Apache Traffic Server 5.2.0 - 5.3.2 / 6.x < 6.2.2 / 7.x < 7.1.2 TLS Handshake DoS

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(107228);
  script_version("1.3");
  script_cvs_date("Date: 2019/11/08");

  script_cve_id("CVE-2017-7671");

  script_name(english:"Apache Traffic Server 5.2.0 - 5.3.2 / 6.x < 6.2.2 / 7.x < 7.1.2 TLS Handshake DoS");
  script_summary(english:"Checks the version of Apache Traffic Server.");

  script_set_attribute(attribute:"synopsis", value:
"The remote caching server is affected by an input-validation vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its banner, the version of Apache Traffic Server running
on the remote host is between 5.2.0 and 5.3.2, 6.x prior to 6.2.2 or
7.x prior to 7.1.2. It is, therefore, affected by a flaw related to
handling TLS handshakes that allows a remote attacker to crash the
application.


Note that Nessus has not tested for this issue but has instead
relied only on the application's self-reported version number.");
  # https://lists.apache.org/thread.html/203bdcf9bbb718f3dc6f7aaf3e2af632474d51fa9e7bfb7832729905@%3Cdev.trafficserver.apache.org%3E
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?cb325357");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache Traffic Server version 6.2.2, 7.1.2 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-7671");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/02/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/02/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/03/08");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:traffic_server");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("apache_traffic_server_version.nasl", "npn_protocol_enumeration.nasl");
  script_require_keys("www/apache_traffic_server");
  script_require_ports("Services/www", 8080);

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");

app = 'Apache Traffic Server';
port = get_http_port(default:8080);

# Make sure this is Apache Traffic Server
get_kb_item_or_exit('www/'+port+'/apache_traffic_server');

# Check if we could get a version
version   = get_kb_item_or_exit('www/'+port+'/apache_traffic_server/version', exit_code:1);
source    = get_kb_item_or_exit('www/'+port+'/apache_traffic_server/source', exit_code:1);

# Is numeric
if (version !~ "^[0-9.]+$")
  audit(AUDIT_NONNUMERIC_VER, app, port, version);

# Is proper branch
if (version !~ "^[567]($|[^0-9])")
  audit(AUDIT_NOT_LISTEN, app + " 5.x / 6.x / 7.x", port);

# Is granular enough
if (
  version =~ "^5(\.[23])?$" ||
  version =~ "^6(\.2)?$" ||
  version =~ "^7(\.1)?$"
)
  audit(AUDIT_VER_NOT_GRANULAR, app, port, version);

if (
  (
    version =~ "^5\." &&
    ver_compare(ver:version, fix:'5.2.0', strict:FALSE) >= 0 &&
    ver_compare(ver:version, fix:'5.3.2', strict:FALSE) <= 0
  )
  ||
  (
    version =~ "^6\." &&
    ver_compare(ver:version, fix:'6.2.2', strict:FALSE) < 0
  )
  ||
  (
    version =~ "^7\." &&
    ver_compare(ver:version, fix:'7.1.2', strict:FALSE) < 0
  )
)
{
  report =
    '\n  Version source    : ' + source +
    '\n  Installed version : ' + version +
    '\n  Fixed version     : 6.2.2 / 7.1.2' +
    '\n';
  security_report_v4(port:port, severity:SECURITY_WARNING, extra:report);
  exit(0);
}
else audit(AUDIT_LISTEN_NOT_VULN, app, port, version);