Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.10.1.9)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(253515);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/26");

  script_cve_id(
    "CVE-2016-9840",
    "CVE-2023-40403",
    "CVE-2024-12243",
    "CVE-2025-3576",
    "CVE-2025-4802",
    "CVE-2025-6020",
    "CVE-2025-6021",
    "CVE-2025-47273",
    "CVE-2025-49794",
    "CVE-2025-49796"
  );

  script_name(english:"Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.10.1.9)");

  script_set_attribute(attribute:"synopsis", value:
"The Nutanix AOS host is affected by multiple vulnerabilities .");
  script_set_attribute(attribute:"description", value:
"The version of AOS installed on the remote host is prior to 6.10.1.9. It is, therefore, affected by multiple
vulnerabilities as referenced in the NXSA-AOS-6.10.1.9 advisory.

  - setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python
    packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version
    78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the
    permissions of the process running the Python code, which could escalate to remote code execution
    depending on the context. Version 78.1.1 fixes the issue. (CVE-2025-47273)

  - inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging
    improper pointer arithmetic. (CVE-2016-9840)

  - A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under
    certain circumstances when the XML schematron has the <sch:name path=.../> schema elements. This flaw
    allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the
    program's crash using libxml or other possible undefined behaviors. (CVE-2025-49794)

  - A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can
    trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that
    can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to
    sensitive data being corrupted in memory. (CVE-2025-49796)

  - A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations
    can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of
    service when processing crafted input. (CVE-2025-6021)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://portal.nutanix.com/page/documents/security-advisories/release-advisories/details?id=NXSA-AOS-6.10.1.9
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?33994f60");
  script_set_attribute(attribute:"solution", value:
"Update the Nutanix AOS software to the recommended version. Before upgrading: if this cluster is registered with Prism
Central, ensure that Prism Central has been upgraded first to a compatible version. Refer to the Software Product
Interoperability page on the Nutanix portal.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-9840");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2025-47273");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2025-47273");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/12/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/08/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/08/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:nutanix:aos");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nutanix_collect.nasl");
  script_require_keys("Host/Nutanix/Data/lts", "Host/Nutanix/Data/Service", "Host/Nutanix/Data/Version", "Host/Nutanix/Data/arch");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

var app_info = vcf::nutanix::get_app_info();

var constraints = [
  { 'fixed_version' : '6.10.1.9', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 6.10.1.9 or higher.', 'lts' : TRUE },
  { 'fixed_version' : '6.10.1.9', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 6.10.1.9 or higher.', 'lts' : TRUE }
];

vcf::nutanix::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);