Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.3.1.7)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(310749);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/15");

  script_cve_id(
    "CVE-2025-0938",
    "CVE-2025-9820",
    "CVE-2025-14831",
    "CVE-2025-15281",
    "CVE-2025-69419",
    "CVE-2026-0915",
    "CVE-2026-23490",
    "CVE-2026-25749"
  );

  script_name(english:"Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.3.1.7)");

  script_set_attribute(attribute:"synopsis", value:
"The Nutanix AHV host is affected by multiple vulnerabilities .");
  script_set_attribute(attribute:"description", value:
"The version of AHV installed on the remote host is prior to 10.3.1.7 / AHV-10.3.1.7. It is, therefore, affected by
multiple vulnerabilities as referenced in the NXSA-AHV-10.3.1.7 advisory.

  - Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS
    backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version
    2.42 can leak stack contents to the configured DNS resolver. (CVE-2026-0915)

  - pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found
    that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This
    vulnerability is fixed in 0.6.2. (CVE-2026-23490)

  - Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a
    BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before
    the allocated buffer. Impact summary: The out-of-bounds write can cause a memory corruption which can have
    various consequences including a Denial of Service. The OPENSSL_uni2utf8() function performs a two-pass
    conversion of a PKCS#12 BMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes, the
    helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16 source byte count as the
    destination buffer capacity to UTF8_putc(). For BMP code points above U+07FF, UTF-8 requires three bytes,
    but the forwarded capacity can be just two bytes. UTF8_putc() then returns -1, and this negative value is
    added to the output length without validation, causing the length to become negative. The subsequent
    trailing NUL byte is then written at a negative offset, causing write outside of heap allocated buffer.
    The vulnerability is reachable via the public PKCS12_get_friendlyname() API when parsing attacker-
    controlled PKCS#12 files. While PKCS12_parse() uses a different code path that avoids this issue,
    PKCS12_get_friendlyname() directly invokes the vulnerable function. Exploitation requires an attacker to
    provide a malicious PKCS#12 file to be parsed by the application and the attacker can just trigger a one
    zero byte write before the allocated buffer. For that reason the issue was assessed as Low severity
    according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this
    issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4,
    3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue.
    (CVE-2025-69419)

  - Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow
    vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The
    vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim
    copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes
    (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been
    patched in version 9.1.2132. (CVE-2026-25749)

  - The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that
    included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be
    used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential
    parsing across the Python URL parser and other specification-compliant URL parsers. (CVE-2025-0938)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://portal.nutanix.com/page/documents/security-advisories/release-advisories/details?id=NXSA-AHV-10.3.1.7
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6346879b");
  script_set_attribute(attribute:"solution", value:
"Update the Nutanix AHV software to the recommended version. Before upgrading: if this cluster is registered with Prism
Central, ensure that Prism Central has been upgraded first to a compatible version. Refer to the Software Product
Interoperability page on the Nutanix portal.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-0915");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2025-0938");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/04/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/28");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:nutanix:ahv");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nutanix_collect.nasl");
  script_require_keys("Host/Nutanix/Data/Node/Version", "Host/Nutanix/Data/Node/Type");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

var app_info = vcf::nutanix::get_app_info(node:TRUE);

var constraints = [
  { 'min_version' : '10.0', 'fixed_version' : '10.3.1.7', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.3.1.7 or higher.' },
  { 'fixed_version' : 'AHV-10.3.1.7', 'equal' : '20230302.102001', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.3.1.7 or higher.' },
  { 'fixed_version' : 'AHV-10.3.1.7', 'equal' : '20230302.102005', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.3.1.7 or higher.' },
  { 'fixed_version' : 'AHV-10.3.1.7', 'equal' : '20230302.103003', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.3.1.7 or higher.' },
  { 'fixed_version' : 'AHV-10.3.1.7', 'equal' : '20230302.103014', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.3.1.7 or higher.' },
  { 'fixed_version' : 'AHV-10.3.1.7', 'equal' : '20230302.103032', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.3.1.7 or higher.' },
  { 'fixed_version' : 'AHV-10.3.1.7', 'equal' : '20230302.103053', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.3.1.7 or higher.' },
  { 'fixed_version' : 'AHV-10.3.1.7', 'equal' : '20230302.103068', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.3.1.7 or higher.' },
  { 'fixed_version' : 'AHV-10.3.1.7', 'equal' : '20230302.103072', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.3.1.7 or higher.' },
  { 'fixed_version' : 'AHV-10.3.1.7', 'equal' : '20230302.103084', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.3.1.7 or higher.' },
  { 'fixed_version' : 'AHV-10.3.1.7', 'equal' : '20230302.103087', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.3.1.7 or higher.' },
  { 'fixed_version' : 'AHV-10.3.1.7', 'equal' : '20230302.103100', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.3.1.7 or higher.' }
];

vcf::nutanix::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);