code |
include("compat.inc");
if (description)
{
script_id(134720);
script_version("1.3");
script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/08");
script_cve_id("CVE-2020-7451");
script_xref(name:"FreeBSD", value:"SA-20:04.tcp");
script_name(english:"FreeBSD : FreeBSD -- TCP IPv6 SYN cache kernel information disclosure (0e06013e-6a06-11ea-92ab-00163e433440)");
script_summary(english:"Checks for updated packages in pkg_info output");
script_set_attribute(
attribute:"synopsis",
value:
"The remote FreeBSD host is missing one or more security-related
updates."
);
script_set_attribute(
attribute:"description",
value:
"When a TCP server transmits or retransmits a TCP SYN-ACK segment over
IPv6, the Traffic Class field is not initialized. This also applies to
challenge ACK segments, which are sent in response to received RST
segments during the TCP connection setup phase. Impact : For each TCP
SYN-ACK (or challenge TCP-ACK) segment sent over IPv6, one byte of
kernel memory is transmitted over the network."
);
script_set_attribute(
attribute:"see_also",
value:"http://www.nessus.org/u?cd50815d"
);
script_set_attribute(attribute:"solution", value:"Update the affected packages.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-7451");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:FreeBSD");
script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");
script_set_attribute(attribute:"vuln_publication_date", value:"2020/03/19");
script_set_attribute(attribute:"patch_publication_date", value:"2020/03/19");
script_set_attribute(attribute:"plugin_publication_date", value:"2020/03/20");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_family(english:"FreeBSD Local Security Checks");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info", "Settings/ParanoidReport");
exit(0);
}
include("audit.inc");
include("freebsd_package.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);
if (report_paranoia < 2) audit(AUDIT_PARANOID);
flag = 0;
if (pkg_test(save_report:TRUE, pkg:"FreeBSD>=12.1<12.1_3")) flag++;
if (pkg_test(save_report:TRUE, pkg:"FreeBSD>=11.3<11.3_7")) flag++;
if (flag)
{
if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());
else security_warning(0);
exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");
|