Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-11.0.1.2)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(319295);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/27");

  script_cve_id(
    "CVE-2023-40403",
    "CVE-2025-14831",
    "CVE-2025-15366",
    "CVE-2025-15367",
    "CVE-2025-61662",
    "CVE-2025-67873",
    "CVE-2025-68114",
    "CVE-2026-1299",
    "CVE-2026-3497",
    "CVE-2026-4111",
    "CVE-2026-4424",
    "CVE-2026-4519",
    "CVE-2026-5121",
    "CVE-2026-25749",
    "CVE-2026-27135",
    "CVE-2026-28417",
    "CVE-2026-28421",
    "CVE-2026-33412"
  );
  script_xref(name:"IAVA", value:"2026-A-0692");

  script_name(english:"Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-11.0.1.2)");

  script_set_attribute(attribute:"synopsis", value:
"The Nutanix AHV host is affected by multiple vulnerabilities .");
  script_set_attribute(attribute:"description", value:
"The version of AHV installed on the remote host is prior to 11.0.1.2 / AHV-11.0.1.2. It is, therefore, affected by
multiple vulnerabilities as referenced in the NXSA-AHV-11.0.1.2 advisory.

  - Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in
    SStream_concat lets a malicious cs_opt_mem.vsnprintf drive SStream's index negative or past the end,
    leading to a stack buffer underflow/overflow when the next write occurs. Commit
    2c7797182a1618be12017d7d41e0b6581d5d529e fixes the issue. (CVE-2025-68114)

  - The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line
    options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize
    URLs prior to passing to webbrowser.open(). (CVE-2026-4519)

  - A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central
    Processing Unit) and memory consumption via specially crafted malicious certificates containing a large
    number of name constraints and subject alternative names (SANs). (CVE-2025-14831)

  - nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1,
    the nghttp2 library stops reading the incoming data when user facing public API
    `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application.
    They might be called internally by the library when it detects the situation that is subject to connection
    error. Due to the missing internal state validation, the library keeps reading the rest of the data after
    one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes
    assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known
    workarounds are available. (CVE-2026-27135)

  - A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive
    processing logic due to improper validation of the LZSS sliding window size after transitions between
    compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive,
    leading to the disclosure of sensitive heap memory information without requiring authentication or user
    interaction. (CVE-2026-4424)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://portal.nutanix.com/page/documents/security-advisories/release-advisories/details?id=NXSA-AHV-11.0.1.2
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f8b8ed3e");
  script_set_attribute(attribute:"solution", value:
"Update the Nutanix AHV software to the recommended version. Before upgrading: if this cluster is registered with Prism
Central, ensure that Prism Central has been upgraded first to a compatible version. Refer to the Software Product
Interoperability page on the Nutanix portal.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-68114");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-4519");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/09/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:nutanix:ahv");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nutanix_collect.nasl");
  script_require_keys("Host/Nutanix/Data/Node/Version", "Host/Nutanix/Data/Node/Type");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

var app_info = vcf::nutanix::get_app_info(node:TRUE);

var constraints = [
  { 'min_version' : '11.0', 'fixed_version' : '11.0.1.2', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1.2', 'equal' : '20230302.102001', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1.2', 'equal' : '20230302.102005', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1.2', 'equal' : '20230302.103003', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1.2', 'equal' : '20230302.103014', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1.2', 'equal' : '20230302.103032', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1.2', 'equal' : '20230302.103053', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1.2', 'equal' : '20230302.103068', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1.2', 'equal' : '20230302.103072', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1.2', 'equal' : '20230302.103084', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1.2', 'equal' : '20230302.103087', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1.2 or higher.' },
  { 'fixed_version' : 'AHV-11.0.1.2', 'equal' : '20230302.103100', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-11.0.1.2 or higher.' }
];

vcf::nutanix::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);