Cisco Identity Services Engine DoS (CVE-2023-20213)

#TRUSTED 03fba8461ca203183a7add9cd767ddb9bad0fa279e12eb7d942595b4bab787f2fe2de12b5c6358b418b3c2dd209471a2730f612ee74e395d3b50cbe1709a37d43420ef03d02b0b1367199e6745119db989b8ffe39ad9c4165686df90cd89aae9489585cd78f898f9e2156dc80d36eb484a930dff9bed80ecce21d2749d0f44680256647cd705bb8ba40a8e82b05cbe2ec73e18a5ae73e59d5ca548569c256488b18c17f26b5c22a926ed01c663e8b1f2e88a263c91db6a924ff365663f86b0600192d78389a0311b7d9a116f09219f06393f6089bc7bd4f2406d94af36c4cec69ae920df1d1310ccad5998a0cd934298d043c4ae31056a69614322067d31be1edc7c7576440edf69dc5a436c198e7b35831ec3cefc63d88cb28d880b48fef703e9dc544ceee8ddcca5ffecb1c4a587b47cfdca4d888a892bc8c6ea279754117cddf2d53630681c500b91f8ff2e1ed86899417a2d1567287d99dc45cf1e34cbd4a2c747864606a307da9e9fbd7fc49cf3664349da15cb894c82b76ee732f1b93fd32e509ea561edd5913f12e4b9f905df0dec93c10d41f2e1f558c5778b3eb6ae68896a70f7272071cb30e2ef2f551798fff00f94008342f5beeffd2a436d5ebd75b96f2bed6f0c4163a14e2fd47a981af10682ab2a7fe2f5969aa2a83de054116708bf366803cb96d88295953e4df1d8677570b6ba23b4dab1830b0bdd38bba0
#TRUST-RSA-SHA256 291f95ad5b4d72a7a78f4c74e680b5cbebc27f8eabfcb0fe33b65a7783baeebb278d831769a3ea4ddb45aba1e13e8ced99b25107c92611f912325f1e843ff864e33ecffc0d2a37924164f7b39d07ce72b7e2f2ac8d6d146ef14e6674bc00abeb2dda41cccadaa47bb1dbec8af04261c9629d9eb342e67f4d45e70faa70eca9bc6e1113abae187a956569b1257cb8c3d769ee1dcb25c7f8954f37e0bcc4f34d5a2fe6edd2dae4b09f0261a320a2db16fc8cf4d4f4ba5998ce626be43a409a54fb296f2090bb30dd0df94260337934f8f1d42c21293d7fad79653f0f93c1d2bb35db6036b439c105fe96c4c592ace73a23d1b79239b97559c6ef86833025efd2be047631c36d316724bc432cf8a54b3c1be73ef72e1ccbcf97699ecd6f92e9b69ed38e24a58dcb29cc2fcd0deff3cf0ac5876f626bc3557c0794d7675d83d9e3d69b22d6a8718abd5789ab67558b83296cf7f86d1c24cae871631dabde209abb01a0b80176f9d074ebb61f2e6e1a47fff84590da8a66ffc7bb587d4411d5c1096f7c8fc4f675e14bdc6e850c05b589d1aab1e6d5377a4c801d72477eddc59efa85b7aa5e80cfe35f8162a481303ce685da75afdbe2cbf785f2afaf7d0149c7ed745349d8a13861ecb28cfa264bd95b6bcbde9ada9bf37e9e24f70a2d6979ed824f4c1e3e281b939e2ca644eaf13bbf29d88fd1af15496f07e10c3f7e07cdb157f2
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(184453);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/11/15");

  script_cve_id("CVE-2023-20213");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwc71225");
  script_xref(name:"CISCO-SA", value:"cisco-sa-ise-file-upload-FceLP4xs");

  script_name(english:"Cisco Identity Services Engine DoS (CVE-2023-20213)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Identity Services Engine Vulnerabilities is affected by a denial of
service (DoS) vulnerability. A vulnerability in the CDP processing feature of Cisco ISE could allow an
unauthenticated, adjacent attacker to cause a denial of service (DoS) condition of the CDP process on an affected
device. This vulnerability is due to insufficient bounds checking when an affected device processes CDP traffic. An
attacker could exploit this vulnerability by sending crafted CDP traffic to the device. A successful exploit could cause
the CDP process to crash, impacting neighbor discovery and the ability of Cisco ISE to determine the reachability of
remote devices. After a crash, the CDP process must be manually restarted using the cdp enable command in interface
configuration mode.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-upload-FceLP4xs
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1997855f");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwc71225");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwc71225");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-20213");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/11/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/11/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/11/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:cisco:identity_services_engine");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:identity_services_engine");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:identity_services_engine_software");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ise_detect.nbin");
  script_require_keys("Host/Cisco/ISE/version");

  exit(0);
}

include('ccf.inc');
include('cisco_ise_func.inc');

var product_info = cisco::get_product_info(name:'Cisco Identity Services Engine Software');

var vuln_ranges = [
  {'min_ver':'0.0', 'fix_ver':'2.7.0.356', required_patch:'10'},
  {'min_ver':'3.0', 'fix_ver':'3.0.0.458', required_patch:'7'},
  {'min_ver':'3.1', 'fix_ver':'3.1.0.518', required_patch:'6'},
  {'min_ver':'3.2', 'fix_ver':'3.2.0.542', required_patch:'2'}
];

var required_patch = get_required_patch(vuln_ranges:vuln_ranges, version:product_info['version']);

if (empty_or_null(required_patch))
  audit(AUDIT_HOST_NOT, 'affected');

var reporting = make_array(
  'port'          , 0,
  'severity'      , SECURITY_NOTE,
  'version'       , product_info['version'],
  'bug_id'        , 'CSCwc71225',
  'disable_caveat', TRUE,
  'fix'           , 'See vendor advisory'
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_ranges:vuln_ranges,
  required_patch:required_patch
);