Cisco Secure Endpoint ClamAV OLE2 File Format Decryption DoS (cisco-sa-clamav-ole2-H549rphA)

#TRUSTED 87d3d411e5827b9766c77e4712f09ccd5c1e9cb73fb9a955039f0b1a3b7676acd40792e4fd1937a25c18606ff5b17c26f47dac14a6ad9af10234c40cc6d1ecf72f9c39c8b78fa55eb7a5ed3dcaf47e02ce7d2dbcc44eaa9c9592d030eb4fdd9c67ae75fc2cb2431cce28c740f649b41bc486d7d35f51b7f6d432e7ada7c9e5c2204d53171c64858893fa44c4c64321b5e07d615ee4f13386cb85fcc0e0f67b6e1016b12a2fea0d2bbe14e450983e94ee8d0b1735ee831f7c7fa2f821c412e80dc247f7b8a7207f14e66126c364b2efb62bdf32212bb7e72efa6eaa320a3bf013bacd61f8e599e8c6931f449a77aabac9147db759e46a9a12f941966488bc6552b3089bd9c8457f19497c009a1bc64abcfdff9936c04323ed11507d99e96a4a629976e8b3f4b9ff73d99eedc431ae92b7b0777438b603edcd4dce74ebef77f61209b3e8a950a8bbcd21d7f8a033133901489e6912f0f20702c1dd5f28327b7503cb0f09d2783de8d1dd094acef723a47f7a51f55720eb797132e9b9fed7805fc578b06415ad274fe5082a967c6725f3e9b2b2cb20a49c5213528bb76121ac56ca5a27de031769e0d4c64bdcb57b862df59821eda749838867bed6bf4a0a1f24ad237307f09a9a3bba5bc2a02411e91d22f90bfdd9907ef2f0fa7b60f4980cf7eae24a5ad646be32a2d9fb230882d3b65994cfc07623b9ed01e8511834a9943bda
#TRUST-RSA-SHA256 87913bec1e679fc8e924cf7781f8bbebb3aa0f157f7dd7611c34b3b82894941a6dc26dc51507aff970203b9309a01679cc0d266c39f259c483577cdfde8ef54235b0f84d969f7e95f79d6d7e1b6ae0374f0c30924ade4f936b66dd1b1cecd8d332c5fa0dc7a090ab238d97c4c0da978eca1834487c80a5b3f428bb4385ef813d5813ab3e25876664da591797879b50bdac987b97ff86048846b161266b5be2e4efea90c10abe2329e53d1d9c80e30e128614a97c7ead16ec3927629de531dafc9f43ffbcb07c868e10f5ca36ca72f38656918dbac10519ea38bb0ad2c9b67a281cf39ecdbc1bac2f95e6563c0225bc29ac5e6b801d0fefe0d7de67c2e516e0a699f1e820243bbf1552ccdfe26736c7c5090711a713d11954f1f9784f7f1439a70f7729a219a02235d58232803e945d6a6f3987537a50173970fafcccadebb562c07b0b99d6bed00ea8ac2b05bf0ab22e6dad9a6b1bbef0dab596f3c78baacde9fbb0837399fa7048fc57b3a30dfecdf971c75737dba73ad4affb994419bb23f77e129b6de8980ca0b7e883c9dcb3e5f5684664e501e1857cd9ed0ca9b0d13da6cb80b22170ac36f0bc7c1cc2bf0d67a5ab47e89aca21871b57ada49c5a9ecff21a9592bd9fa933218d9d5eb91e1c8f23fabf04a6e4fee6ea88a8843ea8eb5a696980a4f10dd6eaba16889195cc40521fbd043d320df99290445997808b4df60e
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(214849);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/30");

  script_cve_id("CVE-2025-20128");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwm89781");
  script_xref(name:"CISCO-SA", value:"cisco-sa-clamav-ole2-H549rphA");
  script_xref(name:"IAVA", value:"2025-A-0066-S");

  script_name(english:"Cisco Secure Endpoint ClamAV OLE2 File Format Decryption DoS (cisco-sa-clamav-ole2-H549rphA)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Secure Endpoint Connector for ClamAV is affected by a
vulnerability.

  - A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an
    unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This
    vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow
    read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to
    be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the
    ClamAV scanning process, resulting in a DoS condition on the affected software. For a description of this
    vulnerability, see the . Cisco has released software updates that address this vulnerability. There are no
    workarounds that address this vulnerability. (CVE-2025-20128)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-ole2-H549rphA
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?78f287fd");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwm89781");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwm89781");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20128");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(122);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/01/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/01/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/01/31");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:secure_endpoint");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_secure_endpoint_win_installed.nbin");
  script_require_keys("installed_sw/Cisco Secure Endpoint", "SMB/Registry/Enumerated");

  exit(0);
}

include('vcf.inc');

get_kb_item_or_exit('SMB/Registry/Enumerated');

var app_info = vcf::get_app_info(app:'Cisco Secure Endpoint', win_local:TRUE);

var constraints = [
  { 'min_version' : '0.0',  'fixed_version' : '7.5.20' },
  { 'min_version' : '8.0',  'fixed_version' : '8.4.3' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);