Rockwell Automation Allen-Bradley Stratix 5950 Improper Input Validation (CVE-2018-0231)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(506047);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/06");

  script_cve_id("CVE-2018-0231");

  script_name(english:"Rockwell Automation Allen-Bradley Stratix 5950 Improper Input Validation (CVE-2018-0231)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the Transport Layer Security (TLS) library of Cisco
Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat
Defense (FTD) Software could allow an unauthenticated, remote attacker
to trigger a reload of the affected device, resulting in a denial of
service (DoS) condition. The vulnerability is due to insufficient
validation of user-supplied input. An attacker could exploit this
vulnerability by sending a malicious TLS message to an interface
enabled for Secure Layer Socket (SSL) services on an affected device.
Messages using SSL Version 3 (SSLv3) or SSL Version 2 (SSLv2) cannot
be be used to exploit this vulnerability. An exploit could allow the
attacker to cause a buffer underflow, triggering a crash on an
affected device. This vulnerability affects Cisco ASA Software and
Cisco FTD Software that is running on the following Cisco products:
Adaptive Security Virtual Appliance (ASAv), Firepower Threat Defense
Virtual (FTDv), Firepower 2100 Series Security Appliance. Cisco Bug
IDs: CSCve18902, CSCve34335, CSCve38446.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa3
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?72e6e924");
  script_set_attribute(attribute:"see_also", value:"http://www.securitytracker.com/id/1040725");
  script_set_attribute(attribute:"see_also", value:"https://ics-cert.us-cert.gov/advisories/ICSA-18-184-01");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Rockwell Automation will inform users of updated firmware as soon as it is available. Rockwell Automation recommends
that users using affected devices apply the following risk mitigation strategies:

- CVE-2018-0228 — The ASA and FTD configuration commands—set connection per-client-embryonic-max (TCP) and set
connection per-client-max (TCP, UDP, and Stream Control Transmission Protocol [SCTP])—can be configured to limit the
number of connection requests allowed. Using these configuration parameters can reduce the number of connections and
greatly reduce the impact of the DoS attack.
- CVE-2018-0227 — No workarounds available
- CVE-2018-0231 — No workarounds available
- CVE-2018-0240 — No workarounds available
- CVE-2018-0296 — Cisco has released Snort Rule 46897

For additional information please see the Rockwell Automation security notification at (login required):
https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1073860

Additionally the Cisco advisories can be found at the following links:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa2

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa1

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa3

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa_inspect

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-0231");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20, 787);

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/04/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/04/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/05");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.8%281%29");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:98.1%281.154%29");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:adaptive_security_appliance_software:9.8%281%29" :
        {"versionEndIncluding" : "9.8%281%29", "versionStartIncluding" : "9.8%281%29", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:98.1%281.154%29" :
        {"versionEndIncluding" : "98.1%281.154%29", "versionStartIncluding" : "98.1%281.154%29", "family" : "CiscoFirepower"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);