Cisco IOS XR Software Border Gateway Protocol Confederation DoS (cisco-sa-iosxr-bgp-dos-O7stePhX)

#TRUSTED 6da3acc6c5dd32ad9c9eb301b019842fc84e8aa43e66a0174a1543f86254213ec2948c3703a7fb9181d8658cc9d078d097a50c62e6eef367a5671dd65444e2e39d03fcd415ce620ad0be504965d41f44f3cec72780042657a5d4f67a4bfb3a9e55888c89b68e02642d40800cc7f99774fab6da85640f7b6cc23ffd06299f75b3b51cba09bf7cbacc41fe3efbbbfb87ceda806136e61f26d0dd49a8e32062afd7ecb4e3f55dda7a29acea3309b40cbee8b81641509daefeb6747f7699d9f0bcd674c9fdccdc36258da81b4bfbb195ecf413890d7681e826d775dcaf50302d95284343afe2d3ad13ade084045e1c4bbac39680e00682b0787c7177f09c4e0df1b01ad1cdddedec1b16055f6c284b84ca8daf1dd5a0b9894b74a0b21abf54cef58c7db9f2cac3ed8d9dc435790ca0214e7097e2e390f5d56d9b06010fc748a5313fac1d1e58fa6058df1ff9a87023ef20d15954d505730fb3f16a3f02e5cc008ae3780eae22064562e375b03656ace53653bf34da07750cf12f1dea561f3450925aefa9a7ae24321f95536273e0659d05e383e44c5930cd5b5a38888315ff18afc50ca92bc946cda9d0793acab8e1e4e69ca915d162799c5eca94dbe57ec34e45f8d924338aa130195718a5cb77ad324bb51c161a4208d94e91c401f004238405ce3eb1d04d6f564f7c309a7b1cc01d4faf3447ccce735bb9f322c66e79b92feff2
#TRUST-RSA-SHA256 3f0ae1176b3283f39a6fdb835bfeebef19697057dc60288381b7ab5ab92c754bd69c8fbab070872ac85f1c2b4b21ba17892de28e3dcb418b1aa02c01c1e5aa78a055093b0a396ea61eda4f5eeb4d100ed0946a77256f8b07ca8a48a3c8c57a74f314f1f0613555a97346d9809c48024493c5398dabb49ada4ee6c8d4112916f1e30a1adad8a69a481ff5b188d4cca5323b8ee5099eefd1223947bf60252d53c4b04b0dde0da476457766b6781d371c1f92914655dfb024ea7d8ad08d9bc1f7d87e47411aaadfc775b68fd81964e3bed46f32b445b8a15b1b3728712da9198e49cf136b31b1d6f1683256ae05bbe52281d880c3b5b09ab7b2160b153dd9958f1eabe73229b900f5bcf7c17fd945d7df67edff48fabc966a4a301d5466cb4b1d8e81aa6b3df2c873b685769d6f4f4b6746967a128693c72d890edb147abf29f42ec240e0e52895a7e9a8dcdd3bc5f771143061d4ee11991c909bb62f20ecdcafbac113dba3a4c9e6715847ab86805854228d99f92980e7887d897f04199e81bff8b39b3f97c06816ed5f2ada9ab72603cdebfc33ae31598bc05ed404c72d5affcaceb30d4a40322913916a9dbcf7700ed50a8df3f535a941c3ca800291d64d376ed6601364255050c796575382e90f929b19a8e975b5ce2530943c620a54d27e6b389a7d3c305068121cb01b46f4cdd0ee504b2b8ff5cf1554b8d8c51935da0077
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(232841);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/09/25");

  script_cve_id("CVE-2025-20115");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwk15887");
  script_xref(name:"CISCO-SA", value:"cisco-sa-iosxr-bgp-dos-O7stePhX");
  script_xref(name:"IAVA", value:"2025-A-0154-S");

  script_name(english:"Cisco IOS XR Software Border Gateway Protocol Confederation DoS (cisco-sa-iosxr-bgp-dos-O7stePhX)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS XR is affected by a vulnerability.

  - A vulnerability in confederation implementation for the Border Gateway Protocol (BGP)in Cisco IOS XR
    Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.
    This vulnerability is due to a memory corruption that occurs when a BGP update is created with an
    AS_CONFED_SEQUENCE attribute that has 255 autonomous system numbers (AS numbers). An attacker could
    exploit this vulnerability by sending a crafted BGP update message, or the network could be designed in
    such a manner that the AS_CONFED_SEQUENCE attribute grows to 255 AS numbers or more. A successful exploit
    could allow the attacker to cause memory corruption, which may cause the BGP process to restart, resulting
    in a DoS condition. To exploit this vulnerability, an attacker must control a BGP confederation speaker
    within the same autonomous system as the victim, or the network must be designed in such a manner that the
    AS_CONFED_SEQUENCE attribute grows to 255 AS numbers or more. (CVE-2025-20115)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-bgp-dos-O7stePhX
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?142863cd");
  # https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75548
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?402ef3d6");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk15887");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwk15887");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20115");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(120);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/03/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/03/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/03/18");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xr");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_xr_version.nasl", "cisco_enum_smu.nasl");
  script_require_keys("Host/Cisco/IOS-XR/Version");

  exit(0);
}

include('cisco_workarounds.inc');
include('ccf.inc');

var product_info = cisco::get_product_info(name:'Cisco IOS XR');

var vuln_ranges = [
  {'min_ver':'0.0',  'fix_ver':'24.2.21', 'fix_display':'See vendor advisory'},
  {'min_ver':'24.0', 'fix_ver':'24.2.21', 'fix_display':'See vendor advisory'},
  {'min_ver':'24.2', 'fix_ver':'24.2.21'},
  {'min_ver':'24.3', 'fix_ver':'24.3.1'}
];

var workarounds = make_list(CISCO_WORKAROUNDS['generic_workaround']);
var workaround_params = [
  WORKAROUND_CONFIG['router_bgp'],
  WORKAROUND_CONFIG['bgp_confederation_peers'],
  {'require_all_generic_workarounds': TRUE}
];

var fix = NULL;
var reporting;

if (product_info['version'] =~ "^24\.[23]") 
{
    reporting = make_array(
      'port'    , product_info['port'],
      'severity', SECURITY_HOLE,
      'version' , product_info['version'],
      'bug_id'  , 'CSCwk15887',
      'cmds'    , ['show running-config']
    );
}
else 
{
  reporting = make_array(
    'port'    , product_info['port'],
    'severity', SECURITY_HOLE,
    'version' , product_info['version'],
    'bug_id'  , 'CSCwk15887',
    'cmds'    , ['show running-config'],
    'fix'     , 'See vendor advisory'
  );
}

cisco::check_and_report(
  product_info:product_info,
  workarounds:workarounds,
  workaround_params:workaround_params,
  reporting:reporting,
  vuln_ranges:vuln_ranges
);