Multiple Cisco Products Snort 3 DoS (cisco-sa-snort3-gtpcodec-dos-Rmecfepz)

#TRUSTED 8657c0655cd04e10530bda6855d466cfcec7b1c9ec9b8b82016fd949edddf67a75b3e9c91fbb346e6bf826c5e31ec117ecc229bb35355e061c21ae3fd1d0c2882a5c8eb714473f97b6544fa1932e07868964983742d7832a132fa116e3c5f14686c9483fe7143fabde94fb4601d5ffb9a2a40a9b42aed1e5e13413841b4c7ba8ba2bbdfc6265eadcef89cefade213c196397eb38ba029c463533ee2a135d537462a3fc1f252b47183343ea99dc9b0d6f5ab9dd69937a6928f02093968418a7b0d9f44f372315f61c661fe6fa1e75f40e3ad99970e436ae86326705d17b2c9dd14df31f4506fd9534332f2f352912ad77eff09cc8280a7e2db949c4450aee9bbb35c77759f50a9af3293a836239836403b672a3b112e6e8752703c9c5d5ec4d9ad4d075f2d2dd454ffa711b3acaa30b87d3ed26eb5d6145d6b044f7a22bf3cf11d9a37f1f53249ae236983ce54797239d73c652872576fcd31aeb49b8cc5a507baaeb7275355ab9506bbeb9d8717e59f5b832cbdfd670663bfbb51a6b0bd87ba1dfe821ff6339f7cd80be9b7f977a3584eef6d59aac407fd1bc84f8afbf7db1e77b41560a001223dd7fa300473c3593f7d2eebaa34222b4dcfaad904a1b0a7666755d0eafc33dd8dae5e7d904970bb1ca8105c647f334cab8f91d1a4f73fe0d0f7458df1c02964b41d6eda6175c6331ea12f24748fd9ceb1d59402f9968be8739
#TRUST-RSA-SHA256 0aa835ec1d23711185c305cace8cc498eb2fb5e211b95a540aa0530c94def51102fe3854e451bc81e9f50a69169d38ecafd0bc9e54a43aa3cdc3685462cdadf02e9c5d50a08ff658899761f81371f886859274efbd9ece7eed6be817781e85dce47f2ccede7d171e2504a5c48f4a00c46dea39182e45027250bd2f9989533846b32d806fa6a63a036b452be9c04805ccf4feded60a4489b456962700be943c721d296a33428f71a7668540ffe09fcbeee2fa4d02267bdd34d240f959d8fa670eb0f2c360a87183199a86e9087484533e522367c646018e221744c1c726caf09a5aba1b3ddab5bdbfbb47233363b7744a4b410eaa4a8e3ed12e575c842710f096012d51cb20975332469c90f39c857f0eac2a2f06b493150c3a8756df6b3514ada6e8d79e8d57eb26cf247e11a8099d184b869c279418990f053ed8821df0e8339ce9b73b7e3cb57fa083161c5d8a94ec24de5bc80fc946a5a00a1fee963d523ae3f342d14f1a47eebdf93f074418d7ac0eb51db7cce96d424fdca51c0dcfa5ca7deb85fa40a3fc57e8642e8b77135239fe023913223005c45d3333e4ddf43ce464c0fca1f55f43622f0aeddac340d0438ce8239917a32b81e3c16acd35e1f15fdcbe6c0bbf407c07d13046ff823e50946ab9df4ac8ef6f54fd0f7bd42c638159269d7816de8c37afa0a3a9240d03d640c2ce61d440de7a125c061e95d44c15c0
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(369977);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/21");

  script_cve_id("CVE-2026-76445");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwu17795");
  script_xref(name:"CISCO-SA", value:"cisco-sa-snort3-gtpcodec-dos-Rmecfepz");

  script_name(english:"Multiple Cisco Products Snort 3 DoS (cisco-sa-snort3-gtpcodec-dos-Rmecfepz)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco ASA Software is affected by a vulnerability.

  - Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow
    an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a
    denial of service (DoS) condition. The vulnerability is due to a flaw in logic handling when General
    Packet Radio Service (GPRS) Tunneling Protocol (GTP) extension headers are processed within the codec. An
    attacker could exploit this vulnerability by sending a crafted, fragmented UDP datagram that contains
    these headers to the Snort 3 Detection Engine of an affected device. A successful exploit could allow the
    attacker to cause the detection engine to enter an infinite loop, resulting in a DoS condition.
    (CVE-2026-76445)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-gtpcodec-dos-Rmecfepz
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3ccc6fad");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu17795");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwu17795");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-76445");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(835);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:adaptive_security_appliance_software");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/Cisco/ASA/model");

  exit(0);
}

include('ccf.inc');
include('cisco_workarounds.inc');

var product_info = cisco::get_product_info(name:'Cisco Adaptive Security Appliance (ASA) Software');

var vuln_ranges = [
  {'min_ver': '17.12', 'fix_ver': '17.12.8'},
  {'min_ver': '17.15', 'fix_ver': '17.15.6'},
  {'min_ver': '17.18', 'fix_ver': '17.18.5'},
  {'min_ver': '26.1', 'fix_ver': '26.1.2'},
  {'min_ver': '26.2', 'fix_ver': '26.2.1'}
];

var workarounds = make_list(CISCO_WORKAROUNDS['generic_workaround']);
var workaround_params = WORKAROUND_CONFIG['utd_enabled'];

var reporting = make_array(
  'port'    , 0,
  'severity', SECURITY_WARNING,
  'version' , product_info['version'],
  'bug_id'  , 'CSCwu17795'
);

cisco::check_and_report(
  product_info:product_info,
  workarounds:workarounds,
  workaround_params:workaround_params,
  reporting:reporting,
  vuln_ranges:vuln_ranges
);