Denial of service due to insufficient input validation in authentication logging

#!/usr/bin/env python3
# check_cve_2026_28718.py
# Determine likely exposure to CVE-2026-28718 by checking for Acronis Cyber Protect 17
# and comparing discovered build numbers against fixed build 41186.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import re
import sys
import platform
import subprocess
from pathlib import Path

FIXED_BUILD = 41186
TARGET_NAMES = [
    'Acronis Cyber Protect 17',
    'Acronis Cyber Protect',
    'Acronis Backup Agent',
    'Acronis Managed Machine Service',
]

BUILD_RE = re.compile(r'(?<!\d)(\d{5})(?!\d)')
VER_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)(?:\.(\d+))?')


def out(status, detail):
    print(f'{status}: {detail}')
    if status == 'PATCHED':
        sys.exit(0)
    if status == 'VULNERABLE':
        sys.exit(1)
    sys.exit(2)


def extract_build(text):
    if not text:
        return None
    m = BUILD_RE.search(text)
    if m:
        return int(m.group(1))
    m = VER_RE.search(text)
    if m:
        parts = [p for p in m.groups() if p is not None]
        if parts:
            try:
                last = int(parts[-1])
                if last >= 10000:
                    return last
            except Exception:
                pass
    return None


def run(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=15)
        return p.returncode, (p.stdout or '') + (p.stderr or '')
    except Exception:
        return 999, ''


def check_windows():
    candidates = []
    try:
        import winreg
    except Exception:
        return None, 'winreg unavailable'

    reg_paths = [
        r'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall',
        r'SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall',
    ]

    for hive in (winreg.HKEY_LOCAL_MACHINE, winreg.HKEY_CURRENT_USER):
        for base in reg_paths:
            try:
                k = winreg.OpenKey(hive, base)
            except Exception:
                continue
            for i in range(0, winreg.QueryInfoKey(k)[0]):
                try:
                    subname = winreg.EnumKey(k, i)
                    sk = winreg.OpenKey(k, subname)
                    name = str(winreg.QueryValueEx(sk, 'DisplayName')[0]) if True else ''
                except Exception:
                    continue
                if 'Acronis' not in name:
                    continue
                version = ''
                publisher = ''
                install = ''
                try:
                    version = str(winreg.QueryValueEx(sk, 'DisplayVersion')[0])
                except Exception:
                    pass
                try:
                    publisher = str(winreg.QueryValueEx(sk, 'Publisher')[0])
                except Exception:
                    pass
                try:
                    install = str(winreg.QueryValueEx(sk, 'InstallLocation')[0])
                except Exception:
                    pass
                if any(t.lower() in name.lower() for t in TARGET_NAMES) or ('Acronis' in name and '17' in version):
                    candidates.append((name, version, publisher, install))

    for item in candidates:
        name, version, publisher, install = item
        b = extract_build(version) or extract_build(name)
        if b:
            return b, f'{name} {version}'.strip()

    common_paths = [
        Path(os.environ.get('ProgramFiles', r'C:\Program Files')) / 'Acronis',
        Path(os.environ.get('ProgramFiles(x86)', r'C:\Program Files (x86)')) / 'Acronis',
    ]
    for root in common_paths:
        if not root.exists():
            continue
        for p in root.rglob('*'):
            if not p.is_file():
                continue
            b = extract_build(str(p))
            if b:
                return b, str(p)

    return None, 'No Acronis Cyber Protect 17 build identified on Windows'


def check_linux():
    cmds = [
        ['rpm', '-qa'],
        ['dpkg-query', '-W', '-f=${Package} ${Version}\n'],
    ]
    for cmd in cmds:
        rc, text = run(cmd)
        if rc == 0 and text:
            for line in text.splitlines():
                if 'acronis' in line.lower() or 'backupclient' in line.lower():
                    b = extract_build(line)
                    if b:
                        return b, line.strip()

    common_paths = [
        Path('/usr/lib/Acronis'),
        Path('/opt/acronis'),
        Path('/var/lib/Acronis'),
        Path('/etc/Acronis'),
    ]
    for root in common_paths:
        if not root.exists():
            continue
        for p in root.rglob('*'):
            b = extract_build(str(p))
            if b:
                return b, str(p)
            if p.is_file() and p.stat().st_size < 1024 * 1024:
                try:
                    data = p.read_text(errors='ignore')
                except Exception:
                    continue
                b = extract_build(data)
                if b:
                    return b, str(p)

    return None, 'No Acronis Cyber Protect 17 build identified on Linux'


def main():
    system = platform.system().lower()
    if 'windows' in system:
        build, source = check_windows()
    elif 'linux' in system:
        build, source = check_linux()
    else:
        out('UNKNOWN', f'Unsupported platform for this check: {platform.system()}')
        return

    if build is None:
        out('UNKNOWN', source)
    if build < FIXED_BUILD:
        out('VULNERABLE', f'Discovered build {build} from {source}; fixed build is {FIXED_BUILD}')
    else:
        out('PATCHED', f'Discovered build {build} from {source}; meets or exceeds fixed build {FIXED_BUILD}')


if __name__ == '__main__':
    main()