Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.3.1.4)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(300398);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/13");

  script_cve_id(
    "CVE-2025-9230",
    "CVE-2025-64720",
    "CVE-2025-65018",
    "CVE-2025-66293",
    "CVE-2025-68615",
    "CVE-2025-68973"
  );

  script_name(english:"Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.3.1.4)");

  script_set_attribute(attribute:"synopsis", value:
"The Nutanix AHV host is affected by multiple vulnerabilities .");
  script_set_attribute(attribute:"description", value:
"The version of AHV installed on the remote host is prior to 10.3.1.4. It is, therefore, affected by multiple
vulnerabilities as referenced in the NXSA-AHV-10.3.1.4 advisory.

  - In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is
    intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are
    fixed versions.) (CVE-2025-68973)

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read
    vulnerability exists in png_image_read_composite when processing palette images with
    PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly
    applies background compositing during premultiplication, violating the invariant component  alpha  257
    required by the simplified PNG API. This issue has been patched in version 1.6.51. (CVE-2025-64720)

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow
    vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit
    interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond
    allocated buffer bounds. This issue has been patched in version 1.6.51. (CVE-2025-65018)

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
    Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's
    simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid
    palette PNG images with partial transparency and gamma correction. The PNG files that trigger this
    vulnerability are valid per the PNG specification; the bug is in libpng's internal state management.
    Upgrade to libpng 1.6.52 or later. (CVE-2025-66293)

  - Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can
    trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which
    leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which
    can have various consequences including a Denial of Service or Execution of attacker-supplied code.
    Although the consequences of a successful exploit of this vulnerability could be severe, the probability
    that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in
    CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to
    our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue,
    as the CMS implementation is outside the OpenSSL FIPS module boundary. (CVE-2025-9230)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://portal.nutanix.com/page/documents/security-advisories/release-advisories/details?id=NXSA-AHV-10.3.1.4
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6f41621b");
  script_set_attribute(attribute:"solution", value:
"Update the Nutanix AHV software to the recommended version. Before upgrading: if this cluster is registered with Prism
Central, ensure that Prism Central has been upgraded first to a compatible version. Refer to the Software Product
Interoperability page on the Nutanix portal.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-68973");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/04/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/03");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:nutanix:ahv");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nutanix_collect.nasl");
  script_require_keys("Host/Nutanix/Data/Node/Version", "Host/Nutanix/Data/Node/Type");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

var app_info = vcf::nutanix::get_app_info(node:TRUE);

var constraints = [
  { 'min_version' : '10.0', 'fixed_version' : '10.3.1.4', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to 10.3.1.4 or higher.' },
  { 'fixed_version' : '10.3.1.4', 'equal' : '20230302.102001', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to 10.3.1.4 or higher.' },
  { 'fixed_version' : '10.3.1.4', 'equal' : '20230302.102005', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to 10.3.1.4 or higher.' },
  { 'fixed_version' : '10.3.1.4', 'equal' : '20230302.103003', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to 10.3.1.4 or higher.' },
  { 'fixed_version' : '10.3.1.4', 'equal' : '20230302.103014', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to 10.3.1.4 or higher.' },
  { 'fixed_version' : '10.3.1.4', 'equal' : '20230302.103032', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to 10.3.1.4 or higher.' },
  { 'fixed_version' : '10.3.1.4', 'equal' : '20230302.103053', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to 10.3.1.4 or higher.' },
  { 'fixed_version' : '10.3.1.4', 'equal' : '20230302.103068', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to 10.3.1.4 or higher.' },
  { 'fixed_version' : '10.3.1.4', 'equal' : '20230302.103072', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to 10.3.1.4 or higher.' },
  { 'fixed_version' : '10.3.1.4', 'equal' : '20230302.103084', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to 10.3.1.4 or higher.' },
  { 'fixed_version' : '10.3.1.4', 'equal' : '20230302.103087', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to 10.3.1.4 or higher.' },
  { 'fixed_version' : '10.3.1.4', 'equal' : '20230302.103100', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to 10.3.1.4 or higher.' }
];

vcf::nutanix::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);