Cisco ASA/FTD WebVPN Double Free (CVE-2018-0101)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505546);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/20");

  script_cve_id("CVE-2018-0101");

  script_name(english:"Cisco ASA/FTD WebVPN Double Free (CVE-2018-0101)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the Secure Sockets Layer (SSL) VPN functionality
of the Cisco Adaptive Security Appliance (ASA) Software could allow
an unauthenticated, remote attacker to cause a reload of the affected
system or to remotely execute code. The vulnerability is due to an
attempt to double free a region of memory when the webvpn feature is
enabled on the Cisco ASA device. An attacker could exploit this
vulnerability by sending multiple, crafted XML packets to a
webvpn-configured interface on the affected system. An exploit could
allow the attacker to execute arbitrary code and obtain full control
of the system, or cause a reload of the affected device. This
vulnerability affects Cisco ASA Software that is running on the
following Cisco products: 3000 Series Industrial Security Appliance
(ISA), ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series
Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500
Series Switches and Cisco 7600 Series Routers, ASA 1000V Cloud
Firewall, Adaptive Security Virtual Appliance (ASAv), Firepower 2100
Series Security Appliance, Firepower 4110 Security Appliance,
Firepower 9300 ASA Security Module, FTD Software (Version 6.2.2 only).

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2fc59e84");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-0101");

  script_cwe_id(415);

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/01/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/01/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/20");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:firepower_threat_defense");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:adaptive_security_appliance_software:9.1_branch" :
        {"versionStartIncluding" : "9.1", "versionEndExcluding" : "9.1.7.23", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.2_branch" :
        {"versionStartIncluding" : "9.2", "versionEndExcluding" : "9.2.4.27", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.4_branch" :
        {"versionStartIncluding" : "9.4", "versionEndExcluding" : "9.4.4.16", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.6_branch" :
        {"versionStartIncluding" : "9.6", "versionEndExcluding" : "9.6.4.3", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.7_branch" :
        {"versionStartIncluding" : "9.7", "versionEndExcluding" : "9.7.1.21", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.8_branch" :
        {"versionStartIncluding" : "9.8", "versionEndExcluding" : "9.8.2.20", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.9_branch" :
        {"versionStartIncluding" : "9.9", "versionEndExcluding" : "9.9.1.2", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:firepower_threat_defense:6.0" :
        {"versionStartIncluding" : "6.0.0", "versionEndExcluding" : "6.0.1.5", "family" : "CiscoFirepower", "os" : "FTD"},
    "cpe:/o:cisco:firepower_threat_defense:6.1" :
        {"versionStartIncluding" : "6.1.0", "versionEndExcluding" : "6.1.0.7", "family" : "CiscoFirepower", "os" : "FTD"},
    "cpe:/o:cisco:firepower_threat_defense:6.2" :
        {"versionStartIncluding" : "6.2.0", "versionEndExcluding" : "6.2.2.2", "family" : "CiscoFirepower", "os" : "FTD"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);