.2");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2017/05/27");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/05/30");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2017-2020 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE42\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "42.2", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE42.2", reference:"libplist++-devel-1.12-7.3.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"libplist++3-1.12-7.3.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"libplist++3-debuginfo-1.12-7.3.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"libplist-debugsource-1.12-7.3.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"libplist-devel-1.12-7.3.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"libplist3-1.12-7.3.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"libplist3-debuginfo-1.12-7.3.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"plistutil-1.12-7.3.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"plistutil-debuginfo-1.12-7.3.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"python-plist-1.12-7.3.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"python-plist-debuginfo-1.12-7.3.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", cpu:"x86_64", reference:"libplist++3-32bit-1.12-7.3.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", cpu:"x86_64", reference:"libplist++3-debuginfo-32bit-1.12-7.3.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", cpu:"x86_64", reference:"libplist3-32bit-1.12-7.3.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", cpu:"x86_64", reference:"libplist3-debuginfo-32bit-1.12-7.3.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libplist++-devel / libplist++3 / libplist++3-32bit / etc");
    }
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2207.NASL
    descriptionAccording to the versions of the libplist package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory corruption) via a crafted plist file.(CVE-2017-6435) - The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data.(CVE-2017-5209) - The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short.(CVE-2017-5545) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-08
    modified2019-11-08
    plugin id130669
    published2019-11-08
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130669
    titleEulerOS 2.0 SP5 : libplist (EulerOS-SA-2019-2207)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(130669);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/07");
    
      script_cve_id(
        "CVE-2017-5209",
        "CVE-2017-5545",
        "CVE-2017-6435"
      );
    
      script_name(english:"EulerOS 2.0 SP5 : libplist (EulerOS-SA-2019-2207)");
      script_summary(english:"Checks the rpm output for the updated packages.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote EulerOS host is missing multiple security updates.");
      script_set_attribute(attribute:"description", value:
    "According to the versions of the libplist package installed, the
    EulerOS installation on the remote host is affected by the following
    vulnerabilities :
    
      - The parse_string_node function in bplist.c in
        libimobiledevice libplist 1.12 allows local users to
        cause a denial of service (memory corruption) via a
        crafted plist file.(CVE-2017-6435)
    
      - The base64decode function in base64.c in
        libimobiledevice libplist through 1.12 allows attackers
        to obtain sensitive information from process memory or
        cause a denial of service (buffer over-read) via split
        encoded Apple Property List data.(CVE-2017-5209)
    
      - The main function in plistutil.c in libimobiledevice
        libplist through 1.12 allows attackers to obtain
        sensitive information from process memory or cause a
        denial of service (buffer over-read) via Apple Property
        List data that is too short.(CVE-2017-5545)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the EulerOS security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues.");
      # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-2207
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a0629fa3");
      script_set_attribute(attribute:"solution", value:
    "Update the affected libplist packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2019/10/28");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/11/08");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libplist");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Huawei Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
      script_exclude_keys("Host/EulerOS/uvp_version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/EulerOS/release");
    if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
    if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");
    
    sp = get_kb_item("Host/EulerOS/sp");
    if (isnull(sp) || sp !~ "^(5)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP5");
    
    uvp = get_kb_item("Host/EulerOS/uvp_version");
    if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP5", "EulerOS UVP " + uvp);
    
    if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);
    
    flag = 0;
    
    pkgs = ["libplist-1.12-3.h2.eulerosv2r7"];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"EulerOS-2.0", sp:"5", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libplist");
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2017-3849AF4477.NASL
    descriptionVersion 2.0.0 Changes : - New light-weight custom XML parser - Remove libxml2 dependency - Refactor binary plist parsing - Improved malformed XML and binary plist detection and error handling - Add parser debug/error output (when compiled with --enable-debug), controlled via environment variables - Fix unicode character handling - Add PLIST_IS_* helper macros for the different node types - Extend date/time range and date conversion issues - Add plist_is_binary() and plist_from_memory() functions to the interface - Plug several memory leaks - Speed improvements for handling large plist files Includes security fixes for : - CVE-2017-6440 - CVE-2017-6439 - CVE-2017-6438 - CVE-2017-6437 - CVE-2017-6436 - CVE-2017-6435 - CVE-2017-5836 - CVE-2017-5835 - CVE-2017-5834 - CVE-2017-5545 - CVE-2017-5209 ... and several others that didn
    last seen2020-06-05
    modified2017-05-16
    plugin id100187
    published2017-05-16
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100187
    titleFedora 24 : libplist (2017-3849af4477)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory FEDORA-2017-3849af4477.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(100187);
      script_version("3.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2017-5209", "CVE-2017-5545", "CVE-2017-5834", "CVE-2017-5835", "CVE-2017-5836", "CVE-2017-6435", "CVE-2017-6436", "CVE-2017-6437", "CVE-2017-6438", "CVE-2017-6439", "CVE-2017-6440");
      script_xref(name:"FEDORA", value:"2017-3849af4477");
    
      script_name(english:"Fedora 24 : libplist (2017-3849af4477)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Version 2.0.0
    
    Changes :
    
      - New light-weight custom XML parser
    
      - Remove libxml2 dependency
    
      - Refactor binary plist parsing
    
      - Improved malformed XML and binary plist detection and
        error handling
    
      - Add parser debug/error output (when compiled with
        --enable-debug), controlled via environment variables
    
      - Fix unicode character handling
    
      - Add PLIST_IS_* helper macros for the different node
        types
    
      - Extend date/time range and date conversion issues
    
      - Add plist_is_binary() and plist_from_memory() functions
        to the interface
    
      - Plug several memory leaks
    
      - Speed improvements for handling large plist files
    
    Includes security fixes for :
    
      - CVE-2017-6440
    
      - CVE-2017-6439
    
      - CVE-2017-6438
    
      - CVE-2017-6437
    
      - CVE-2017-6436
    
      - CVE-2017-6435
    
      - CVE-2017-5836
    
      - CVE-2017-5835
    
      - CVE-2017-5834
    
      - CVE-2017-5545
    
      - CVE-2017-5209
    
    ... and several others that didn't receive any CVE (yet).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora update system website.
    Tenable has attempted to automatically clean and format it as much as
    possible without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bodhi.fedoraproject.org/updates/FEDORA-2017-3849af4477"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected libplist package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:libplist");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:24");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/01/11");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/05/12");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/05/16");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! preg(pattern:"^24([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 24", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"FC24", reference:"libplist-2.0.0-1.fc24")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libplist");
    }
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-2168.NASL
    descriptionlibplist is a library for reading and writing the Apple binary and XML property lists format. It
    last seen2020-04-09
    modified2020-04-03
    plugin id135190
    published2020-04-03
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135190
    titleDebian DLA-2168-1 : libplist security update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Debian Security Advisory DLA-2168-1. The text
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(135190);
      script_version("1.2");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/07");
    
      script_cve_id("CVE-2017-5209", "CVE-2017-5545", "CVE-2017-5834", "CVE-2017-5835", "CVE-2017-6435", "CVE-2017-6436", "CVE-2017-6439", "CVE-2017-7982");
    
      script_name(english:"Debian DLA-2168-1 : libplist security update");
      script_summary(english:"Checks dpkg output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "libplist is a library for reading and writing the Apple binary and XML
    property lists format. It's part of the libimobiledevice stack,
    providing access to iDevices (iPod, iPhone, iPad ...).
    
    CVE-2017-5209
    
    The base64decode function in base64.c allows attackers to obtain
    sensitive information from process memory or cause a denial of service
    (buffer over-read) via split encoded Apple Property List data.
    
    CVE-2017-5545
    
    The main function in plistutil.c allows attackers to obtain sensitive
    information from process memory or cause a denial of service (buffer
    over-read) via Apple Property List data that is too short.
    
    CVE-2017-5834
    
    The parse_dict_node function in bplist.c allows attackers to cause a
    denial of service (out-of-bounds heap read and crash) via a crafted
    file.
    
    CVE-2017-5835
    
    libplist allows attackers to cause a denial of service (large memory
    allocation and crash) via vectors involving an offset size of zero.
    
    CVE-2017-6435
    
    The parse_string_node function in bplist.c allows local users to cause
    a denial of service (memory corruption) via a crafted plist file.
    
    CVE-2017-6436
    
    The parse_string_node function in bplist.c allows local users to cause
    a denial of service (memory allocation error) via a crafted plist
    file.
    
    CVE-2017-6439
    
    Heap-based buffer overflow in the parse_string_node function in
    bplist.c allows local users to cause a denial of service
    (out-of-bounds write) via a crafted plist file.
    
    CVE-2017-7982
    
    Integer overflow in the plist_from_bin function in bplist.c allows
    remote attackers to cause a denial of service (heap-based buffer
    over-read and application crash) via a crafted plist file.
    
    For Debian 8 'Jessie', these problems have been fixed in version
    1.11-3+deb8u1.
    
    We recommend that you upgrade your libplist packages.
    
    NOTE: Tenable Network Security has extracted the preceding description
    block directly from the DLA security advisory. Tenable has attempted
    to automatically clean and format it as much as possible without
    introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/jessie/libplist"
      );
      script_set_attribute(attribute:"solution", value:"Upgrade the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libplist++-dev");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libplist++2");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libplist-dbg");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libplist-dev");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libplist-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libplist-utils");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libplist2");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:python-plist");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/01/11");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/04/02");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/04/03");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"8.0", prefix:"libplist++-dev", reference:"1.11-3+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"libplist++2", reference:"1.11-3+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"libplist-dbg", reference:"1.11-3+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"libplist-dev", reference:"1.11-3+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"libplist-doc", reference:"1.11-3+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"libplist-utils", reference:"1.11-3+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"libplist2", reference:"1.11-3+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"python-plist", reference:"1.11-3+deb8u1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2017-283.NASL
    descriptionThis update for libplist fixes the following issues : - CVE-2017-5209: The base64decode function in libplist allowed attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data (bsc#1019531). - CVE-2017-5834: A heap-buffer overflow in parse_dict_node was fixed (bsc#1023848) - CVE-2017-5835: A memory allocation error leading to DoS was fixed. (bsc#1023822) - CVE-2017-5836: A type inconsistency in bplist.c was fixed. (bsc#1023807)
    last seen2020-06-05
    modified2017-02-21
    plugin id97291
    published2017-02-21
    reporterThis script is Copyright (C) 2017-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/97291
    titleopenSUSE Security Update : libplist (openSUSE-2017-283)
  • NASL familySlackware Local Security Checks
    NASL idSLACKWARE_SSA_2017-320-01.NASL
    descriptionNew libplist packages are available for Slackware 14.2 and -current to fix security issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id104641
    published2017-11-17
    reporterThis script is Copyright (C) 2017 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/104641
    titleSlackware 14.2 / current : libplist (SSA:2017-320-01)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2017-4047180CD3.NASL
    descriptionVersion 2.0.0 Changes : - New light-weight custom XML parser - Remove libxml2 dependency - Refactor binary plist parsing - Improved malformed XML and binary plist detection and error handling - Add parser debug/error output (when compiled with --enable-debug), controlled via environment variables - Fix unicode character handling - Add PLIST_IS_* helper macros for the different node types - Extend date/time range and date conversion issues - Add plist_is_binary() and plist_from_memory() functions to the interface - Plug several memory leaks - Speed improvements for handling large plist files Includes security fixes for : - CVE-2017-6440 - CVE-2017-6439 - CVE-2017-6438 - CVE-2017-6437 - CVE-2017-6436 - CVE-2017-6435 - CVE-2017-5836 - CVE-2017-5835 - CVE-2017-5834 - CVE-2017-5545 - CVE-2017-5209 ... and several others that didn
    last seen2020-06-05
    modified2017-05-16
    plugin id100188
    published2017-05-16
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100188
    titleFedora 25 : libplist (2017-4047180cd3)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2017-1379-1.NASL
    descriptionThis update for libplist fixes the following issues : - CVE-2017-5209: The base64decode function in libplist allowed attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data (bsc#1019531). - CVE-2017-5545: The main function in plistutil.c in libimobiledevice libplist allowed attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short. (bsc#1021610). - CVE-2017-5836: A type inconsistency in bplist.c was fixed. (bsc#1023807) - CVE-2017-5835: A memory allocation error leading to DoS was fixed. (bsc#1023822) - CVE-2017-5834: A heap-buffer overflow in parse_dict_node was fixed. (bsc#1023848) - CVE-2017-6440: Ensure that sanity checks work on 32-bit platforms. (bsc#1029631) - CVE-2017-7982: Add some safety checks, backported from upstream (bsc#1035312). - CVE-2017-5836: A maliciously crafted file could cause the application to crash. (bsc#1023807). - CVE-2017-5835: Malicious crafted file could cause libplist to allocate large amounts of memory and consume lots of CPU (bsc#1023822) - CVE-2017-5834: Maliciou crafted file could cause a heap buffer overflow or segmentation fault (bsc#1023848) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id100374
    published2017-05-24
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100374
    titleSUSE SLED12 / SLES12 Security Update : libplist (SUSE-SU-2017:1379-1)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2017-230.NASL
    descriptionThis update for libplist addresses the following vulnerabilities : - CVE-2017-5545: OOB heap buffer read which could allow attackers to obtain sensitive information from process memory or cause a DoS (bsc#1021610) - CVE-2017-5209: base64decode function could have allowed attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data
    last seen2020-06-05
    modified2017-02-10
    plugin id97093
    published2017-02-10
    reporterThis script is Copyright (C) 2017-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/97093
    titleopenSUSE Security Update : libplist (openSUSE-2017-230)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2017-1368-1.NASL
    descriptionThis update for libplist fixes the following security issues : - CVE-2017-5545: The main function in plistutil.c in libimobiledevice libplist allowed attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short. (bsc#1021610). - CVE-2017-5209: The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data. (bsc#1019531) - CVE-2017-5836: A type inconsistency in bplist.c was fixed. (bsc#1023807) - CVE-2017-5835: A memory allocation error leading to DoS was fixed. (bsc#1023822) - CVE-2017-5834: A heap-buffer overflow in parse_dict_node was fixed (bsc#1023848) - CVE-2017-7982: Denial of service (heap-based buffer over-read and application crash) via a crafted plist file (bsc#1035312) - CVE-2017-6440: A specially crafted plist file could lead to denial of service (bsc#1029631) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id100354
    published2017-05-23
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100354
    titleSUSE SLED12 / SLES12 Security Update : libplist (SUSE-SU-2017:1368-1)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-811.NASL
    descriptionThe following vulnerabilities have been fixed in libplist : CVE-2017-5209 Out of bounds read when parsing specially crafted Apple plist file CVE-2017-5545 Heap buffer overflow via crafted Apple plist file For Debian 7
    last seen2020-03-17
    modified2017-02-01
    plugin id96910
    published2017-02-01
    reporterThis script is Copyright (C) 2017-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/96910
    titleDebian DLA-811-1 : libplist security update