Cisco IOS XE Software HTTP Server Telephony Services DoS (cisco-sa-httpsrvr-dos-yOZThut)

#TRUSTED 9d56ab39614e72d89fdcfe5f03b9c1af7de178b7a1371acb7e957753bd4399bfd961f23ae9d965ea8de4946319bf685478e60ab06e9563c821992370573484bf89be59948761e53057466e2049066d1ec3815f6b2dc0b9ae374ccd1d23e68391d922a62ee214398db4c7771e84698b3583ba0f189e6f39c1ec27ff1241beb5bd1d69deac6887dc780aee79bf33e3a4349143a8eaf5c2d800df12496ec1d1565cf91fed5626d8510c64e1f5e5e53c2b3498e021848dcc5656e35eb0d1d5cfedd7476fb106ecb710954837df439e31d7ac4ea658318d536409e1a8bc606062a62ebb3c5dc7a4e6117b152be3bbc818bdbbdbff328b557019d32bb335fbc2bb4fc2e1e90ec3011f736be3e190fd4f0fa0cac5fc53a3f51a1424bc104ba8c38223b075233e77438e2f58dacb00070308e3f42fd0c7cb10a9b76b3553939d743ed55d86c92b9c0b8512de88b4ca9fc286937fcb1002994aa7aa6b1a0989179800de7c456ba90e011e37afcd910b03b6f29dfcf84d4ffc271d64df5c6ba656393f60fb563e8ac39b5d2ca3583cb8bbd2d463ceb97104342c6f4094096906d1c6ffa24b001675c5b776599132f5679e317381a50c8f70a3ebadf9f43d30395c343fd2734ac8e96e0b529e742a2b132bb1eb3985e76e8c651b08f341a02b562f57e6367c322850742a089f6ae8e4b996b3230909f0c150f1310838c9c4167605aa4d7ddb
#TRUST-RSA-SHA256 52a63b5b74091cb5083f9f0115aee1dfbed1ba8a2dccdf244331b6d9764fe5cee4a0ac69c78834b7e5265da8d04580c36c8d0c4acdc97575d12f3bb1d97c1a4fb8c5fb5c23ada1f83887411f63373a9b9f355c10f75239c13568582b4adf49a195007f5166b86be093382e3afa95afb8b2431abd12bab3629856e7241f1d7e93d211d8d192e4ce2e234e18d86f982067dda21d35f76e0a835bffe5ab00397297e2039024104ab3436ce8d15b175566b7b4dbc8b6ea4891a49f84f9b08dce8ba77e40e4f4a182af7572d7bd72109019913e8d7df476b6526a06b7f84dd95b64c8b368de67990d697c060bf6f916d74521abd1e43426d2a328fe5c61f5229646cb85fb930fcac8a94fca80593175c20bacdaa536bdd0319873c5f222d8eb4f49030854f51ff2bcc9128c56bd216b0d37d5cc343243cd1a9771bf685c4eb9ae31ce50ceafa8ca1396d39dce71c6ebf48a75748186321684d0ed33d6855ca852c6831d6905190755e86ea8df9507f6321b6f1b5b6b85585d9f850e4989ea81d0d5addc503d8ad4b3dd3fd02451d397a4f8754dcc4b246356cd62e39ecefecae8ae26fd86d0e209e7be64c38b9b922e7e6b225487c6061c2e2211a1db7e4cb4c85bbf7023e24fdda20e2cf419cc2c1c9c90add6e23287de33d6cbbaf109d7a27442f88d17510b1fdb8c1e6279580ddc16af7460a3a0ce46afe6f42a923237905b1ba0
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(207824);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/06/04");

  script_cve_id("CVE-2024-20436");
  script_xref(name:"IAVA", value:"2024-A-0592");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwh94964");
  script_xref(name:"CISCO-SA", value:"cisco-sa-httpsrvr-dos-yOZThut");

  script_name(english:"Cisco IOS XE Software HTTP Server Telephony Services DoS (cisco-sa-httpsrvr-dos-yOZThut)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS-XE Software is affected by a vulnerability.

  - A vulnerability in the HTTP Server feature of Cisco IOS XE Software when the Telephony Service feature is
    enabled could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an
    affected device. This vulnerability is due to a null pointer dereference when accessing specific URLs. An
    attacker could exploit this vulnerability by sending crafted HTTP traffic to an affected device. A
    successful exploit could allow the attacker to cause the affected device to reload, causing a DoS
    condition on the affected device. (CVE-2024-20436)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-httpsrvr-dos-yOZThut
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?75e02591");
  # https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75169
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e0341eea");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwh94964");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwh94964");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-20436");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(476);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/09/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/09/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/09/27");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xe");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2024-2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_xe_version.nasl");
  script_require_keys("Host/Cisco/IOS-XE/Version");

  exit(0);
}

include('cisco_workarounds.inc');
include('ccf.inc');

var product_info = cisco::get_product_info(name:'Cisco IOS XE Software');

var version_list=make_list(
  '3.9.0aS',
  '3.9.1S',
  '3.9.2S',
  '3.10.0S',
  '3.10.1S',
  '3.10.2S',
  '3.10.2aS',
  '3.10.2tS',
  '3.10.3S',
  '3.10.4S',
  '3.10.5S',
  '3.10.6S',
  '3.10.7S',
  '3.10.8S',
  '3.10.8aS',
  '3.10.9S',
  '3.10.10S',
  '3.11.0S',
  '3.11.1S',
  '3.11.2S',
  '3.11.3S',
  '3.11.4S',
  '3.12.0S',
  '3.12.1S',
  '3.12.2S',
  '3.12.3S',
  '3.12.4S',
  '3.13.0S',
  '3.13.1S',
  '3.13.2S',
  '3.13.3S',
  '3.13.4S',
  '3.13.5S',
  '3.13.6S',
  '3.13.6aS',
  '3.13.7S',
  '3.13.8S',
  '3.13.9S',
  '3.13.10S',
  '3.14.0S',
  '3.14.1S',
  '3.14.2S',
  '3.14.3S',
  '3.14.4S',
  '3.15.0S',
  '3.15.1S',
  '3.15.1cS',
  '3.15.2S',
  '3.15.3S',
  '3.15.4S',
  '3.16.0S',
  '3.16.0cS',
  '3.16.1aS',
  '3.16.2S',
  '3.16.3S',
  '3.16.4aS',
  '3.16.4bS',
  '3.16.4cS',
  '3.16.4dS',
  '3.16.4eS',
  '3.16.4gS',
  '3.16.5S',
  '3.16.5aS',
  '3.16.5bS',
  '3.16.6S',
  '3.16.6bS',
  '3.16.7S',
  '3.16.7aS',
  '3.16.7bS',
  '3.16.8S',
  '3.16.9S',
  '3.16.10S',
  '3.17.0S',
  '3.17.1S',
  '3.17.2S',
  '3.17.3S',
  '3.17.4S',
  '3.18.2aSP',
  '16.2.1',
  '16.2.2',
  '16.3.1',
  '16.3.1a',
  '16.3.2',
  '16.3.3',
  '16.3.4',
  '16.3.5',
  '16.3.6',
  '16.3.7',
  '16.3.8',
  '16.3.9',
  '16.3.10',
  '16.3.11',
  '16.4.1',
  '16.4.2',
  '16.4.3',
  '16.5.1',
  '16.5.1b',
  '16.5.2',
  '16.5.3',
  '16.6.1',
  '16.6.2',
  '16.6.3',
  '16.6.4',
  '16.6.4s',
  '16.6.5',
  '16.6.6',
  '16.6.7',
  '16.6.8',
  '16.6.9',
  '16.6.10',
  '16.7.1',
  '16.7.2',
  '16.7.3',
  '16.8.1',
  '16.8.1s',
  '16.8.2',
  '16.8.3',
  '16.9.1',
  '16.9.1s',
  '16.9.2',
  '16.9.2s',
  '16.9.3',
  '16.9.3s',
  '16.9.4',
  '16.9.5',
  '16.9.6',
  '16.9.7',
  '16.9.8',
  '16.9.8a',
  '16.10.1',
  '16.10.1a',
  '16.10.1b',
  '16.10.1e',
  '16.10.1s',
  '16.10.2',
  '16.10.3',
  '16.11.1',
  '16.11.1a',
  '16.11.1b',
  '16.11.1c',
  '16.11.1s',
  '16.11.2',
  '16.12.1',
  '16.12.1a',
  '16.12.1c',
  '16.12.1s',
  '16.12.2',
  '16.12.2s',
  '16.12.2t',
  '16.12.3',
  '16.12.3s',
  '16.12.4',
  '16.12.4a',
  '16.12.5',
  '16.12.6',
  '16.12.7',
  '16.12.8',
  '17.1.1',
  '17.1.1s',
  '17.1.1t',
  '17.1.2',
  '17.1.3',
  '17.2.1',
  '17.2.1r',
  '17.2.1v',
  '17.2.2',
  '17.2.3',
  '17.3.1',
  '17.3.1a',
  '17.3.2',
  '17.3.3',
  '17.3.4',
  '17.3.4a',
  '17.3.5',
  '17.3.6',
  '17.3.7',
  '17.3.8',
  '17.3.8a',
  '17.4.1',
  '17.4.1a',
  '17.4.1b',
  '17.4.2',
  '17.5.1',
  '17.5.1a',
  '17.6.1',
  '17.6.1a',
  '17.6.2',
  '17.6.3',
  '17.6.3a',
  '17.6.4',
  '17.6.5',
  '17.6.5a',
  '17.6.6',
  '17.6.6a',
  '17.7.1',
  '17.7.1a',
  '17.7.2',
  '17.8.1',
  '17.8.1a',
  '17.9.1',
  '17.9.1a',
  '17.9.2',
  '17.9.2a',
  '17.9.3',
  '17.9.3a',
  '17.9.4',
  '17.9.4a',
  '17.10.1',
  '17.10.1a',
  '17.10.1b',
  '17.11.1',
  '17.11.1a',
  '17.12.1',
  '17.12.1a'
);

var workarounds = make_list(CISCO_WORKAROUNDS['generic_workaround']);
var workaround_params = [
  WORKAROUND_CONFIG['telephony_enabled'],
  WORKAROUND_CONFIG['HTTP_Server_iosxe'],
  WORKAROUND_CONFIG['active-session-modules'],
  {'require_all_generic_workarounds': TRUE}
];

var reporting = make_array(
  'port'    , product_info['port'],
  'severity', SECURITY_HOLE,
  'version' , product_info['version'],
  'bug_id'  , 'CSCwh94964',
  'cmds'    , make_list('show running-config')
);

cisco::check_and_report(
  product_info:product_info,
  workarounds:workarounds,
  workaround_params:workaround_params,
  reporting:reporting,
  vuln_versions:version_list
);