Unix Operating System Unsupported Version Detection

Tenable plugin 33850 (unsupported_operating_system.nasl) is an *informational lifecycle check*, not a CVE. It fires when Nessus fingerprints a Unix/Linux host running an OS release the vendor no longer supports — think RHEL 5/6, CentOS 6/8, Solaris 9/10 pre-ESU, AIX 5.x/6.1, Ubuntu 16.04/18.04 without ESM, macOS <11, Debian 9/10, SUSE 11, or NetApp/Nokia IPSO/embedded appliances that trip the same fingerprint. There is no single 'affected version range' — the plugin's whole point is to flag *any* OS release past its vendor End-of-Life date.

Tenable rates this Critical / CVSS 10.0 as a policy signal, not a technical measurement. The score reflects the compounding risk that no future kernel, libc, OpenSSL, or sudo CVE will ever be patched on this host — not that a single exploit exists today. In real environments the vendor label is directionally right (unsupported OSes are radioactive) but the score is a placeholder. The true severity depends entirely on the host's role and network exposure, which is why we reassess to HIGH with role-driven escalation to CRITICAL for identity, hypervisor, or edge boxes.

Why this verdict

• Not a CVE, no PoC to score: Plugin 33850 is a lifecycle finding. There is no single exploit chain — the risk is the *statistical certainty* that some future CVE in the frozen stack will be unpatchable. Baseline down from CRITICAL to HIGH.
• Friction adjustment — ESM/ELS programs: Ubuntu Pro ESM, RHEL ELS, TuxCare KernelCare, Oracle ESU, and IBM SWMA extensions materially reduce risk on hosts covered by them. Fleets with any ESM coverage should adjust down further.
• Friction adjustment — network position: An EOL host on an isolated OT segment or behind a strict WAF is meaningfully less exposed than one internet-facing. Downgrade only applies where segmentation is verifiable.
• Role multiplier — workstation / dev sandbox: Chain succeeds but blast radius is single-host. Verdict floor stays at HIGH given the long-tail CVE exposure.
• Role multiplier — line-of-business app tier: Chain succeeds; blast radius extends to tenant/data. Sits at HIGH.
• Role multiplier — domain controller / hypervisor / identity broker / backup server / edge appliance / CI runner: Chain succeeds; blast radius is fleet-scale or supply-chain-scale. Verdict floor for these hosts is CRITICAL — do NOT let the fleet-average downgrade mask them. Enumerate and treat individually.

Why not higher?

Uniformly CRITICAL treats every EOL host — including an air-gapped lab VM or a legacy printer front-end — as fleet-ending, which drowns out the actual high-value-role hosts that deserve emergency attention. Without a specific active-exploitation event tied to a specific EOL host, a fleet-wide CRITICAL is operationally unusable.

Why not lower?

MEDIUM would ignore the compounding reality that these hosts will *never* receive another security patch. Every kernel, glibc, OpenSSL, and sudo CVE published from EOL day forward is a permanent exposure. Ransomware initial-access brokers explicitly hunt EOL Linux/Solaris in ShadowServer and GreyNoise telemetry — this is not backlog hygiene.

1. Inventory and role-tag every 33850 hit — Export the plugin 33850 finding set and enrich with CMDB role data (DC, hypervisor, edge, DB, workstation). Anything role-tagged identity/hypervisor/edge/backup/CI moves to the CRITICAL queue; the rest stays HIGH. Complete within 30 days per the noisgate HIGH mitigation SLA.
2. Purchase extended support where migration will slip — For hosts you cannot retire inside the noisgate remediation window, buy RHEL ELS, Ubuntu Pro ESM, TuxCare ELS, Oracle Solaris ESU, or IBM AIX SWMA extension. This restores patch coverage for the frozen CVEs and converts the finding from HIGH to MEDIUM until migration completes.
3. Segment and firewall the EOL hosts — Move EOL hosts behind a dedicated VLAN with default-deny east-west, and front any exposed service with a WAF or reverse proxy that terminates TLS on a supported OS. Deploy within 30 days. Assume the OS itself is untrustworthy.
4. Deploy a modern EDR / kernel-runtime agent — SentinelOne, CrowdStrike Falcon, or Elastic Defend on Linux catches syscall-level exploit behavior (pwnkit, Dirty Pipe) even when the underlying OS is unpatched. Confirm agent supports the EOL kernel — some vendors drop support along with the distro.
5. Rotate credentials and remove Tier-0 trust — Ensure no Domain Admin, root SSH keys, or PAM secrets live on or trust the EOL host. Break lateral-movement paths so that when — not if — the host is popped, the blast radius stays local.
6. Commit to a migration date with executive sign-off — Register every 33850 host in an exception register with a hard replacement date inside the 180-day noisgate HIGH remediation SLA (or ≤90 days for CRITICAL role-tagged hosts). Exceptions without a target date are how EOL fleets grow.

Run on the target Unix/Linux host as any user (root not required). Invoke as ./check_eol.sh — no arguments. Exit code 2 = VULNERABLE (EOL), 0 = PATCHED (supported), 1 = UNKNOWN. Cross-checks against endoflife.date release windows shipped as a static table.

#!/usr/bin/env bash
# noisgate: Tenable plugin 33850 verifier — Unix/Linux OS lifecycle check
# Exit codes: 0 PATCHED, 1 UNKNOWN, 2 VULNERABLE
set -u

today_epoch=$(date +%s)
result="UNKNOWN"
detail=""

to_epoch() { date -d "$1" +%s 2>/dev/null || echo 0; }

check_eol() {
  local name="$1" ver="$2" eol_date="$3"
  local eol_epoch
  eol_epoch=$(to_epoch "$eol_date")
  if [ "$eol_epoch" -eq 0 ]; then result="UNKNOWN"; return; fi
  if [ "$today_epoch" -gt "$eol_epoch" ]; then
    result="VULNERABLE"
    detail="$name $ver reached vendor EOL on $eol_date"
  else
    result="PATCHED"
    detail="$name $ver supported until $eol_date"
  fi
}

if [ -r /etc/os-release ]; then
  . /etc/os-release
  ID_LC=$(echo "${ID:-unknown}" | tr '[:upper:]' '[:lower:]')
  VER="${VERSION_ID:-unknown}"
  case "$ID_LC" in
    rhel|centos|rocky|almalinux)
      case "${VER%%.*}" in
        5) check_eol "RHEL-family" "$VER" "2017-03-31" ;;
        6) check_eol "RHEL-family" "$VER" "2020-11-30" ;;
        7) check_eol "RHEL-family" "$VER" "2024-06-30" ;;
        8) [ "$ID_LC" = "centos" ] && check_eol "CentOS" "$VER" "2021-12-31" || check_eol "RHEL-family" "$VER" "2029-05-31" ;;
        9) check_eol "RHEL-family" "$VER" "2032-05-31" ;;
        *) result="UNKNOWN" ;;
      esac ;;
    ubuntu)
      case "$VER" in
        14.04) check_eol "Ubuntu" "$VER" "2019-04-30" ;;
        16.04) check_eol "Ubuntu" "$VER" "2021-04-30" ;;
        18.04) check_eol "Ubuntu" "$VER" "2023-05-31" ;;
        20.04) check_eol "Ubuntu" "$VER" "2025-05-31" ;;
        22.04) check_eol "Ubuntu" "$VER" "2027-05-31" ;;
        24.04) check_eol "Ubuntu" "$VER" "2029-05-31" ;;
        *) result="UNKNOWN" ;;
      esac ;;
    debian)
      case "${VER%%.*}" in
        8) check_eol "Debian" "$VER" "2020-06-30" ;;
        9) check_eol "Debian" "$VER" "2022-06-30" ;;
        10) check_eol "Debian" "$VER" "2024-06-30" ;;
        11) check_eol "Debian" "$VER" "2026-08-31" ;;
        12) check_eol "Debian" "$VER" "2028-06-30" ;;
        *) result="UNKNOWN" ;;
      esac ;;
    sles|suse)
      case "${VER%%.*}" in
        11) check_eol "SLES" "$VER" "2019-03-31" ;;
        12) check_eol "SLES" "$VER" "2024-10-31" ;;
        15) check_eol "SLES" "$VER" "2031-07-31" ;;
        *) result="UNKNOWN" ;;
      esac ;;
    *) result="UNKNOWN"; detail="Unrecognized distro: $ID_LC $VER" ;;
  esac
elif [ "$(uname -s)" = "SunOS" ]; then
  REL=$(uname -r)
  case "$REL" in
    5.9)  check_eol "Solaris" "9"  "2014-10-31" ;;
    5.10) check_eol "Solaris" "10" "2021-01-31" ;;
    5.11) check_eol "Solaris" "11" "2034-11-30" ;;
    *) result="UNKNOWN" ;;
  esac
elif [ "$(uname -s)" = "AIX" ]; then
  REL=$(oslevel 2>/dev/null || echo unknown)
  case "$REL" in
    5.*|6.*) check_eol "AIX" "$REL" "2017-04-30" ;;
    7.1*)    check_eol "AIX" "$REL" "2023-04-30" ;;
    7.2*)    check_eol "AIX" "$REL" "2028-04-30" ;;
    7.3*)    check_eol "AIX" "$REL" "2033-04-30" ;;
    *) result="UNKNOWN" ;;
  esac
elif [ "$(uname -s)" = "Darwin" ]; then
  MAJ=$(sw_vers -productVersion 2>/dev/null | awk -F. '{print $1}')
  case "$MAJ" in
    10) check_eol "macOS" "$(sw_vers -productVersion)" "2020-11-01" ;;
    11) check_eol "macOS" "11" "2023-09-30" ;;
    12) check_eol "macOS" "12" "2024-11-30" ;;
    13) check_eol "macOS" "13" "2025-11-30" ;;
    14) check_eol "macOS" "14" "2026-11-30" ;;
    15) check_eol "macOS" "15" "2027-11-30" ;;
    *) result="UNKNOWN" ;;
  esac
fi

echo "[noisgate:33850] $result — $detail"
case "$result" in
  PATCHED)    exit 0 ;;
  VULNERABLE) exit 2 ;;
  *)          exit 1 ;;
esac

Sources

1. Tenable plugin 33850 overview
2. Tenable plugin 33850 dependencies
3. Tenable plugin 33850 changelog
4. Tenable Community — how to handle 33850
5. NetApp KB — ONTAP flagged by plugin 33850
6. endoflife.date — vendor EOL calendar
7. CISA KEV catalog (for implied CVEs like pwnkit)
8. Ubuntu Pro ESM overview