Cisco Secure Email Gateway Remote Code Execution Vulnerability (regreSSHion) (cisco cisco-sa-openssh-rce-2024)

#TRUSTED 8881954448d046fde563ef3be641d163206fb00d633385bc097773f93cd1d4b1c2c20f50edada32e29db7e1151534238facf0a25ef3db0a7dfb2f9678a834b5e56165d580719ea0e9b5c690efb9e299a16abd8d14af161f5d9e4d1ec6dc87814487d14e06aa28ec9cf6ffb1848453922918e608ac453246f561472700c027d4f6d4c053798687630f404a05c72e3c0b4d49b932fe30c882712b3b8fc1d3d68e926d8b1a9d3385267668a35a12f24aff9bf1a9c927ca2558d3cc6a0fab26ed833320d62c9f1436f342790cf346335335bd680fcda2af029ee15e394a158ae2b2d009463d95f1cc121170c19b766038e0c568295975c02cef58a9190b2828403abd010ff93d3a1c632eff3472e1ddb9dfb3a12a8da63e6f70c2c98e148e11962f7ca3c08e4d5db212927a12061d526aec8fac655f85cf5bfc14b4a92f28883ef3d4c995a219e7d6138da4509d5ab3511a8f0d14acefdf94e3a3e13e6561dbc0ce7b735366c84997f576115945d0d9ce15d88330e46c18e12c22d20ceb52b82dfefc0542fcca2d5c34ac5a0c3afe97523c2b89423a8d5c3807a1f2df470411a29c9e9a7710b1ad7dee83eaab6d7080f21e75d6c770da6bacd74b2b911e53e83a7f499be062fd4d65b0d782e608be1bb8df69e6075a924c2a71df26e819346d18d52dc2f55c3eb1f0e167e020506c580788ac3af6de5ca2fe9013e831270d43a6b0f
#TRUST-RSA-SHA256 20c601ecde70da80b3e1bdea83c0787a883ef377444f94e87fc8f27cc6ca641678a2ee24204d6bdb821fa86d9968b3adc507650ddb0132b954006f6c27188f2b25e1755153557ab7032e16408679ea3b1fabb6af24407027a7907ab82a3ccc085182bc53c46693d739aec9547ef6d70d018d89bec6a0da15dedb57595168e83e4317e131d2512c7abe6ec9c940e57071c1ad893391aa32526a496b19384779a41b1f219a7bd93125ea65878c1d8b25d0756f36c87185c463ebed8c359dff8f67abb4cba5f55a16cdd7b3adc6d90e4b5e46dc3b89c1959fa023f5709e10ea18a4e894f76d68bb844725431b3daab0b8b511ce0816b19e341095ddae566855e3fa4190f99d09591089f39e92c44f320e36af3daadfc74dd0b1c4e9aaeeeeaafb49eba5878978de202e87429818d13a46f066086c7301c45cfdb8d7fcede6507ac25c7f28207b65b28911a016649241ca92a9785ca7d0e3d45ef8d52391d0d076d12f50cc13b0e0e0ed2d42fa76001b67c5237c78069248249b684eebdeb90ccfa84ef39e7f618047d49ef1694ebf56ada5e36dd673ecb430f0774dfb50798260098ccb4d520f9555b8bacdbd16c0e0b4559de5e5c3c7a32ced055325d6247a59d93a584c80dfa26362d2f3a2c954919aa990b54f838b0c0ea2320f8ff61d8997bd028a4824b0211d7ac0c5f0df5febf171014ae1d890718c27d00c3d41c5f3933f
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(312158);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/06");

  script_cve_id("CVE-2024-6387");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwk63523");
  script_xref(name:"CISCO-SA", value:"cisco-sa-openssh-rce-2024");
  script_xref(name:"IAVA", value:"2024-A-0375-S");

  script_name(english:"Cisco Secure Email Gateway Remote Code Execution Vulnerability (regreSSHion) (cisco cisco-sa-openssh-rce-2024)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Secure Email Gateway is affected by a vulnerability.

  - A remote code execution vulnerability exists in Cisco Secure Email Gateway due to a signal handler race condition
    found in sshd, where a client does not authenticate within LoginGraceTime seconds, after which the sshd SIGALRM handler
    is called asynchronously. An unauthenticated, remote attacker can exploit this to call various functions that are not
    async-signal-safe with root privileges. (CVE-2024-6387)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssh-rce-2024
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1ac35fe1");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk63523");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwk63523");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-6387");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/07/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/07/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/05/05");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:email_security_appliance");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_esa_version.nasl");
  script_require_keys("Host/AsyncOS/Cisco Email Security Appliance/Version");

  exit(0);
}

include('ccf.inc');

var product_info = cisco::get_product_info(name:'Cisco Email Security Appliance (ESA)');

var vuln_ranges = [
  {'min_ver' : '15.0','fix_ver' : '15.0.3.002'}, 
  {'min_ver' : '15.5','fix_ver' : '15.5.2.018'},
];

var reporting = {
  'port'          : 0,
  'severity'      : SECURITY_HOLE,
  'version'       : product_info['version'],
  'bug_id'        : 'CSCwk63523',
  'disable_caveat': TRUE
};

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_ranges:vuln_ranges
);