# encoding: utf-8
# copyright: 2018, eNFence GmbH

title 'tcpdump_advisory3'

control 'CVE-2017-12894' do
  impact 0.53
  title 'Vulnerabilities in tcpdump affect AIX'
  desc 'tcpdump could allow a remote attacker to obtain sensitive
        information, caused by a buffer overread memory in the
        lookup_bytestring component. By sending a specially crafted request,
        an attacker could exploit this vulnerability to obtain sensitive
        information. 
  '

  tag 'tcpdump'
  tag :score, '5.3'
  ref 'https://aix.software.ibm.com/aix/efixes/security/tcpdump_advisory3.asc'

  only_if do
    os.aix?
  end

  # AIX 5.3 and earlier
  describe command('/usr/bin/lslpp -Lqc bos.net.tcp.server') do
    its('stdout') { should_not match(/:5\.[0-2]\./) }
    its('stdout') { should_not match(/:5\.3\.[02-9]\./) }
    its('stdout') { should_not match(/:5\.3\.1[01]\./) }
  end

  # AIX 6.1
  describe command('/usr/bin/lslpp -Lqc bos.net.tcp.server') do
    its('stdout') { should_not match(/:6\.1\.[0-8]\./) }
    its('stdout') { should_not match(/:6\.1\.9\.300:/) }
  end

  # AIX 7.1
  describe command('/usr/bin/lslpp -Lqc bos.net.tcp.server') do
    its('stdout') { should_not match(/:7\.1\.[0-2]\./) }
    its('stdout') { should_not match(/:7\.1\.3\.[0-3]/) }
  end

  # Fix for AIX 5.3 bos.net.tcp.server 5.3.12.0-5.3.12.6
  if command('/usr/bin/lslpp -Lqc bos.net.tcp.server').stdout.match(/:5\.3\.12\.[0-6]:/)
    describe command('/usr/sbin/emgr -l') do
      its('stdout') { should match(/IV94729m9a/) }
    end
  end

  # Fix for AIX 6.1 bos.net.tcp.server 6.1.9.0-6.1.9.300
  if command('/usr/bin/lslpp -Lqc bos.net.tcp.server').stdout.match(/:6\.1\.9\.[0-2]/)
    describe command('/usr/sbin/emgr -l') do
      its('stdout') { should match(/IV94728mAa/) }
    end
  end
  if command('/usr/bin/lslpp -Lqc bos.net.tcp.server').stdout.match(/:6\.1\.9\.300:/)
    describe command('/usr/sbin/emgr -l') do
      its('stdout') { should match(/IV94728mAa/) }
    end
  end

  # Fix for AIX 7.1 bos.net.tcp.server 7.1.3.0-7.1.3.49
  if command('/usr/bin/lslpp -Lqc bos.net.tcp.server').stdout.match(/:7\.1\.3\.[0-3]/)
    describe command('/usr/sbin/emgr -l') do
      its('stdout') { should match(/IV94727m9a/) }
    end
  end
  if command('/usr/bin/lslpp -Lqc bos.net.tcp.server').stdout.match(/:7\.1\.3\.4[0-9]:/)
    describe command('/usr/sbin/emgr -l') do
      its('stdout') { should match(/IV94727m9a/) }
    end
  end

  # Fix for AIX 7.1 bos.net.tcp.server 7.1.4.0-7.1.4.32
  if command('/usr/bin/lslpp -Lqc bos.net.tcp.server').stdout.match(/:7\.1\.4\.[0-2]/)
    describe command('/usr/sbin/emgr -l') do
      its('stdout') { should match(/IV94726m5a/) }
    end
  end
  if command('/usr/bin/lslpp -Lqc bos.net.tcp.server').stdout.match(/:7\.1\.4\.3[0-2]:/)
    describe command('/usr/sbin/emgr -l') do
      its('stdout') { should match(/IV94726m5a/) }
    end
  end

  # Fix for AIX 7.2 bos.net.tcp.tcpdump 7.2.0.0-7.2.0.3
  if command('/usr/bin/lslpp -Lqc bos.net.tcp.tcpdump').stdout.match(/:7\.2\.0\.[0-3]:/)
    describe command('/usr/sbin/emgr -l') do
      its('stdout') { should match(/IV94724m5a/) }
    end
  end

  # Fix for AIX 7.2 bos.net.tcp.tcpdump 7.2.1.0-7.2.1.1
  if command('/usr/bin/lslpp -Lqc bos.net.tcp.tcpdump').stdout.match(/:7\.2\.1\.[01]:/)
    describe command('/usr/sbin/emgr -l') do
      its('stdout') { should match(/IV94723m3a/) }
    end
  end
end

