# encoding: utf-8
# copyright: 2019, eNFence GmbH

title 'java_jan2019_advisory'

control 'CVE-2018-11212' do
  impact 0.33
  title 'CVE-2018-11212'
  desc 'libjpeg is vulnerable to a denial of service, caused by 
        divide-by-zero error in the alloc_sarray function in jmemmgr.c. By 
        persuading a victim to open a specially-crafted file, a remote 
        attacker could exploit this vulnerability to cause the application to 
        crash.
  '
  tag 'java', 'jre', 'java8'
  tag :score, '3.3'
  ref 'http://aix.software.ibm.com/aix/efixes/security/java_jan2019_advisory.asc'

  only_if do
    os.aix?
  end

  describe command('/usr/bin/lslpp -Lqc Java7_64.jre') do
    its('stdout') { should_not match(/:7\.0\.0\.[0-9]:/) }
    its('stdout') { should_not match(/:7\.0\.0\.[0-9][0-9]:/) }
    its('stdout') { should_not match(/:7\.0\.0\.[0-5][0-9][0-9]:/) }
    its('stdout') { should_not match(/:7\.0\.0\.6[0-3][0-9]:/) }
  end

  describe command('/usr/bin/lslpp -Lqc Java7_64.sdk') do
    its('stdout') { should_not match(/:7\.0\.0\.[0-9]:/) }
    its('stdout') { should_not match(/:7\.0\.0\.[0-9][0-9]:/) }
    its('stdout') { should_not match(/:7\.0\.0\.[0-5][0-9][0-9]:/) }
    its('stdout') { should_not match(/:7\.0\.0\.6[0-3][0-9]:/) }
  end

  describe command('/usr/bin/lslpp -Lqc Java7.jre') do
    its('stdout') { should_not match(/:7\.0\.0\.[0-9]:/) }
    its('stdout') { should_not match(/:7\.0\.0\.[0-9][0-9]:/) }
    its('stdout') { should_not match(/:7\.0\.0\.[0-5][0-9][0-9]:/) }
    its('stdout') { should_not match(/:7\.0\.0\.6[0-3][0-9]:/) }
  end

  describe command('/usr/bin/lslpp -Lqc Java7.sdk') do
    its('stdout') { should_not match(/:7\.0\.0\.[0-9]:/) }
    its('stdout') { should_not match(/:7\.0\.0\.[0-9][0-9]:/) }
    its('stdout') { should_not match(/:7\.0\.0\.[0-5][0-9][0-9]:/) }
    its('stdout') { should_not match(/:7\.0\.0\.6[0-3][0-9]:/) }
  end

  describe command('/usr/bin/lslpp -Lqc Java71_64.jre') do
    its('stdout') { should_not match(/:7\.1\.0\.[0-3]/) }
    its('stdout') { should_not match(/:7\.1\.0\.4[0-2][0-9]:/) }
    its('stdout') { should_not match(/:7\.1\.0\.43[0-4]:/) }
  end

  describe command('/usr/bin/lslpp -Lqc Java71_64.sdk') do
    its('stdout') { should_not match(/:7\.1\.0\.[0-9]:/) }
    its('stdout') { should_not match(/:7\.1\.0\.[0-9][0-9]:/) }
    its('stdout') { should_not match(/:7\.1\.0\.[0-3][0-9][0-9]:/) }
    its('stdout') { should_not match(/:7\.1\.0\.4[0-3][0-9]:/) }
  end

  describe command('/usr/bin/lslpp -Lqc Java71.jre') do
    its('stdout') { should_not match(/:7\.1\.0\.[0-9]:/) }
    its('stdout') { should_not match(/:7\.1\.0\.[0-9][0-9]:/) }
    its('stdout') { should_not match(/:7\.1\.0\.[0-3][0-9][0-9]:/) }
    its('stdout') { should_not match(/:7\.1\.0\.4[0-3][0-9]:/) }
  end

  describe command('/usr/bin/lslpp -Lqc Java71.sdk') do
    its('stdout') { should_not match(/:7\.1\.0\.[0-9]:/) }
    its('stdout') { should_not match(/:7\.1\.0\.[0-9][0-9]:/) }
    its('stdout') { should_not match(/:7\.1\.0\.[0-3][0-9][0-9]:/) }
    its('stdout') { should_not match(/:7\.1\.0\.4[0-3][0-9]:/) }
  end

  describe command('/usr/bin/lslpp -Lqc Java8_64.jre') do
    its('stdout') { should_not match(/:8\.0\.0\.[0-9]:/) }
    its('stdout') { should_not match(/:8\.0\.0\.[0-9][0-9]:/) }
    its('stdout') { should_not match(/:8\.0\.0\.[0-4][0-9][0-9]:/) }
    its('stdout') { should_not match(/:8\.0\.0\.5[0-2][0-9]:/) }
  end

  describe command('/usr/bin/lslpp -Lqc Java8_64.sdk') do
    its('stdout') { should_not match(/:8\.0\.0\.[0-9]:/) }
    its('stdout') { should_not match(/:8\.0\.0\.[0-9][0-9]:/) }
    its('stdout') { should_not match(/:8\.0\.0\.[0-4][0-9][0-9]:/) }
    its('stdout') { should_not match(/:8\.0\.0\.5[0-2][0-9]:/) }
  end

  describe command('/usr/bin/lslpp -Lqc Java8.jre') do
    its('stdout') { should_not match(/:8\.0\.0\.[0-9]:/) }
    its('stdout') { should_not match(/:8\.0\.0\.[0-9][0-9]:/) }
    its('stdout') { should_not match(/:8\.0\.0\.[0-4][0-9][0-9]:/) }
    its('stdout') { should_not match(/:8\.0\.0\.5[0-2][0-9]:/) }
  end

  describe command('/usr/bin/lslpp -Lqc Java8.sdk') do
    its('stdout') { should_not match(/:8\.0\.0\.[0-9]:/) }
    its('stdout') { should_not match(/:8\.0\.0\.[0-9][0-9]:/) }
    its('stdout') { should_not match(/:8\.0\.0\.[0-4][0-9][0-9]:/) }
    its('stdout') { should_not match(/:8\.0\.0\.5[0-2][0-9]:/) }
  end
end

