Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nessusThis script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.NNM_6_2_2.NASL
HistoryJun 30, 2023 - 12:00 a.m.

Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)

2023-06-3000:00:00
This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
36
JSON

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  • c-ares from version 1.10.0 to version 1.19.1.
  • curl from version 7.79.1 to version 8.1.2.
  • libbzip2 from version 1.0.6 to version 1.0.8.
  • libpcre from version 8.42 to version 8.44.
  • libxml2 from version 2.7.7 to version 2.11.1.
  • libxslt from version 1.1.26 to version 1.1.37.
  • libxmlsec from version 1.2.18 to version 1.2.37.
  • sqlite from version 3.27.2 to version 3.40.1.
  • jQuery Cookie from version 1.3.1 to version 1.4.1.
  • jQuery UI from version 1.13.0 to version 1.13.2.
  • OpenSSL from version 3.0.8 to version 3.0.9.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(177842);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/07/06");

  script_cve_id(
    "CVE-2010-4008",
    "CVE-2010-4494",
    "CVE-2011-1202",
    "CVE-2011-1944",
    "CVE-2011-3970",
    "CVE-2012-0841",
    "CVE-2012-2870",
    "CVE-2012-2871",
    "CVE-2012-5134",
    "CVE-2012-6139",
    "CVE-2013-0338",
    "CVE-2013-0339",
    "CVE-2013-1969",
    "CVE-2013-2877",
    "CVE-2013-4520",
    "CVE-2014-3660",
    "CVE-2015-5312",
    "CVE-2015-7497",
    "CVE-2015-7498",
    "CVE-2015-7499",
    "CVE-2015-7500",
    "CVE-2015-7941",
    "CVE-2015-7942",
    "CVE-2015-7995",
    "CVE-2015-8035",
    "CVE-2015-8241",
    "CVE-2015-8242",
    "CVE-2015-8317",
    "CVE-2015-8710",
    "CVE-2015-8806",
    "CVE-2015-9019",
    "CVE-2016-1683",
    "CVE-2016-1684",
    "CVE-2016-1762",
    "CVE-2016-1833",
    "CVE-2016-1834",
    "CVE-2016-1836",
    "CVE-2016-1837",
    "CVE-2016-1838",
    "CVE-2016-1839",
    "CVE-2016-1840",
    "CVE-2016-2073",
    "CVE-2016-3189",
    "CVE-2016-3627",
    "CVE-2016-3705",
    "CVE-2016-3709",
    "CVE-2016-4447",
    "CVE-2016-4448",
    "CVE-2016-4449",
    "CVE-2016-4483",
    "CVE-2016-4607",
    "CVE-2016-4609",
    "CVE-2016-4658",
    "CVE-2016-5131",
    "CVE-2016-5180",
    "CVE-2016-9596",
    "CVE-2016-9597",
    "CVE-2016-9598",
    "CVE-2017-5029",
    "CVE-2017-5130",
    "CVE-2017-5969",
    "CVE-2017-7375",
    "CVE-2017-7376",
    "CVE-2017-8872",
    "CVE-2017-9047",
    "CVE-2017-9048",
    "CVE-2017-9049",
    "CVE-2017-9050",
    "CVE-2017-15412",
    "CVE-2017-16931",
    "CVE-2017-16932",
    "CVE-2017-18258",
    "CVE-2017-1000061",
    "CVE-2017-1000381",
    "CVE-2018-9251",
    "CVE-2018-14404",
    "CVE-2018-14567",
    "CVE-2019-5815",
    "CVE-2019-8457",
    "CVE-2019-9936",
    "CVE-2019-9937",
    "CVE-2019-11068",
    "CVE-2019-12900",
    "CVE-2019-13117",
    "CVE-2019-13118",
    "CVE-2019-16168",
    "CVE-2019-19242",
    "CVE-2019-19244",
    "CVE-2019-19317",
    "CVE-2019-19603",
    "CVE-2019-19645",
    "CVE-2019-19646",
    "CVE-2019-19880",
    "CVE-2019-19923",
    "CVE-2019-19924",
    "CVE-2019-19925",
    "CVE-2019-19926",
    "CVE-2019-19956",
    "CVE-2019-19959",
    "CVE-2019-20218",
    "CVE-2019-20388",
    "CVE-2019-20838",
    "CVE-2020-7595",
    "CVE-2020-9327",
    "CVE-2020-11655",
    "CVE-2020-11656",
    "CVE-2020-13434",
    "CVE-2020-13435",
    "CVE-2020-13630",
    "CVE-2020-13631",
    "CVE-2020-13632",
    "CVE-2020-13871",
    "CVE-2020-14155",
    "CVE-2020-15358",
    "CVE-2020-24977",
    "CVE-2020-35525",
    "CVE-2020-35527",
    "CVE-2021-3517",
    "CVE-2021-3518",
    "CVE-2021-3537",
    "CVE-2021-3541",
    "CVE-2021-3672",
    "CVE-2021-20227",
    "CVE-2021-30560",
    "CVE-2021-31239",
    "CVE-2021-36690",
    "CVE-2021-45346",
    "CVE-2022-4904",
    "CVE-2022-22576",
    "CVE-2022-23308",
    "CVE-2022-23395",
    "CVE-2022-27774",
    "CVE-2022-27775",
    "CVE-2022-27776",
    "CVE-2022-27781",
    "CVE-2022-27782",
    "CVE-2022-29824",
    "CVE-2022-31160",
    "CVE-2022-32205",
    "CVE-2022-32206",
    "CVE-2022-32207",
    "CVE-2022-32208",
    "CVE-2022-32221",
    "CVE-2022-35252",
    "CVE-2022-35737",
    "CVE-2022-40303",
    "CVE-2022-40304",
    "CVE-2022-42915",
    "CVE-2022-42916",
    "CVE-2022-43551",
    "CVE-2022-43552",
    "CVE-2022-46908",
    "CVE-2023-0465",
    "CVE-2023-0466",
    "CVE-2023-1255",
    "CVE-2023-2650",
    "CVE-2023-23914",
    "CVE-2023-23915",
    "CVE-2023-23916",
    "CVE-2023-27533",
    "CVE-2023-27534",
    "CVE-2023-27535",
    "CVE-2023-27536",
    "CVE-2023-27538",
    "CVE-2023-28320",
    "CVE-2023-28321",
    "CVE-2023-28322",
    "CVE-2023-28484",
    "CVE-2023-29469",
    "CVE-2023-31124",
    "CVE-2023-31130",
    "CVE-2023-31147",
    "CVE-2023-32067"
  );
  script_xref(name:"CEA-ID", value:"CEA-2021-0025");
  script_xref(name:"CEA-ID", value:"CEA-2021-0004");
  script_xref(name:"CEA-ID", value:"CEA-2022-0026");

  script_name(english:"Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)");

  script_set_attribute(attribute:"synopsis", value:
"An instance of Tenable NNM installed on the remote system is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is,
therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party 
components were found to contain vulnerabilities, and updated versions have been made available by the providers. 
Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential 
impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.");
  script_set_attribute(attribute:"see_also", value:"https://docs.tenable.com/releasenotes/Content/nnm/2023nnm.htm");
  script_set_attribute(attribute:"see_also", value:"https://www.tenable.com/security/TNS-2023-23");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Nessus Network Monitor 6.2.2 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-7376");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2022-32221");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/06/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/06/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/06/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:tenable:nnm");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nnm_installed_win.nbin", "nnm_installed_nix.nbin");
  script_require_keys("installed_sw/Tenable NNM", "Host/nnm_installed");

  exit(0);
}

include('vcf.inc');

var app_name = 'Tenable NNM';

var app_info = vcf::get_app_info(app:app_name);

vcf::check_granularity(app_info:app_info, sig_segments:3);

var constraints = [
  { 'max_version' : '6.2.1', 'fixed_version' : '6.2.2' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);
VendorProductVersionCPE
tenablennmcpe:/a:tenable:nnm

References

Related

openvas 44
tenable 1
nessus 50
suse 5
gentoo 2
rosalinux 1
osv 36
oraclelinux 3
centos 3
veracode 3
ibm 20
freebsd 1
redhat 3
debian 6
f5 1
mageia 4
amazon 4
cloudfoundry 2
ubuntu 2
altlinux 5
rubygems 1
archlinux 2
openvas
openvas
Tenable Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)
2023-07-04 00:00:00
openSUSE: Security Advisory for sqlite3 (openSUSE-SU-2021:2320-1)
2021-07-15 00:00:00
openSUSE: Security Advisory for sqlite3 (openSUSE-SU-2021:1058-1)
2021-07-20 00:00:00
tenable
tenable
[R1] Nessus Network Monitor 6.2.2 Fixes Multiple Vulnerabilities
2023-06-29 10:45:47
nessus
nessus
SUSE SLED15 / SLES15 Security Update : sqlite3 (SUSE-SU-2021:2320-1)
2021-07-15 00:00:00
openSUSE 15 Security Update : sqlite3 (openSUSE-SU-2021:2320-1)
2021-07-16 00:00:00
GLSA-201701-37 : libxml2: Multiple vulnerabilities
2017-01-17 00:00:00
suse
suse
Security update for sqlite3 (important)
2021-07-14 00:00:00
Security update for sqlite3 (important)
2021-07-20 00:00:00
Security update for libxml2 (important)
2016-06-16 13:10:48
gentoo
gentoo
libxml2: Multiple vulnerabilities
2017-01-16 00:00:00
SQLite: Multiple vulnerabilities
2020-07-27 00:00:00
rosalinux
rosalinux
Advisory ROSA-SA-2021-1905
2021-07-02 17:25:35
osv
osv
CVE-2021-3518
2021-05-18 12:15:08
CVE-2016-3709
2022-07-28 17:15:07
CVE-2023-29469
2023-04-24 21:15:09
oraclelinux
oraclelinux
libxml2 security update
2015-12-07 00:00:00
libxml2 security update
2015-12-07 00:00:00
libxml2 security update
2016-06-23 00:00:00
centos
centos
libxml2 security update
2015-12-07 13:26:33
libxml2 security update
2015-12-07 20:38:05
libxml2 security update
2016-06-23 15:28:21
veracode
veracode
Denial Of Service (DoS)
2019-05-02 05:51:46
Denial Of Service (DoS)
2019-05-02 05:51:46
Information Disclosure
2019-05-02 05:51:46
ibm
ibm
Security Bulletin: Multiple Vulnerabilities in libpng and libxml affect Rational DOORS
2020-05-01 08:19:24
Security Bulletin: Vulnerabilities in XML processing affect IBM DataPower Gateways
2021-06-08 22:18:27
Security Bulletin: IBM Cognos Business Intelligence Server 2017Q4 Security Updater: IBM Cognos Business Intelligence Server is affected by multiple vulnerabilities.
2018-06-15 23:47:49
freebsd
freebsd
libxml2 -- multiple vulnerabilities
2015-11-20 00:00:00
redhat
redhat
(RHSA-2015:2549) Moderate: libxml2 security update
2015-12-07 00:00:00
(RHSA-2015:2550) Moderate: libxml2 security update
2015-12-07 10:04:33
(RHSA-2016:1292) Important: libxml2 security update
2016-06-23 08:21:08
debian
debian
[SECURITY] [DSA 3593-1] libxml2 security update
2016-06-02 20:28:31
[SECURITY] [DLA 503-1] libxml2 security update
2016-06-03 19:22:01
[SECURITY] [DSA 3593-1] libxml2 security update
2016-06-02 20:28:31
f5
f5
K61570943 : Multiple libXML2 vulnerabilities
2016-02-15 00:00:00
mageia
mageia
Updated libxml2 packages fix security vulnerabilities
2015-11-26 23:47:39
Updated libxml2 packages fix security vulnerability
2016-07-27 00:59:16
Updated sqlite3 packages fix security vulnerabilities
2021-07-01 02:58:41
amazon
amazon
Medium: libxml2
2019-05-29 19:14:00
Important: libxml2
2016-07-14 16:30:00
Medium: libxml2
2015-12-14 10:00:00
cloudfoundry
cloudfoundry
USN-2994-1 libxml2 vulnerabilities | Cloud Foundry
2016-06-13 00:00:00
USN-2834-1 libxml2 vulnerability | Cloud Foundry
2016-01-07 00:00:00
ubuntu
ubuntu
libxml2 vulnerabilities
2015-12-14 00:00:00
libxml2 vulnerabilities
2016-06-06 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 9 package libxml2 version 1:2.9.9.0.52.f824-alt1
2019-05-22 00:00:00
Security fix for the ALT Linux 10 package libxml2 version 1:2.9.9.0.52.f824-alt1
2019-05-22 00:00:00
Security fix for the ALT Linux 8 package libxml2 version 1:2.9.4.0.12.e905-alt1
2017-03-07 00:00:00
rubygems
rubygems
Nokogiri gem contains several vulnerabilities in libxml2
2015-12-14 21:00:00
archlinux
archlinux
libxml2: multiple issues
2016-05-26 00:00:00
libxml2: multiple issues
2015-12-09 00:00:00
JSON
Related for NNM_6_2_2.NASL
openvas44tenable1nessus50suse5gentoo2rosalinux1osv36oraclelinux3centos3veracode3ibm20freebsd1redhat3debian6f51mageia4amazon4cloudfoundry2ubuntu2altlinux5rubygems1archlinux2