Rockwell Automation Allen-Bradley Stratix 5950 Improper Input Validation (CVE-2018-0228)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(506171);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/06");

  script_cve_id("CVE-2018-0228");

  script_name(english:"Rockwell Automation Allen-Bradley Stratix 5950 Improper Input Validation (CVE-2018-0228)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the ingress flow creation functionality of Cisco
Adaptive Security Appliance (ASA) could allow an unauthenticated,
remote attacker to cause the CPU to increase upwards of 100%
utilization, causing a denial of service (DoS) condition on an
affected system. The vulnerability is due to incorrect handling of an
internal software lock that could prevent other system processes from
getting CPU cycles, causing a high CPU condition. An attacker could
exploit this vulnerability by sending a steady stream of malicious IP
packets that can cause connections to be created on the targeted
device. A successful exploit could allow the attacker to exhaust CPU
resources, resulting in a DoS condition during which traffic through
the device could be delayed. This vulnerability applies to either IPv4
or IPv6 ingress traffic. This vulnerability affects Cisco Adaptive
Security Appliance (ASA) and Firepower Threat Defense (FTD) Software
that is running on the following Cisco products: 3000 Series
Industrial Security Appliances (ISA), ASA 5500 Series Adaptive
Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA
Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600
Series Routers, Adaptive Security Virtual Appliances (ASAv), Firepower
2100 Series Security Appliances, Firepower 4110 Security Appliances,
Firepower 9300 ASA Security Modules. Cisco Bug IDs: CSCvf63718.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa2
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d86bee0f");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/104220");
  script_set_attribute(attribute:"see_also", value:"http://www.securitytracker.com/id/1040724");
  script_set_attribute(attribute:"see_also", value:"https://ics-cert.us-cert.gov/advisories/ICSA-18-184-01");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Rockwell Automation will inform users of updated firmware as soon as it is available. Rockwell Automation recommends
that users using affected devices apply the following risk mitigation strategies:

- CVE-2018-0228 — The ASA and FTD configuration commands—set connection per-client-embryonic-max (TCP) and set
connection per-client-max (TCP, UDP, and Stream Control Transmission Protocol [SCTP])—can be configured to limit the
number of connection requests allowed. Using these configuration parameters can reduce the number of connections and
greatly reduce the impact of the DoS attack.
- CVE-2018-0227 — No workarounds available
- CVE-2018-0231 — No workarounds available
- CVE-2018-0240 — No workarounds available
- CVE-2018-0296 — Cisco has released Snort Rule 46897

For additional information please see the Rockwell Automation security notification at (login required):
https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1073860

Additionally the Cisco advisories can be found at the following links:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa2

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa1

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa3

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa_inspect

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-0228");
  script_cwe_id(20, 667);

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/04/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/04/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/06");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:98.1%2812.187%29");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:adaptive_security_appliance_software:9.2" :
        {"versionEndExcluding" : "9.2.4.27", "versionStartIncluding" : "9.2", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.9" :
        {"versionEndExcluding" : "9.9.1", "versionStartIncluding" : "9.9", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:98.1%2812.187%29" :
        {"versionEndIncluding" : "98.1%2812.187%29", "versionStartIncluding" : "98.1%2812.187%29", "family" : "CiscoFirepower"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);