Cisco ASA IKEv1/IKEv2 Buffer Overflow (CVE-2016-1287)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505548);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/21");

  script_cve_id("CVE-2016-1287");

  script_name(english:"Cisco ASA IKEv1/IKEv2 Buffer Overflow (CVE-2016-1287)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the Internet Key Exchange (IKE) version 1 (v1)
and IKE version 2 (v2) code of Cisco ASA Software could allow an
unauthenticated, remote attacker to cause a reload of the affected
system or to remotely execute code. The vulnerability is due to a
buffer overflow in the affected code area. An attacker could exploit
this vulnerability by sending crafted UDP packets to the affected
system. An attacker could exploit this vulnerability by sending
crafted UDP packets to the affected system. Only traffic directed to
the affected system can be used to exploit this vulnerability. This
vulnerability affects systems configured in routed and transparent
firewall mode and in single or multiple context mode. This
vulnerability can be triggered by IPv4 and IPv6 traffic. A valid IKE
phase 1 SA is not required to exploit this vulnerability.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b63e3f2a");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-1287");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(119);

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/02/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/02/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/20");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:adaptive_security_appliance_software:7.2" :
        {"versionStartIncluding" : "7.2", "versionEndExcluding" : "8.2.5.59", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:8.2" :
        {"versionStartIncluding" : "8.2", "versionEndExcluding" : "8.2.5.59", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:8.4" :
        {"versionStartIncluding" : "8.4", "versionEndExcluding" : "8.4.7.30", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:8.7" :
        {"versionStartIncluding" : "8.7", "versionEndExcluding" : "8.7.1.18", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.0" :
        {"versionStartIncluding" : "9.0", "versionEndExcluding" : "9.0.4.38", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.1" :
        {"versionStartIncluding" : "9.1", "versionEndExcluding" : "9.1.6.11", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.2" :
        {"versionStartIncluding" : "9.2", "versionEndExcluding" : "9.2.4.5", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.3" :
        {"versionStartIncluding" : "9.3", "versionEndExcluding" : "9.3.3.7", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.4" :
        {"versionStartIncluding" : "9.4", "versionEndExcluding" : "9.4.2.4", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.5" :
        {"versionStartIncluding" : "9.5", "versionEndExcluding" : "9.5.2.2", "family" : "CiscoFirepower", "os" : "ASA"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);