Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability (CVE-2014-3931)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(271368);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/25");

  script_cve_id("CVE-2014-3931");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/07/28");

  script_name(english:"Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability (CVE-2014-3931)");

  script_set_attribute(attribute:"synopsis", value:
"Multi-Router Looking Glass (MRLG) affected by buffer overflow in fastping.c before version 5.5.0 RCE.");
  script_set_attribute(attribute:"description", value:
"The version of Multi-Router Looking Glass (MRLG) installed on the remote host is prior to 5.5.0. It is, 
therefore, affected by a memory-handling vulnerability in fastping.c that can be triggered remotely 
without authentication. Therefore, an attacker could send crafted input through the MRLG interface 
or over the network to corrupt memory and potentially execute arbitrary code with the privileges of 
the web-server process, exposing the system to full compromise. Administrators are advised to 
upgrade to MRLG 5.5.0 immediately.
 
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mrlg.op-sec.us/");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Multi-Router Looking Glass version 5.5.0 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2014-3931");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/03/31");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/03/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/24");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:multi-router_looking_glass_project:multi-router_looking_glass");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("op-sec_mrlg_detect.nbin");
  script_require_ports("Services/www", 80, 443);

  exit(0);
}

include('vcf.inc');

var app = 'OP-SEC Multi-Router Looking Glass';
var app_info = vcf::combined_get_app_info(app:app);
vcf::check_granularity(app_info:app_info, sig_segments:3);

constraints = [
  { 'fixed_version' : '5.5.0' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);