Cisco IOS Software for Cisco Industrial Routers Arbitrary Code Execution Vulnerabilities (cisco-sa-ios-iot-rce-xYRSeMNH)

2020-08-17T00:00:00
ID CISCO-SA-IOS-IOT-RCE-XYRSEMNH-IOS.NASL
Type nessus
Reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
Modified 2020-08-17T00:00:00

Description

According to its self-reported version, Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Grid Routers (CGR1000) is affected by multiple arbitrary code execution vulnerabilities, as follows:

  • A vulnerability in the area of code that manages inter-VM signaling due to incorrect bounds checking. An unauthenticated, remote attacker can exploit this, by sending malicious packets to an affected device, in order to execute arbitrary code on an affected system or cause the system to crash and reload. (CVE-2020-3198)

  • A vulnerability in one of the diagnostic test CLI commands. This exists because, under specific circumstances, the affected software permits the modification of the device's run-time memory. An authenticated, local attacker can exploit this, by authenticating to the targeted device and issuing a specific diagnostic test command at the CLI in order to execute arbitrary code on an affected device. (CVE-2020-3258)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

                                        
                                            #TRUSTED 4303bd5f01aa12d06aa0cc47d168d3d12efcee8774b99918872584a6ce80b9d7afe9d762b967b88e0a22bbe2cf186fbb270f2451b453e129b69ba1069f1b24370a79f43e074fc660d7b83d92e25e9cf49537d7717538a964d09d336a536499874b4e4a446b795f77bac474b1809dc2f1fd055857d11d46dc712c6690fcdc1570e6c0ac268403b9de60edc70d1cd82fd9ae6f2d11811d97b6d664f8a3c9a2ff31deb6e9dd2fe233c20e8d38c846213e73dfa25daa6749818fc1a3d802e875917b30fce51700b7660dfd5e98ab19bb7089024bfa80210e037a8e0a730ff7463f40d1788c881bbeb48b317b28653a15031cbe03e147f45ef02711304c4f66a5366f006116a11e38ab9fd937b4f895120077a54c6f4459f7ccdbd2fe97a88d90108164484eea26d7fa7d01ee061868096383dfaac8f9118ccbf94e7352e204b324c99e422200ef78ec9324545a987a2073522818605d8ef9584891ba71cdaaf1877fdd2e507d153d07454f236a5382ef27035dc989c64d32f1fe5df472a7e54a4765ecaebd660120c6a276a96124136c69c4f0b610ab41e5c702b00ffd90b8d34bd7417c3e14816d7d72ecc4f302b9f4029d662a058da17197bf575c921abdce29260ca2a440b397ac45101abbb1bee5a45567f1f7e4ac7e4d61d59eea8f730080af2aa7af96463788144e33f0048b3631c7edbdf141c0585283dc4a1eada24a8ae6
#
# (C) Tenable Network Security, Inc.
#

include('compat.inc');

if (description)
{
  script_id(139614);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/08/18");

  script_cve_id("CVE-2020-3198", "CVE-2020-3258");
  script_xref(name:"CISCO-BUG-ID", value:"CSCvr12083");
  script_xref(name:"CISCO-BUG-ID", value:"CSCvr46885");
  script_xref(name:"CISCO-SA", value:"cisco-sa-ios-iot-rce-xYRSeMNH");
  script_xref(name:"IAVA", value:"2020-A-0239");

  script_name(english:"Cisco IOS Software for Cisco Industrial Routers Arbitrary Code Execution Vulnerabilities (cisco-sa-ios-iot-rce-xYRSeMNH)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers
(Industrial ISRs) and Cisco 1000 Series Connected Grid Routers (CGR1000) is affected by multiple arbitrary code
execution vulnerabilities, as follows:

  - A vulnerability in the area of code that manages inter-VM signaling due to incorrect bounds checking. An
    unauthenticated, remote attacker can exploit this, by sending malicious packets to an affected device, in
    order to execute arbitrary code on an affected system or cause the system to crash and reload.
    (CVE-2020-3198)

  - A vulnerability in one of the diagnostic test CLI commands. This exists because, under specific
    circumstances, the affected software permits the modification of the device's run-time memory. An
    authenticated, local attacker can exploit this, by authenticating to the targeted device and issuing
    a specific diagnostic test command at the CLI in order to execute arbitrary code on an affected device.
    (CVE-2020-3258)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-iot-rce-xYRSeMNH
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f0db8a62");
  script_set_attribute(attribute:"see_also", value:"http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-73388");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvr12083");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvr46885");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in the Cisco bug IDs CSCvr12083 and CSCvr46885");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-3198");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(119);

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/06/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/06/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/08/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_version.nasl");
  script_require_keys("Host/Cisco/IOS/Version", "Host/Cisco/IOS/Model");

  exit(0);
}

include('cisco_workarounds.inc');
include('ccf.inc');

product_info = cisco::get_product_info(name:'Cisco IOS');

# This vulnerability affects Cisco 809 and 829 Industrial ISRs and CGR1000
if (toupper(product_info['model']) !~ "^IR8[0-9]{2}([^0-9]|$)" &&
    toupper(product_info['model']) !~ "CGR.*1[0-9]{3}([^0-9]|$)")
  audit(AUDIT_HOST_NOT, 'affected');

# It looks like we might get IR800 for IR809, IR829, or IR800 - so make this paranoid.
# According to: https://www.cisco.com/c/en/us/td/docs/routers/access/800/829/15-8-3M2-Release-Note.html
if (report_paranoia < 2)
  audit(AUDIT_PARANOID);

version_list=make_list(
  '12.2(60)EZ16',
  '15.0(2)SG11a',
  '15.4(3)M',
  '15.4(3)M1',
  '15.4(3)M2',
  '15.4(3)M3',
  '15.4(3)M4',
  '15.4(3)M5',
  '15.4(3)M6',
  '15.4(3)M7',
  '15.4(3)M6a',
  '15.4(3)M8',
  '15.4(3)M9',
  '15.4(3)M10',
  '15.4(1)CG',
  '15.4(2)CG',
  '15.5(1)T',
  '15.5(2)T',
  '15.5(1)T2',
  '15.5(1)T3',
  '15.5(2)T1',
  '15.5(2)T2',
  '15.5(2)T3',
  '15.5(2)T4',
  '15.5(1)T4',
  '15.5(3)M',
  '15.5(3)M1',
  '15.5(3)M0a',
  '15.5(3)M2',
  '15.5(3)M2a',
  '15.5(3)M3',
  '15.5(3)M4',
  '15.5(3)M4a',
  '15.5(3)M5',
  '15.5(3)M6',
  '15.5(3)M7',
  '15.5(3)M6a',
  '15.5(3)M8',
  '15.5(3)M9',
  '15.5(3)M10',
  '15.3(3)JAA1',
  '15.6(1)T',
  '15.6(2)T',
  '15.6(1)T0a',
  '15.6(1)T1',
  '15.6(2)T1',
  '15.6(1)T2',
  '15.6(2)T2',
  '15.6(1)T3',
  '15.6(2)T3',
  '15.6(3)M',
  '15.6(3)M1',
  '15.6(3)M0a',
  '15.6(3)M1b',
  '15.6(3)M2',
  '15.6(3)M3',
  '15.6(3)M3a',
  '15.6(3)M4',
  '15.6(3)M5',
  '15.6(3)M6',
  '15.6(3)M7',
  '15.6(3)M6a',
  '15.6(3)M6b',
  '15.7(3)M',
  '15.7(3)M1',
  '15.7(3)M3',
  '15.7(3)M2',
  '15.7(3)M4',
  '15.7(3)M5',
  '15.7(3)M4a',
  '15.7(3)M4b',
  '15.8(3)M',
  '15.8(3)M1',
  '15.8(3)M0a',
  '15.8(3)M2',
  '15.8(3)M3',
  '15.8(3)M2a',
  '15.8(3)M3a',
  '15.8(3)M3b',
  '15.9(3)M',
  '15.9(3)M0a',
  '15.3(3)JPJ'
);

reporting = make_array(
  'port'     , 0,
  'severity' , SECURITY_HOLE,
  'version'  , product_info['version'],
  'bug_id'   , 'CSCvr12083, CSCvr46885'
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_versions:version_list,
  router_only:TRUE
);