Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.0.1.2)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(253664);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/15");

  script_cve_id(
    "CVE-2016-9840",
    "CVE-2024-8176",
    "CVE-2024-12133",
    "CVE-2024-12243",
    "CVE-2024-24786",
    "CVE-2024-55549",
    "CVE-2025-0395",
    "CVE-2025-3576",
    "CVE-2025-24855",
    "CVE-2025-27363",
    "CVE-2025-32414"
  );
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/05/27");

  script_name(english:"Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.0.1.2)");

  script_set_attribute(attribute:"synopsis", value:
"The Nutanix AHV host is affected by multiple vulnerabilities .");
  script_set_attribute(attribute:"description", value:
"The version of AHV installed on the remote host is prior to 10.0.1.2 / AHV-10.0.1.2. It is, therefore, affected by
multiple vulnerabilities as referenced in the NXSA-AHV-10.0.1.2 advisory.

  - inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging
    improper pointer arithmetic. (CVE-2016-9840)

  - xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result
    prefixes. (CVE-2024-55549)

  - numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath
    context node can be modified but never restored. This is related to xsltNumberFormatGetValue,
    xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal. (CVE-2025-24855)

  - A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity
    expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat
    can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could
    lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the
    environment and library usage. (CVE-2024-8176)

  - When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough
    space for the assertion failure message string and size information, which may lead to a buffer overflow
    if the message string size aligns to page size. (CVE-2025-0395)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://portal.nutanix.com/page/documents/security-advisories/release-advisories/details?id=NXSA-AHV-10.0.1.2
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?61151fb2");
  script_set_attribute(attribute:"solution", value:
"Update the Nutanix AHV software to the recommended version. Before upgrading: if this cluster is registered with Prism
Central, ensure that Prism Central has been upgraded first to a compatible version. Refer to the Software Product
Interoperability page on the Nutanix portal.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:A");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-9840");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2024-24786");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/12/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/08/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/08/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:nutanix:ahv");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nutanix_collect.nasl");
  script_require_keys("Host/Nutanix/Data/Node/Version", "Host/Nutanix/Data/Node/Type");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

var app_info = vcf::nutanix::get_app_info(node:TRUE);

var constraints = [
  { 'min_version' : '10.0', 'fixed_version' : '10.0.1.2', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-10.0.1.2', 'equal' : '20230302.207', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-10.0.1.2', 'equal' : '20230302.216', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-10.0.1.2', 'equal' : '20230302.1011', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-10.0.1.2', 'equal' : '20230302.2008', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-10.0.1.2', 'equal' : '20230302.2010', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-10.0.1.2', 'equal' : '20230302.2014', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-10.0.1.2', 'equal' : '20230302.2024', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-10.0.1.2', 'equal' : '20230302.3002', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-10.0.1.2', 'equal' : '20230302.100173', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-10.0.1.2', 'equal' : '20230302.100187', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-10.0.1.2', 'equal' : '20230302.101026', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-10.0.1.2', 'equal' : '20230302.101035', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-10.0.1.2', 'equal' : '20230302.101046', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-10.0.1.2', 'equal' : '20230302.101060', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-10.0.1.2', 'equal' : '20230302.102001', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-10.0.1.2', 'equal' : '20230302.102005', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-10.0.1.2', 'equal' : '20230302.103003', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-10.0.1.2', 'equal' : '20230302.103014', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-10.0.1.2', 'equal' : '20230302.103032', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-10.0.1.2', 'equal' : '20230302.103053', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.0.1.2 or higher.' }
];

vcf::nutanix::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);