Cisco Secure Endpoint Multiple ClamAV DoS (cisco-sa-clamav-88cFYyxR)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(324975);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/03");

  script_cve_id(
    "CVE-2026-20213",
    "CVE-2026-20214",
    "CVE-2026-20215",
    "CVE-2026-20216",
    "CVE-2026-20217",
    "CVE-2026-20243",
    "CVE-2026-20244"
  );
  script_xref(name:"CISCO-BUG-ID", value:"CSCwt81501");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwt81503");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwt81504");
  script_xref(name:"CISCO-SA", value:"cisco-sa-clamav-88cFYyxR");
  script_xref(name:"IAVA", value:"2026-A-0653");

  script_name(english:"Cisco Secure Endpoint Multiple ClamAV DoS (cisco-sa-clamav-88cFYyxR)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Secure Endpoint is affected by multiple vulnerabilities.

  - A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to
    cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected
    device. This vulnerability is due to improper boundary checks for content in PE files during scanning,
    which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by
    submitting a crafted file that contains PE content to be scanned by ClamAV on an affected device. A
    successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting
    in a DoS condition on the affected software. (CVE-2026-20213)

  - A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attacker to
    cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected
    device. This vulnerability is due to improper boundary checks for content in FSG files during scanning,
    which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by
    submitting a crafted file that contains portable executable content compressed with FSG to be scanned by
    ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning
    process to terminate, resulting in a DoS condition on the affected software. (CVE-2026-20214)

  - A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attacker to
    cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected
    device. This vulnerability is due to improper boundary checks for content in 7z files during scanning,
    which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by
    submitting a crafted file that contains 7z content to be scanned by ClamAV on an affected device. A
    successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting
    in a DoS condition on the affected software. (CVE-2026-20215)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-88cFYyxR
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0218276a");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwt81501");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwt81503");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwt81504");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwt81501, CSCwt81503, CSCwt81504.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-20213");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/03");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:secure_endpoint");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_secure_endpoint_win_installed.nbin", "cisco_secure_endpoint_connector_mac_installed.nbin", "cisco_secure_endpoint_connector_nix_installed.nbin");
  script_require_ports("installed_sw/Cisco Secure Endpoint", "installed_sw/Cisco Secure Endpoint Connector");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'requires': [{'scope': 'target', 'match': {'os': 'windows'}}],
      'product': {'name': 'Cisco Secure Endpoint', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        { 'fixed_version': '8.6.2' }
      ]
    },
    {
      'requires': [{'scope': 'target', 'match': {'os': 'linux'}}],
      'product': {'name': 'Cisco Secure Endpoint Connector', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        { 'fixed_version': '1.29.0' }
      ]
    },
    {
      'requires': [{'scope': 'target', 'match': {'os': 'macos'}}],
      'product': {'name': 'Cisco Secure Endpoint Connector', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        { 'fixed_version': '1.27.2' }
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);