Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.10.1.12)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(278725);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/12/15");

  script_cve_id(
    "CVE-2025-6395",
    "CVE-2025-26465",
    "CVE-2025-32988",
    "CVE-2025-32990",
    "CVE-2025-58060"
  );

  script_name(english:"Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.10.1.12)");

  script_set_attribute(attribute:"synopsis", value:
"The Nutanix AOS host is affected by multiple vulnerabilities .");
  script_set_attribute(attribute:"description", value:
"The version of AOS installed on the remote host is prior to 6.10.1.12. It is, therefore, affected by multiple
vulnerabilities as referenced in the NXSA-AOS-6.10.1.12 advisory.

  - A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic
    within the certtool utility. When it reads certain settings from a template file, it allows an attacker to
    cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service
    (DoS) that could potentially crash the system. (CVE-2025-32990)

  - A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership
    handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the
    type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not
    own, leading to a double-free condition when the parent function or caller later attempts to free the same
    structure. This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of
    service or memory corruption, depending on allocator behavior. (CVE-2025-32988)

  - A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite().
    (CVE-2025-6395)

  - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In
    versions 2.4.12 and earlier, when the `AuthType` is set to anything but `Basic`, if the request contains
    an `Authorization: Basic ...` header, the password is not checked. This results in authentication bypass.
    Any configuration that allows an `AuthType` that is not `Basic` is affected. Version 2.4.13 fixes the
    issue. (CVE-2025-58060)

  - A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle
    attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how
    OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be
    considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning
    the attack complexity high. (CVE-2025-26465)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://portal.nutanix.com/page/documents/security-advisories/release-advisories/details?id=NXSA-AOS-6.10.1.12
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bcf8b577");
  script_set_attribute(attribute:"solution", value:
"Update the Nutanix AOS software to the recommended version. Before upgrading: if this cluster is registered with Prism
Central, ensure that Prism Central has been upgraded first to a compatible version. Refer to the Software Product
Interoperability page on the Nutanix portal.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-32990");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/02/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/12/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/12/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:nutanix:aos");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nutanix_collect.nasl");
  script_require_keys("Host/Nutanix/Data/lts", "Host/Nutanix/Data/Service", "Host/Nutanix/Data/Version", "Host/Nutanix/Data/arch");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

var app_info = vcf::nutanix::get_app_info();

var constraints = [
  { 'fixed_version' : '6.10.1.12', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 6.10.1.12 or higher.', 'lts' : TRUE },
  { 'fixed_version' : '6.10.1.12', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 6.10.1.12 or higher.', 'lts' : TRUE }
];

vcf::nutanix::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);