Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-11.0.1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(303851);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/15");

  script_cve_id(
    "CVE-2025-5318",
    "CVE-2025-5987",
    "CVE-2025-9086",
    "CVE-2025-9230",
    "CVE-2025-9714",
    "CVE-2025-11083",
    "CVE-2025-40778",
    "CVE-2025-40780",
    "CVE-2025-45582",
    "CVE-2025-53905",
    "CVE-2025-53906",
    "CVE-2025-59375",
    "CVE-2025-61984",
    "CVE-2025-61985",
    "CVE-2025-64720",
    "CVE-2025-65018",
    "CVE-2025-66293"
  );

  script_name(english:"Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-11.0.1)");

  script_set_attribute(attribute:"synopsis", value:
"The Nutanix AHV host is affected by multiple vulnerabilities .");
  script_set_attribute(attribute:"description", value:
"The version of AHV installed on the remote host is prior to 11.0.1 / AHV-11.0.1. It is, therefore, affected by multiple
vulnerabilities as referenced in the NXSA-AHV-11.0.1 advisory.

  - A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages
    to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized
    cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code,
    resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead
    to undefined behavior, including compromised data confidentiality and integrity or crashes.
    (CVE-2025-5987)

  - A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in
    the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
    The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The
    identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended
    to deploy a patch. The code maintainer replied with [f]ixed for 2.46. (CVE-2025-11083)

  - 1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise
    made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3.
    The same cookie name is set - but with just a slash as path (`path=\/\,`). Since this site is not
    secure, the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside
    a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the
    wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to
    expectations and depending on the memory contents immediately following the single-byte allocation that
    holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie
    since it was already set as secure on a secure host so overriding it on an insecure host should not be
    okay. (CVE-2025-9086)

  - Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in
    Vim's tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives.
    Impact is low because this exploit requires direct user interaction. However, successfully exploitation
    can lead to overwriting sensitive files or placing executable code in privileged locations, depending on
    the permissions of the process editing the archive. The victim must edit such a file using Vim which will
    reveal the filename and the file content, a careful user may suspect some strange things going on.
    Successful exploitation could results in the ability to execute arbitrary commands on the underlying
    operating system. Version 9.1.1552 contains a patch for the vulnerability. (CVE-2025-53905)

  - Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in
    Vim's zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip archives.
    Impact is low because this exploit requires direct user interaction. However, successfully exploitation
    can lead to overwriting sensitive files or placing executable code in privileged locations, depending on
    the permissions of the process editing the archive. The victim must edit such a file using Vim which will
    reveal the filename and the file content, a careful user may suspect some strange things going on.
    Successful exploitation could results in the ability to execute arbitrary commands on the underlying
    operating system. Version 9.1.1551 contains a patch for the vulnerability. (CVE-2025-53906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://portal.nutanix.com/page/documents/security-advisories/release-advisories/details?id=NXSA-AHV-11.0.1
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5a59aa6a");
  script_set_attribute(attribute:"solution", value:
"Update the Nutanix AHV software to the recommended version. Before upgrading: if this cluster is registered with Prism
Central, ensure that Prism Central has been upgraded first to a compatible version. Refer to the Software Product
Interoperability page on the Nutanix portal.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-5318");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2025-5987");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2025-11083");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/04/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:nutanix:ahv");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nutanix_collect.nasl");
  script_require_keys("Host/Nutanix/Data/Node/Version", "Host/Nutanix/Data/Node/Type");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

var app_info = vcf::nutanix::get_app_info(node:TRUE);

var constraints = [
  { 'min_version' : '11.0', 'fixed_version' : '11.0.1', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1', 'equal' : '20230302.102001', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1', 'equal' : '20230302.102005', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1', 'equal' : '20230302.103003', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1', 'equal' : '20230302.103014', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1', 'equal' : '20230302.103032', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1', 'equal' : '20230302.103053', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1', 'equal' : '20230302.103068', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1', 'equal' : '20230302.103072', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1', 'equal' : '20230302.103084', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1', 'equal' : '20230302.103087', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1', 'equal' : '20230302.103100', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1 or higher.' }
];

vcf::nutanix::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);