# encoding: utf-8
# copyright: 2018, eNFence GmbH

title 'sendmail_advisory3'

control 'CVE-2014-3956' do
  impact 0.21
  title 'Vulnerability in sendmail impacts AIX (CVE-2014-3956)'
  desc 'The sm_close_on_exec function in conf.c in sendmail before 
        8.14.9 has arguments in the wrong order, and consequently skips 
        setting expected FD_CLOEXEC flags, which allows local users to access 
        unintended high-numbered file descriptors via a custom mail-delivery 
        program.  
  '

  tag 'aix', 'aix53', 'aix61', 'aix71', 'aix72'
  tag 'vios'
  tag :score, '2.1'
  ref 'ftp://aix.software.ibm.com/aix/efixes/security/sendmail_advisory3.asc'

  only_if do
    os.aix?
  end

  describe command('/usr/bin/lslpp -Lqc bos.net.tcp.client') do
    its('stdout') { should_not match(/:5\.3\.[0-9]\./) }
    its('stdout') { should_not match(/:5\.3\.1[01]\./) }
    its('stdout') { should_not match(/:5\.3\.12\.[0-9]:/) }
    its('stdout') { should_not match(/:6\.1\.[0-8]\./) }
    its('stdout') { should_not match(/:6\.1\.9\.[0-9]:/) }
    its('stdout') { should_not match(/:6\.1\.9\.[0-9][0-9]:/) }
    its('stdout') { should_not match(/:6\.1\.9\.1[0-9][0-9]:/) }
    its('stdout') { should_not match(/:6\.1\.9\.200:/) }
    its('stdout') { should_not match(/:7\.1\.[0-3]\./) }
    its('stdout') { should_not match(/:7\.1\.4\.[0-9]:/) }
    its('stdout') { should_not match(/:7\.1\.4\.[0-2][0-9]:/) }
  end

  describe command('/usr/bin/lslpp -Lqc bos.net.tcp.server') do
    its('stdout') { should_not match(/:5\.3\.[0-9]\./) }
    its('stdout') { should_not match(/:5\.3\.1[01]\./) }
    its('stdout') { should_not match(/:5\.3\.12\.[0-5]:/) }
  end

  describe command('/usr/bin/lslpp -Lqc bos.net.tcp.sendmail') do
    its('stdout') { should_not match(/:7\.2\.0\.0:/) }
  end

  if command('/usr/bin/lslpp -Lqc bos.net.tcp.client').stdout.match(/:5\.3\.12\.10:/)
    describe command('/usr/sbin/emgr -l') do
      its('stdout') { should match(/IJ03273s9a/) }
    end
  end

  if command('/usr/bin/lslpp -Lqc bos.net.tcp.server').stdout.match(/:5\.3\.12\.6:/)
    describe command('/usr/sbin/emgr -l') do
      its('stdout') { should match(/IJ03273s9a/) }
    end
  end

  if command('/usr/bin/lslpp -Lqc bos.net.tcp.client').stdout.match(/:6\.1\.9\.201:/)
    describe command('/usr/sbin/emgr -l') do
      its('stdout') { should match(/IJ02915s9a/) }
    end
  end

  if command('/usr/bin/lslpp -Lqc bos.net.tcp.client').stdout.match(/:6\.1\.9\.30[0-9]:/)
    describe command('/usr/sbin/emgr -l') do
      its('stdout') { should match(/IJ02915s9a/) }
    end
  end

  if command('/usr/bin/lslpp -Lqc bos.net.tcp.client').stdout.match(/:6\.1\.9\.31[0-5]:/)
    describe command('/usr/sbin/emgr -l') do
      its('stdout') { should match(/IJ02915s9a/) }
    end
  end

  if command('/usr/bin/lslpp -Lqc bos.net.tcp.client').stdout.match(/:7\.1\.4\.3[0-2]:/)
    describe command('/usr/sbin/emgr -l') do
      its('stdout') { should match(/IJ02917s3a/) }
    end
  end

  if command('/usr/bin/lslpp -Lqc bos.net.tcp.client').stdout.match(/:7\.1\.5\.[0-9]:/)
    describe command('/usr/sbin/emgr -l') do
      its('stdout') { should match(/IJ03121s0a/) }
    end
  end

  if command('/usr/bin/lslpp -Lqc bos.net.tcp.client').stdout.match(/:7\.1\.5\.1[0-5]:/)
    describe command('/usr/sbin/emgr -l') do
      its('stdout') { should match(/IJ03121s0a/) }
    end
  end

  if command('/usr/bin/lslpp -Lqc bos.net.tcp.sendmail').stdout.match(/:7\.2\.0\.[1-2]:/)
    describe command('/usr/sbin/emgr -l') do
      its('stdout') { should match(/IJ02918s3a/) }
    end
  end

  if command('/usr/bin/lslpp -Lqc bos.net.tcp.sendmail').stdout.match(/:7\.2\.0\.3:/)
    describe command('/usr/sbin/emgr -l') do
      its('stdout') { should match(/IJ02918sp6/) }
    end
  end

  if command('/usr/bin/lslpp -Lqc bos.net.tcp.sendmail').stdout.match(/:7\.2\.1\.[01]:/)
    describe command('/usr/sbin/emgr -l') do
      its('stdout') { should match(/IJ02919s1a/) }
    end
  end

  if command('/usr/bin/lslpp -Lqc bos.net.tcp.sendmail').stdout.match(/:7\.2\.2\.[0-9]:/)
    describe command('/usr/sbin/emgr -l') do
      its('stdout') { should match(/IJ02920s0a/) }
    end
  end

  if command('/usr/bin/lslpp -Lqc bos.net.tcp.sendmail').stdout.match(/:7\.2\.2\.1[0-5]:/)
    describe command('/usr/sbin/emgr -l') do
      its('stdout') { should match(/IJ02920s0a/) }
    end
  end
end
