Cisco IOS Smart Install Packet Image List Parameter Handling DoS (cisco-sa-20160323-smi)

2016-04-06T00:00:00
ID CISCO-SA-20160323-SMI-IOS.NASL
Type nessus
Reporter This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
Modified 2019-11-20T00:00:00

Description

According to its self-reported version, the Cisco IOS software running on the remote device is affected by a denial of service vulnerability in the Smart Install client feature due to improper handling of image list parameters. An unauthenticated, remote attacker can exploit this issue, via crafted Smart Install packets, to cause the device to reload.

                                        
                                            #TRUSTED 0102e7ade2f7d80ac14c4280273b80883994a354aedc4ec8579a7339a39191bbe7af40281fa5dfd528b6e066b6a0fab2fd315d501ce9398640392d0ff98c4d939c32846f9fe9a41595443b2f7aa69d97cd8ec52f83e4e9ba478de0d241f00215c7d86fb91327a0aaf3bdcdc0f475fa974b63e5d9b9cc037b987d7640ca5211dc8a3697a2b054aa446754611fa85e6d4c60f8d4c9ce05736a210be9792dce87d356e262cc154c65ee0c3df9e8f2632cf38192bb3c90c68ce331e3f5796fe4428f04809a95d78e986c30a6ce31bf6a05cb55184ec6fd6b96412f360e2fa37b2ff996cc91d9805d857fd8c395e2b315659352b057ce5da7474c0926a9a5810728268b7dcd6c6478fecb95d7174f2f12b3589560c98a058d4406fc2d7a36b38fccc950a4983b538df117981a80755319527f99159a89261b6139945b53ec567907c388d5bba4d89a927d69cf2f661c381dbd7e86720ed3a9c848ac1a0fc5abb0cf1839c4d341dc0398af11325ae3ff0a3ccc0c0aa86f4142204ffd5880fa6247643e86d0e975faec305b3c51aa95dab98c9d78ef1a1e1a255bb3efc25d86f83f57a73f37abb30fc4c64d986615ad42c84df320068284a3d1f6e8f5e71235993ca9b98b842958e4cda5929512d580df1704526121cd6c45d84628d52f20d0cb7b922de0f1ca08dc679590e48dde68ef097c32e4d5867c07f6e8ba6ac4d18fe20d9b42
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(90358);
  script_version("1.12");
  script_cvs_date("Date: 2019/11/20");

  script_cve_id("CVE-2016-1349");
  script_xref(name:"TRA", value:"TRA-2016-04");
  script_xref(name:"CISCO-BUG-ID", value:"CSCuv45410");
  script_xref(name:"CISCO-SA", value:"cisco-sa-20160323-smi");

  script_name(english:"Cisco IOS Smart Install Packet Image List Parameter Handling DoS (cisco-sa-20160323-smi)");
  script_summary(english:"Checks the IOS version.");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the Cisco IOS software running
on the remote device is affected by a denial of service vulnerability
in the Smart Install client feature due to improper handling of image
list parameters. An unauthenticated, remote attacker can exploit this
issue, via crafted Smart Install packets, to cause the device to
reload.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160323-smi
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?14b003f9");
  script_set_attribute(attribute:"see_also", value:"https://www.tenable.com/security/research/tra-2016-04");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID
CSCuv45410. Alternatively, disable the Smart Install feature per the
vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-1349");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/03/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/03/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/04/06");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_version.nasl");
  script_require_keys("Host/Cisco/IOS/Version");

  exit(0);
}

include("audit.inc");
include("cisco_func.inc");
include("cisco_kb_cmd_func.inc");

flag = 0;
override = 0;

ver = get_kb_item_or_exit("Host/Cisco/IOS/Version");

# Check for vuln version
if ( ver == '12.2(35)EX' ) flag++;
if ( ver == '12.2(35)EX1' ) flag++;
if ( ver == '12.2(35)EX2' ) flag++;
if ( ver == '12.2(37)EX' ) flag++;
if ( ver == '12.2(40)EX' ) flag++;
if ( ver == '12.2(40)EX1' ) flag++;
if ( ver == '12.2(40)EX2' ) flag++;
if ( ver == '12.2(40)EX3' ) flag++;
if ( ver == '12.2(44)EX' ) flag++;
if ( ver == '12.2(44)EX1' ) flag++;
if ( ver == '12.2(46)EX' ) flag++;
if ( ver == '12.2(52)EX' ) flag++;
if ( ver == '12.2(52)EX1' ) flag++;
if ( ver == '12.2(53)EX' ) flag++;
if ( ver == '12.2(55)EX' ) flag++;
if ( ver == '12.2(55)EX1' ) flag++;
if ( ver == '12.2(55)EX2' ) flag++;
if ( ver == '12.2(55)EX3' ) flag++;
if ( ver == '12.2(58)EX' ) flag++;
if ( ver == '12.2(37)EY' ) flag++;
if ( ver == '12.2(44)EY' ) flag++;
if ( ver == '12.2(46)EY' ) flag++;
if ( ver == '12.2(53)EY' ) flag++;
if ( ver == '12.2(55)EY' ) flag++;
if ( ver == '12.2(58)EY' ) flag++;
if ( ver == '12.2(58)EY1' ) flag++;
if ( ver == '12.2(58)EY2' ) flag++;
if ( ver == '12.2(53)EZ' ) flag++;
if ( ver == '12.2(55)EZ' ) flag++;
if ( ver == '12.2(58)EZ' ) flag++;
if ( ver == '12.2(60)EZ' ) flag++;
if ( ver == '12.2(60)EZ1' ) flag++;
if ( ver == '12.2(60)EZ2' ) flag++;
if ( ver == '12.2(60)EZ3' ) flag++;
if ( ver == '12.2(60)EZ4' ) flag++;
if ( ver == '12.2(60)EZ5' ) flag++;
if ( ver == '12.2(60)EZ6' ) flag++;
if ( ver == '12.2(60)EZ7' ) flag++;
if ( ver == '12.2(60)EZ8' ) flag++;
if ( ver == '12.2(25)FZ' ) flag++;
if ( ver == '12.2(35)SE' ) flag++;
if ( ver == '12.2(35)SE1' ) flag++;
if ( ver == '12.2(35)SE2' ) flag++;
if ( ver == '12.2(35)SE3' ) flag++;
if ( ver == '12.2(35)SE4' ) flag++;
if ( ver == '12.2(35)SE5' ) flag++;
if ( ver == '12.2(37)SE' ) flag++;
if ( ver == '12.2(37)SE1' ) flag++;
if ( ver == '12.2(40)SE' ) flag++;
if ( ver == '12.2(40)SE1' ) flag++;
if ( ver == '12.2(40)SE2' ) flag++;
if ( ver == '12.2(44)SE' ) flag++;
if ( ver == '12.2(44)SE1' ) flag++;
if ( ver == '12.2(44)SE2' ) flag++;
if ( ver == '12.2(44)SE3' ) flag++;
if ( ver == '12.2(44)SE4' ) flag++;
if ( ver == '12.2(44)SE5' ) flag++;
if ( ver == '12.2(44)SE6' ) flag++;
if ( ver == '12.2(46)SE' ) flag++;
if ( ver == '12.2(46)SE1' ) flag++;
if ( ver == '12.2(46)SE2' ) flag++;
if ( ver == '12.2(50)SE' ) flag++;
if ( ver == '12.2(50)SE1' ) flag++;
if ( ver == '12.2(50)SE2' ) flag++;
if ( ver == '12.2(50)SE3' ) flag++;
if ( ver == '12.2(50)SE4' ) flag++;
if ( ver == '12.2(50)SE5' ) flag++;
if ( ver == '12.2(52)SE' ) flag++;
if ( ver == '12.2(52)SE1' ) flag++;
if ( ver == '12.2(53)SE' ) flag++;
if ( ver == '12.2(53)SE1' ) flag++;
if ( ver == '12.2(53)SE2' ) flag++;
if ( ver == '12.2(54)SE' ) flag++;
if ( ver == '12.2(55)SE' ) flag++;
if ( ver == '12.2(55)SE1' ) flag++;
if ( ver == '12.2(55)SE10' ) flag++;
if ( ver == '12.2(55)SE2' ) flag++;
if ( ver == '12.2(55)SE3' ) flag++;
if ( ver == '12.2(55)SE4' ) flag++;
if ( ver == '12.2(55)SE5' ) flag++;
if ( ver == '12.2(55)SE6' ) flag++;
if ( ver == '12.2(55)SE7' ) flag++;
if ( ver == '12.2(55)SE8' ) flag++;
if ( ver == '12.2(55)SE9' ) flag++;
if ( ver == '12.2(58)SE' ) flag++;
if ( ver == '12.2(58)SE1' ) flag++;
if ( ver == '12.2(58)SE2' ) flag++;
if ( ver == '12.2(25)SED' ) flag++;
if ( ver == '12.2(25)SED1' ) flag++;
if ( ver == '12.2(25)SEE' ) flag++;
if ( ver == '12.2(25)SEE1' ) flag++;
if ( ver == '12.2(25)SEE2' ) flag++;
if ( ver == '12.2(25)SEE3' ) flag++;
if ( ver == '12.2(25)SEE4' ) flag++;
if ( ver == '12.2(25)SEF1' ) flag++;
if ( ver == '12.2(25)SEF2' ) flag++;
if ( ver == '12.2(25)SEF3' ) flag++;
if ( ver == '12.2(25)SEG' ) flag++;
if ( ver == '12.2(25)SEG1' ) flag++;
if ( ver == '12.2(25)SEG2' ) flag++;
if ( ver == '12.2(25)SEG3' ) flag++;
if ( ver == '12.2(25)SEG4' ) flag++;
if ( ver == '12.2(25)SEG5' ) flag++;
if ( ver == '12.2(25)SEG6' ) flag++;
if ( ver == '15.0(2)EB' ) flag++;
if ( ver == '15.0(2)EC' ) flag++;
if ( ver == '15.0(2)ED' ) flag++;
if ( ver == '15.0(2)ED1' ) flag++;
if ( ver == '15.0(2)EH' ) flag++;
if ( ver == '15.0(2)EJ' ) flag++;
if ( ver == '15.0(2)EJ1' ) flag++;
if ( ver == '15.0(2)EK' ) flag++;
if ( ver == '15.0(2)EK1' ) flag++;
if ( ver == '15.0(1)EX' ) flag++;
if ( ver == '15.0(2)EX' ) flag++;
if ( ver == '15.0(2)EX1' ) flag++;
if ( ver == '15.0(2)EX2' ) flag++;
if ( ver == '15.0(2)EX3' ) flag++;
if ( ver == '15.0(2)EX4' ) flag++;
if ( ver == '15.0(2)EX5' ) flag++;
if ( ver == '15.0(2)EX8' ) flag++;
if ( ver == '15.0(2a)EX5' ) flag++;
if ( ver == '15.0(1)EY' ) flag++;
if ( ver == '15.0(1)EY1' ) flag++;
if ( ver == '15.0(1)EY2' ) flag++;
if ( ver == '15.0(2)EY' ) flag++;
if ( ver == '15.0(2)EY1' ) flag++;
if ( ver == '15.0(2)EY2' ) flag++;
if ( ver == '15.0(2)EY3' ) flag++;
if ( ver == '15.0(2)EZ' ) flag++;
if ( ver == '15.0(1)SE' ) flag++;
if ( ver == '15.0(1)SE1' ) flag++;
if ( ver == '15.0(1)SE2' ) flag++;
if ( ver == '15.0(1)SE3' ) flag++;
if ( ver == '15.0(2)SE' ) flag++;
if ( ver == '15.0(2)SE1' ) flag++;
if ( ver == '15.0(2)SE2' ) flag++;
if ( ver == '15.0(2)SE3' ) flag++;
if ( ver == '15.0(2)SE4' ) flag++;
if ( ver == '15.0(2)SE5' ) flag++;
if ( ver == '15.0(2)SE6' ) flag++;
if ( ver == '15.0(2)SE7' ) flag++;
if ( ver == '15.2(1)E' ) flag++;
if ( ver == '15.2(1)E1' ) flag++;
if ( ver == '15.2(1)E2' ) flag++;
if ( ver == '15.2(1)E3' ) flag++;
if ( ver == '15.2(2)E' ) flag++;
if ( ver == '15.2(2)E1' ) flag++;
if ( ver == '15.2(2)E2' ) flag++;
if ( ver == '15.2(2)E3' ) flag++;
if ( ver == '15.2(2a)E1' ) flag++;
if ( ver == '15.2(2a)E2' ) flag++;
if ( ver == '15.2(3)E' ) flag++;
if ( ver == '15.2(3)E1' ) flag++;
if ( ver == '15.2(3)E2' ) flag++;
if ( ver == '15.2(3a)E' ) flag++;
if ( ver == '15.2(3m)E2' ) flag++;
if ( ver == '15.2(3m)E3' ) flag++;
if ( ver == '15.2(2)EB' ) flag++;
if ( ver == '15.2(2)EB1' ) flag++;
if ( ver == '15.2(1)EY' ) flag++;
if ( ver == '15.2(2)EA1' ) flag++;
if ( ver == '15.2(2)EA2' ) flag++;
if ( ver == '15.2(3)EA' ) flag++;

# Check for Smart Install client feature
if (flag && get_kb_item("Host/local_checks_enabled"))
{
  flag = 0;

  buf = cisco_command_kb_item("Host/Cisco/Config/show_vstack_config", "show vstack config");
  if (check_cisco_result(buf))
  {
    if ( (preg(multiline:TRUE, pattern:"Role:\s*[Cc]lient", string:buf)) &&
         (!preg(multiline:TRUE, pattern:"Role:\s*[Cc]lient\s+\(SmartInstall disabled\)", string:buf)) ) { flag = 1; }
  }
  else if (cisco_needs_enable(buf))
  {
    flag = 1;
    override = 1;
  }
}

if (flag)
{
  if (report_verbosity > 0)
  {
    report =
      '\n  Cisco bug ID      : CSCuv45410' +
      '\n  Installed release : ' + ver +
      '\n';
    security_hole(port:0, extra:report + cisco_caveat(override));
    exit(0);
  }
  else security_hole(port:0, extra:cisco_caveat(override));
}
else audit(AUDIT_HOST_NOT, "affected");