Cisco Secure Endpoint Multiple ClamAV DoS (cisco-sa-clamav-WuuvVd26)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(335452);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/14");

  script_cve_id(
    "CVE-2026-20337",
    "CVE-2026-20338",
    "CVE-2026-20339",
    "CVE-2026-20345",
    "CVE-2026-20346",
    "CVE-2026-20347",
    "CVE-2026-20348"
  );
  script_xref(name:"CISCO-BUG-ID", value:"CSCwu34288");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwu59475");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwu65985");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwu78432");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwu99410");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwv57797");
  script_xref(name:"CISCO-SA", value:"cisco-sa-clamav-WuuvVd26");
  script_xref(name:"IAVB", value:"2026-B-0225");

  script_name(english:"Cisco Secure Endpoint Multiple ClamAV DoS (cisco-sa-clamav-WuuvVd26)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Secure Endpoint is affected by multiple denial of service vulnerabilities.

  - A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to
    cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for
    content in zip files during scanning, which may result in an out-of-bounds write condition. An attacker
    could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could
    allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the
    affected software. (CVE-2026-20337)

  - A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to
    cause a DoS condition on an affected device. This vulnerability is due to improper memory handling when
    processing content in zip files during scanning. An attacker could exploit this vulnerability by
    submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the
    ClamAV scanning process to terminate as a result of a memory double-free, resulting in a DoS condition on
    the affected software. (CVE-2026-20338)

  - A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker
    to cause a DoS condition or possibly other expanded impacts as a result ofmemory corruption on an
    affected device. This vulnerability is due to improper boundary checks for content in PESpin files during
    scanning, which may result in an integer overflow. An attacker could exploit this vulnerability by
    submitting a crafted file that contains PESpin content to be scanned by ClamAV on an affected device. A
    successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting
    in a DoS condition on the affected software. (CVE-2026-20339)

  - A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to
    cause a DoS condition or possibly other expanded impacts as a result ofmemory corruption on an
    affected device. This vulnerability is due to improper boundary checks for content in XAR files during
    scanning. An attacker could exploit this vulnerability by submitting a crafted file that contains XAR
    content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to
    cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
    (CVE-2026-20348)

  - A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to
    cause a DoS condition or possibly other expanded impacts as a result ofmemory corruption on an
    affected device. This vulnerability is due to improper handling of an endian conversion operation, which
    may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a
    crafted GPT file to be scanned by ClamAV on an affected device. A successful exploit could allow the
    attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected
    software. (CVE-2026-20345)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-WuuvVd26
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?20148de3");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu34288");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu59475");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu65985");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu78432");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu99410");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwv57797");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwu34288, CSCwu59475, CSCwu65985, CSCwu78432,
CSCwu99410, CSCwv57797");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-20337");

  script_cwe_id(120, 121, 125);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/14");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:secure_endpoint");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_secure_endpoint_win_installed.nbin", "cisco_secure_endpoint_connector_mac_installed.nbin", "cisco_secure_endpoint_connector_nix_installed.nbin");
  script_require_ports("installed_sw/Cisco Secure Endpoint", "installed_sw/Cisco Secure Endpoint Connector");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'requires': [{'scope': 'target', 'match': {'os': 'windows'}}],
      'product': {'name': 'Cisco Secure Endpoint', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        { 'fixed_version': '7.5.24.21780' },
        { 'min_version': '8', 'fixed_version': '8.6.3' }
      ]
    },
    {
      'requires': [{'scope': 'target', 'match': {'os': 'linux'}}],
      'product': {'name': 'Cisco Secure Endpoint Connector', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        { 'fixed_version': '1.29.2' }
      ]
    },
    {
      'requires': [{'scope': 'target', 'match': {'os': 'macos'}}],
      'product': {'name': 'Cisco Secure Endpoint Connector', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        { 'fixed_version': '1.27.4' }
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);