Cisco IOS XE Software Simple Network Management Protocol Double-Free DoS (cisco-sa-20180328-snmp-dos)

#TRUSTED 8ce0a664d690b42836e258ffacd7a6ae8cb6e90f12cb3f3b091364112241f5c9de22fbf0b3fd35d80a458a3ba3f127633f0818247f61d1c12f899c535d816b05c105c505a38dd16e8204cef6dc0f07606e71bc718e9d1aabcae7e9d240cf2330d2092760f85e97eb2636738fb493e690a5b20e1d786fe12d949c84df3bd3126075a7908fd33de6e9aea4ed2f671fd8c078cf0c1dd872b60040c750c407fed32a26837a0b4b7478581e2a17e112be0a2bbc687752694ef91a6c9577f6591b8b12d87a25d5438ccac32e3f7938d11736e51458d29e444b26ff7eb314fea654788bd651fb76ef2f514daa484449222e5e6b3432293b225cd67acb324b297d876afd26d5e4883c0ef52592b4cbbe1330f2ad58b6207252aafa34f502b6b3517b16e51b224d877e034420fa5b02d750c0382c2c9be9930bc9979edb697a4d21656bd5cbe7eb45ee7cf53f88400f4adb41df4613bfd0f306abd0ae7a6c09cab90cae2ef9fcbfe4786e7b29aa06a1ce1f0477531d1d6a487c3efef7f51f0902be4ddd3dd1ec241779c7cc359a73d7d929c0a5bc05038c327c61f58ea103c91ef968527b1d244f9c6d2bc6a78aadadc5d620f73eb2792735dae7f2e78eea40317d70ff85ba950ea418c53584660a905e5b82bbc29e97751ba1edfad3b73ff074a15cc1572734ff3e14829e1bfdd8a79777d5f8ef0a106cb343822de1676b8948fdb7d9ce
#TRUST-RSA-SHA256 23e6967fd8d7ac67dd35397c1b505bc326b93c8aaa460514fd565f5ac841fec7e2f45ea03fe209817394dfa6db5f29be9f9fec64e0493d2b9bdf93c05e4fadc23a3cbb06d9f2709cbaeb7652824ca759e2555fb47f589461c9ff124b519709d91eb6136cc2cc71307fa7026222e36a274ed93895d69a238e5b0f9cabe38bd9dd4a19869aa024f67610ac6841a8759751ead6ceb1e0ffa79d4ed5d51855fc007de647108529f2afe585162b36f8c035488727d0650a64fac596d8c585edf09cf5796fad2ad988c86d5c9edd28c64c43206d77a8853bcfec7b0b9f2eca081fde2f78393bb73e97a1d4569b54cd4554822880e92eb1f916672dedaba87c71c3e3db39388831ce4f8bd2cbe457e60db1dae1225f694ca3cfa03ad40efb512c165cafdcd9492730e89dbebaffc205937bd7952cef7cd681850223c386b1505b791d96146abe000a69916c978be2b7c7e07738c8b6e7a31be3c76e587162d7ebc48d135eed95637fc246b63bcdde8966fff7cdd3df06c5e7cf0bd0136ac8d3659ed9069bde07ffad26e82d1dfafd86200e8f8ba8ccfba4c38e1a45b7c149e76c8c524e41d4b18a3eeb2db960a25dd804eee81dc01c89961b2db9a9666e06a32143ce275d46838e23f0fa291e3da2c2e2bb5a92677a076dfc07fe5805cda5c80828e4c0d609ad6ce09b3175516da75bc82ab2e70b934ad84a8231d8dad18448569f5c4b
#
# (C) Tenable Network Security, Inc.
#

include('compat.inc');

if (description)
{
  script_id(132039);
  script_version("1.7");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/05/03");

  script_cve_id("CVE-2018-0160");
  script_bugtraq_id(103575);
  script_xref(name:"CISCO-BUG-ID", value:"CSCve75818");
  script_xref(name:"CISCO-SA", value:"cisco-sa-20180328-snmp-dos");

  script_name(english:"Cisco IOS XE Software Simple Network Management Protocol Double-Free DoS (cisco-sa-20180328-snmp-dos)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS XE Software is affected by a denial of service (DoS) vulnerability in
the Simple Network Management Protocol (SNMP) subsystem  due to improper management of memory resources, referred to as
a double free. An authenticated, remote attacker can exploit this vulnerability by sending crafted SNMP packets to an
affected device in order to cause the affected device to reload, resulting in a DoS condition.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-snmp-dos
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0b77f9f4");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCve75818");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID(s) CSCve75818.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-0160");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/03/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/03/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/12/13");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xe");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2019-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_xe_version.nasl");
  script_require_keys("Host/Cisco/IOS-XE/Version");

  exit(0);
}

include('cisco_workarounds.inc');
include('ccf.inc');

product_info = cisco::get_product_info(name:'Cisco IOS XE Software');

version_list = make_list(
  '3.15.0S',
  '3.15.1S',
  '3.15.2S',
  '3.15.1cS',
  '3.15.3S',
  '3.15.4S',
  '3.16.0S',
  '3.16.1S',
  '3.16.1aS',
  '3.16.2S',
  '3.16.0bS',
  '3.16.0cS',
  '3.16.3S',
  '3.16.2bS',
  '3.16.4aS',
  '3.16.4bS',
  '3.16.4gS',
  '3.16.5S',
  '3.16.4cS',
  '3.16.4dS',
  '3.16.4eS',
  '3.16.6S',
  '3.16.5aS',
  '3.16.5bS',
  '3.16.6bS',
  '3.17.0S',
  '3.17.1S',
  '3.17.2S',
  '3.17.1aS',
  '3.17.3S',
  '3.17.4S',
  '16.2.1',
  '16.2.2',
  '16.3.1',
  '16.3.2',
  '16.3.3',
  '16.3.1a',
  '16.3.4',
  '16.4.1',
  '16.4.2',
  '16.5.1',
  '16.5.1b',
  '16.5.2',
  '3.18.0aS',
  '3.18.1S',
  '3.18.0SP',
  '3.18.1SP',
  '3.18.1aSP',
  '3.18.1gSP',
  '3.18.2SP',
  '3.18.1hSP',
  '3.18.2aSP',
  '3.18.1iSP',
  '3.18.3SP',
  '3.18.3aSP',
  '3.18.3bSP',
  '16.6.1'
);

workarounds = make_list(CISCO_WORKAROUNDS['snmp']);
workaround_params = make_list();

reporting = make_array(
  'port'     , product_info['port'], 
  'severity' , SECURITY_WARNING,
  'version'  , product_info['version'],
  'bug_id'   , 'CSCve75818',
  'cmds'     , make_list('show running-config')
);

cisco::check_and_report(
  product_info:product_info,
  workarounds:workarounds,
  workaround_params:workaround_params,
  reporting:reporting,
  vuln_versions:version_list
);