Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.3.1.1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(272046);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/27");

  script_cve_id(
    "CVE-2025-5914",
    "CVE-2025-6020",
    "CVE-2025-8194",
    "CVE-2025-47273",
    "CVE-2025-54389"
  );

  script_name(english:"Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.3.1.1)");

  script_set_attribute(attribute:"synopsis", value:
"The Nutanix AOS host is affected by multiple vulnerabilities .");
  script_set_attribute(attribute:"description", value:
"The version of AOS installed on the remote host is prior to 7.3.1.1. It is, therefore, affected by multiple
vulnerabilities as referenced in the NXSA-AOS-7.3.1.1 advisory.

  - setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python
    packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version
    78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the
    permissions of the process running the Python code, which could escalate to remote code execution
    depending on the context. Version 78.1.1 fixes the issue. (CVE-2025-47273)

  - A vulnerability has been identified in the libarchive library, specifically within the
    archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately
    lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption,
    enabling an attacker to execute arbitrary code or cause a denial-of-service condition. (CVE-2025-5914)

  - There is a defect in the CPython tarfile module affecting the TarFile extraction and entry enumeration
    APIs. The tar implementation would process tar archives with negative offsets without error, resulting in
    an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability
    can be mitigated by including the following patch after importing the tarfile module:
    https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1 (CVE-2025-8194)

  - A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without
    proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks
    and race conditions. (CVE-2025-6020)

  - AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output
    neutralization vulnerability in AIDE. An attacker can craft a malicious filename by including terminal
    escape sequences to hide the addition or removal of the file from the report and/or tamper with the log
    output. A local user might exploit this to bypass the AIDE detection of malicious files. Additionally the
    output of extended attribute key names and symbolic links targets are also not properly neutralized. This
    issue has been patched in version 0.19.2. A workaround involves configuring AIDE to write the report
    output to a regular file, redirecting stdout to a regular file, or redirecting the log output written to
    stderr to a regular file. (CVE-2025-54389)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://portal.nutanix.com/page/documents/security-advisories/release-advisories/details?id=NXSA-AOS-7.3.1.1
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4097a543");
  script_set_attribute(attribute:"solution", value:
"Update the Nutanix AOS software to the recommended version. Before upgrading: if this cluster is registered with Prism
Central, ensure that Prism Central has been upgraded first to a compatible version. Refer to the Software Product
Interoperability page on the Nutanix portal.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-5914");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2025-47273");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/10/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:nutanix:aos");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nutanix_collect.nasl");
  script_require_keys("Host/Nutanix/Data/lts", "Host/Nutanix/Data/Service", "Host/Nutanix/Data/Version", "Host/Nutanix/Data/arch");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

var app_info = vcf::nutanix::get_app_info();

var constraints = [
  { 'fixed_version' : '7.3.1.1', 'equal' : '6.10', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '6.10.0.5', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '6.10.1', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '6.10.1.5', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '6.10.1.6', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '6.10.1.7', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '6.10.1.8', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '6.10.1.9', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '6.10.1.10', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '6.10.1.11', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.0', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.0.0.5', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.0.1', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.0.1.5', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.0.1.6', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.0.1.7', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.0.1.8', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.0.1.9', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.0.1.10', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.3', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.3.0.1', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.3.0.5', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.3.0.6', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.3.0.7', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.3.1', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '6.10', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '6.10.0.5', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '6.10.1', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '6.10.1.5', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '6.10.1.6', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '6.10.1.7', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '6.10.1.8', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '6.10.1.9', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '6.10.1.10', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '6.10.1.11', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.0', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.0.0.5', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.0.1', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.0.1.5', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.0.1.6', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.0.1.7', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.0.1.8', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.0.1.9', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.0.1.10', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.3', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.3.0.1', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.3.0.5', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.3.0.6', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.3.0.7', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' },
  { 'fixed_version' : '7.3.1.1', 'equal' : '7.3.1', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.1 or higher.' }
];

vcf::nutanix::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);