Cisco IOS Software IKEv2 AutoReconnect Feature DoS (cisco-sa-ikev2-ebFrwMPr)

#TRUSTED 98f91060bf3d652a120ad3bc603c0fa0d7f29244aeb3191a277809655c15420dc9db8e442282903296b7392bb393331ecfad2dd6d94cb3cebdffca2e0ce9da70690b00ea00244db62dd5a6d8c54df812e43e1b778bd8e4bd3efb750080baca80c7295d490577fc9feeb128b7b3ad88c9edbfeabc4728fdb7be155a87685e920946066f6f70ee10d7d1074b27863ce54ad992a075e0bbeb564533a829db54c83403ae1479a22ca26aced35aa8e1fafd79606dee6bd4127d251cfc0f4cd7d1282f911f64aad1ff024a524fe622c8912a15aa7c4b46f7393e1f4b651af128095228169e77b578a310c7a385304d9720e39034ca4a502bfc958e6736bc15190815cb31275d04ba75ea3e60523412da3a2823bb06b57ba5a340e0878fec5cc2a205c78f3f60b60e99510dd724461aa6053f471564c914d02c1ad1d2893474963f0c8a6779f156dc74cb498aa4c6df60aec496fe52a6edc2da87775b45241b92b524487e7fb545d314a914f8128d7096e752280d7b09a4f239bbc54ca687821d7f74f14556253cad6f38d25bbf216dfce4985cf039ec6cbb8647c3e89831ac075179f0383ca84201e15ef1255aba27b8e1b18fb7a1b94b27d7b66a985198a1fca759bbe5ded92e70f33bf72510a1255e6378dc6ec7b696810ba909fd81aa55c786642fb1005b92200f285b253a335c2ea37daf6baab323d389a0dd15925adb71205327
#TRUST-RSA-SHA256 35a84f49224dc10d26b810ade4e714d78baab50b80e435aaa5a3e70dce90a64551ce932af79876fd8bfe1224c61a7447bea39d9cc793afec7b2399fb42ca489164237a3a6d036168095b6bf94d9dad9629bc0333afdbfba4688d3082b754be321962a04241e52fc9114852ea597889933ea3bbf667612d3dce70962ef9efac5269cfc4e7087a1e9abea88e7e965d9b0b5c0199c1fbab2fb7ef772af80f29b4e9851b41e87c397be6f0e171dcc9c95f9b9ba7e9eecb9d7e715d66e7cfbd125dd09b077913d302dbc63028cdf7175799514666326bb9ebcca69a61e5acc986cb00000c5bd2d9400b1ca0aa315c472b21029215d75f2e58cf851dfcfb6531806dad00944bb6c2f9037b30dc7e34a3979e6b6e8d19293c30d74443ee0ef35f72d0d61e8fb7479586b2ab20585e1fa4eca49a7d95dfc4ebe7569b6bb280192f48f9b78c9f0181b6b89ae18ae778dbbc6f48641aafa5a5fb287fb9b29bb9118b80b46e56e3fa2e15aa3fdb653bf7cfe3c8960f2ce468e4719e9deb9511391c6fae50270354e528c23d0b1ea3cab9f82245b7b86a4f4cebebf9c0e624a1fbd0e4676b62790269fb0825855e3de6fd713cd6b1363e82ca87fdb099459701bbde215b78a79fd0040bdad8d75fd6414e43c7fa0cb529577271f0b1ca799e9ca9c1e75b6358e0be049202f8ca9c6acce80660392cbaf80e98a0c9071bc6a5f449ec6ec800a5
#%NASL_MIN_LEVEL 70300
##
# (C) Tenable Network Security, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(155733);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/09/28");

  script_cve_id("CVE-2021-1620");
  script_xref(name:"CISCO-BUG-ID", value:"CSCvw25564");
  script_xref(name:"CISCO-SA", value:"cisco-sa-ikev2-ebFrwMPr");
  script_xref(name:"IAVA", value:"2021-A-0441-S");

  script_name(english:"Cisco IOS Software IKEv2 AutoReconnect Feature DoS (cisco-sa-ikev2-ebFrwMPr)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS is affected by a denial of service (DoS) vulnerability in its 
AutoReconnect feature. An authenticated, remote attacker can exploit this issue to cause a DoS condition by exhausting
the free IP addresses from the assigned local pool.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version 
number.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ikev2-ebFrwMPr
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0ab6fc3e");
  script_set_attribute(attribute:"see_also", value:"http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-74581");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvw25564");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvw25564");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-1620");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/09/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2021/09/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2021/11/30");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_version.nasl");
  script_require_keys("Host/Cisco/IOS/Version");

  exit(0);
}

include('ccf.inc');
include('cisco_workarounds.inc');

var product_info = cisco::get_product_info(name:'Cisco IOS');

var version_list=make_list(
  '12.2(6)I1',
  '15.1(3)SVR1',
  '15.1(3)SVR2',
  '15.1(3)SVR3',
  '15.1(3)SVS',
  '15.1(3)SVS1',
  '15.1(3)SVT1',
  '15.1(3)SVT2',
  '15.1(3)SVU1',
  '15.2(1)SY2',
  '15.2(1)SY3',
  '15.2(1)SY4',
  '15.2(1)SY5',
  '15.2(1)SY6',
  '15.2(1)SY7',
  '15.2(1)SY8',
  '15.2(4)E',
  '15.2(4)E1',
  '15.2(4)E2',
  '15.2(4)E3',
  '15.2(4)E4',
  '15.2(4)E5',
  '15.2(4)E5a',
  '15.2(4)E6',
  '15.2(4)E7',
  '15.2(4)E8',
  '15.2(4)E9',
  '15.2(4)E10',
  '15.2(4)E10a',
  '15.2(4)E10b',
  '15.2(4)EA',
  '15.2(4)EA1',
  '15.2(4)EA2',
  '15.2(4)EA3',
  '15.2(4)EA4',
  '15.2(4)EA5',
  '15.2(4)EA6',
  '15.2(4)EA7',
  '15.2(4)EA8',
  '15.2(4)EA9',
  '15.2(4)EA9a',
  '15.2(4)EC1',
  '15.2(4)EC2',
  '15.2(4m)E1',
  '15.2(4m)E2',
  '15.2(4m)E3',
  '15.2(4n)E2',
  '15.2(4o)E2',
  '15.2(4o)E3',
  '15.2(4p)E1',
  '15.2(4q)E1',
  '15.2(4s)E1',
  '15.2(5)E',
  '15.2(5)E1',
  '15.2(5)E2',
  '15.2(5)E2b',
  '15.2(5)E2c',
  '15.2(5)EA',
  '15.2(5)EX',
  '15.2(5a)E',
  '15.2(5a)E1',
  '15.2(5b)E',
  '15.2(5c)E',
  '15.2(6)E',
  '15.2(6)E0a',
  '15.2(6)E0c',
  '15.2(6)E1',
  '15.2(6)E1a',
  '15.2(6)E1s',
  '15.2(6)E2',
  '15.2(6)E2a',
  '15.2(6)E2b',
  '15.2(6)E3',
  '15.2(6)EB',
  '15.2(7)E',
  '15.2(7)E0a',
  '15.2(7)E0b',
  '15.2(7)E0s',
  '15.2(7)E1',
  '15.2(7)E1a',
  '15.2(7)E2',
  '15.2(7)E2a',
  '15.2(7)E2b',
  '15.2(7)E3',
  '15.2(7)E3a',
  '15.2(7)E3k',
  '15.2(7)E4',
  '15.2(7)E5',
  '15.2(7)E99',
  '15.2(7a)E0b',
  '15.2(7b)E0b',
  '15.2(8)E',
  '15.2(8)E1',
  '15.2(234k)E',
  '15.3(0)SY',
  '15.3(1)SY',
  '15.3(1)SY1',
  '15.3(1)SY2',
  '15.3(3)JC6',
  '15.3(3)JC8',
  '15.3(3)JC9',
  '15.3(3)JC14',
  '15.3(3)JCA7',
  '15.3(3)JCA8',
  '15.3(3)JCA9',
  '15.3(3)JD3',
  '15.3(3)JD4',
  '15.3(3)JD5',
  '15.3(3)JD6',
  '15.3(3)JD7',
  '15.3(3)JD8',
  '15.3(3)JD9',
  '15.3(3)JD11',
  '15.3(3)JD12',
  '15.3(3)JD13',
  '15.3(3)JD14',
  '15.3(3)JD16',
  '15.3(3)JD17',
  '15.3(3)JDA7',
  '15.3(3)JDA8',
  '15.3(3)JDA9',
  '15.3(3)JDA11',
  '15.3(3)JDA12',
  '15.3(3)JDA13',
  '15.3(3)JDA14',
  '15.3(3)JDA16',
  '15.3(3)JDA17',
  '15.3(3)JE',
  '15.3(3)JF',
  '15.3(3)JF1',
  '15.3(3)JF2',
  '15.3(3)JF4',
  '15.3(3)JF5',
  '15.3(3)JF6',
  '15.3(3)JF7',
  '15.3(3)JF8',
  '15.3(3)JF9',
  '15.3(3)JF10',
  '15.3(3)JF11',
  '15.3(3)JF12',
  '15.3(3)JF12i',
  '15.3(3)JF14',
  '15.3(3)JF14i',
  '15.3(3)JF15',
  '15.3(3)JG',
  '15.3(3)JG1',
  '15.3(3)JH',
  '15.3(3)JH1',
  '15.3(3)JI1',
  '15.3(3)JI3',
  '15.3(3)JI4',
  '15.3(3)JI5',
  '15.3(3)JI6',
  '15.3(3)JJ',
  '15.3(3)JJ1',
  '15.3(3)JK',
  '15.3(3)JK1',
  '15.3(3)JK1t',
  '15.3(3)JK2',
  '15.3(3)JK2a',
  '15.3(3)JK3',
  '15.3(3)JK4',
  '15.3(3)JK5',
  '15.3(3)JK6',
  '15.3(3)JK100',
  '15.3(3)JN13',
  '15.3(3)JN14',
  '15.3(3)JN15',
  '15.3(3)JPC5',
  '15.3(3)JPI1',
  '15.3(3)JPI1t',
  '15.3(3)JPI4',
  '15.3(3)JPI5',
  '15.3(3)JPI5s',
  '15.3(3)JPI6a',
  '15.3(3)JPI7',
  '15.3(3)JPI8',
  '15.3(3)JPJ2',
  '15.3(3)JPJ2t',
  '15.3(3)JPJ3',
  '15.3(3)JPJ3a',
  '15.3(3)JPJ4',
  '15.3(3)JPJ5',
  '15.3(3)JPJ6',
  '15.3(3)JPJ7',
  '15.3(3)JPK',
  '15.3(3)JPK1',
  '15.3(3)JPK2',
  '15.4(1)CG',
  '15.4(1)CG1',
  '15.4(1)S',
  '15.4(1)S1',
  '15.4(1)S2',
  '15.4(1)S3',
  '15.4(1)S4',
  '15.4(1)SY',
  '15.4(1)SY1',
  '15.4(1)SY2',
  '15.4(1)SY3',
  '15.4(1)SY4',
  '15.4(1)T',
  '15.4(1)T1',
  '15.4(1)T2',
  '15.4(1)T3',
  '15.4(1)T4',
  '15.4(2)CG',
  '15.4(2)S',
  '15.4(2)S1',
  '15.4(2)S2',
  '15.4(2)S3',
  '15.4(2)S4',
  '15.4(2)SN',
  '15.4(2)SN1',
  '15.4(2)T',
  '15.4(2)T1',
  '15.4(2)T2',
  '15.4(2)T3',
  '15.4(2)T4',
  '15.4(3)M',
  '15.4(3)M1',
  '15.4(3)M2',
  '15.4(3)M3',
  '15.4(3)M4',
  '15.4(3)M5',
  '15.4(3)M6',
  '15.4(3)M6a',
  '15.4(3)M7',
  '15.4(3)M7a',
  '15.4(3)M8',
  '15.4(3)M9',
  '15.4(3)M10',
  '15.4(3)S',
  '15.4(3)S0d',
  '15.4(3)S0e',
  '15.4(3)S0f',
  '15.4(3)S1',
  '15.4(3)S2',
  '15.4(3)S3',
  '15.4(3)S4',
  '15.4(3)S5',
  '15.4(3)S6',
  '15.4(3)S6a',
  '15.4(3)S7',
  '15.4(3)S8',
  '15.4(3)S9',
  '15.4(3)S10',
  '15.4(3)SN1',
  '15.4(3)SN1a',
  '15.5(1)S',
  '15.5(1)S1',
  '15.5(1)S2',
  '15.5(1)S3',
  '15.5(1)S4',
  '15.5(1)SN',
  '15.5(1)SN1',
  '15.5(1)SY',
  '15.5(1)SY1',
  '15.5(1)SY2',
  '15.5(1)SY3',
  '15.5(1)SY4',
  '15.5(1)SY5',
  '15.5(1)SY6',
  '15.5(1)SY7',
  '15.5(1)SY8',
  '15.5(1)T',
  '15.5(1)T1',
  '15.5(1)T2',
  '15.5(1)T3',
  '15.5(1)T4',
  '15.5(2)S',
  '15.5(2)S1',
  '15.5(2)S2',
  '15.5(2)S3',
  '15.5(2)S4',
  '15.5(2)SN',
  '15.5(2)T',
  '15.5(2)T1',
  '15.5(2)T2',
  '15.5(2)T3',
  '15.5(2)T4',
  '15.5(2)XB',
  '15.5(3)M',
  '15.5(3)M0a',
  '15.5(3)M1',
  '15.5(3)M2',
  '15.5(3)M2a',
  '15.5(3)M3',
  '15.5(3)M4',
  '15.5(3)M4a',
  '15.5(3)M4b',
  '15.5(3)M4c',
  '15.5(3)M5',
  '15.5(3)M6',
  '15.5(3)M6a',
  '15.5(3)M7',
  '15.5(3)M8',
  '15.5(3)M9',
  '15.5(3)M10',
  '15.5(3)M11',
  '15.5(3)M11a',
  '15.5(3)S',
  '15.5(3)S0a',
  '15.5(3)S1',
  '15.5(3)S1a',
  '15.5(3)S2',
  '15.5(3)S3',
  '15.5(3)S4',
  '15.5(3)S5',
  '15.5(3)S6',
  '15.5(3)S6a',
  '15.5(3)S6b',
  '15.5(3)S7',
  '15.5(3)S8',
  '15.5(3)S9',
  '15.5(3)S9a',
  '15.5(3)S10',
  '15.5(3)S10a',
  '15.5(3)S10b',
  '15.5(3)SN',
  '15.5(3)SN0a',
  '15.6(1)S',
  '15.6(1)S1',
  '15.6(1)S2',
  '15.6(1)S3',
  '15.6(1)S4',
  '15.6(1)SN',
  '15.6(1)SN1',
  '15.6(1)SN2',
  '15.6(1)SN3',
  '15.6(1)T',
  '15.6(1)T0a',
  '15.6(1)T1',
  '15.6(1)T2',
  '15.6(1)T3',
  '15.6(2)S',
  '15.6(2)S1',
  '15.6(2)S2',
  '15.6(2)S3',
  '15.6(2)S4',
  '15.6(2)SN',
  '15.6(2)SP',
  '15.6(2)SP1',
  '15.6(2)SP2',
  '15.6(2)SP3',
  '15.6(2)SP4',
  '15.6(2)SP5',
  '15.6(2)SP6',
  '15.6(2)SP7',
  '15.6(2)SP8',
  '15.6(2)SP8a',
  '15.6(2)SP9',
  '15.6(2)T',
  '15.6(2)T0a',
  '15.6(2)T1',
  '15.6(2)T2',
  '15.6(2)T3',
  '15.6(3)M',
  '15.6(3)M0a',
  '15.6(3)M1',
  '15.6(3)M1a',
  '15.6(3)M1b',
  '15.6(3)M2',
  '15.6(3)M2a',
  '15.6(3)M3',
  '15.6(3)M3a',
  '15.6(3)M4',
  '15.6(3)M5',
  '15.6(3)M6',
  '15.6(3)M6a',
  '15.6(3)M6b',
  '15.6(3)M7',
  '15.6(3)M8',
  '15.6(3)M9',
  '15.6(3)SN',
  '15.6(4)SN',
  '15.6(5)SN',
  '15.6(7)SN',
  '15.6(7)SN1',
  '15.6(7)SN2',
  '15.7(3)M',
  '15.7(3)M0a',
  '15.7(3)M1',
  '15.7(3)M2',
  '15.7(3)M3',
  '15.7(3)M4',
  '15.7(3)M4a',
  '15.7(3)M4b',
  '15.7(3)M5',
  '15.7(3)M6',
  '15.7(3)M7',
  '15.7(3)M8',
  '15.8(3)M',
  '15.8(3)M0a',
  '15.8(3)M0b',
  '15.8(3)M1',
  '15.8(3)M1a',
  '15.8(3)M2',
  '15.8(3)M2a',
  '15.8(3)M3',
  '15.8(3)M3a',
  '15.8(3)M3b',
  '15.8(3)M4',
  '15.8(3)M5',
  '15.8(3)M6',
  '15.9(3)M',
  '15.9(3)M0a',
  '15.9(3)M1',
  '15.9(3)M2',
  '15.9(3)M2a',
  '15.9(3)M3',
  '15.9(3)M3a',
  '15.9(3)M3b'
);

var workarounds = make_list(CISCO_WORKAROUNDS['generic_workaround']);
var workaround_params = [WORKAROUND_CONFIG['ikev2_auto_reconnect_enabled']];

var reporting = make_array(
  'port'     , product_info['port'],
  'severity' , SECURITY_NOTE,
  'bug_id'   , 'CSCvw25564',
  'version'  , product_info['version'],
  'cmds'     , ['show running-config']
);

cisco::check_and_report(
  product_info:product_info,
  workarounds:workarounds,
  workaround_params:workaround_params,
  reporting:reporting,
  vuln_versions:version_list
);