Rockwell Automation Allen-Bradley Stratix 5950 Resource Management Errors (CVE-2018-0240)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(506189);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/06");

  script_cve_id("CVE-2018-0240");

  script_name(english:"Rockwell Automation Allen-Bradley Stratix 5950 Resource Management Errors (CVE-2018-0240)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Multiple vulnerabilities in the Application Layer Protocol Inspection
feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco
Firepower Threat Defense (FTD) Software could allow an
unauthenticated, remote attacker to trigger a reload of an affected
device, resulting in a denial of service (DoS) condition. The
vulnerabilities are due to logical errors during traffic inspection.
An attacker could exploit these vulnerabilities by sending a high
volume of malicious traffic across an affected device. An exploit
could allow the attacker to cause a deadlock condition, resulting in a
reload of an affected device. These vulnerabilities affect Cisco ASA
Software and Cisco FTD Software configured for Application Layer
Protocol Inspection running on the following Cisco products: 3000
Series Industrial Security Appliance (ISA), ASA 5500 Series Adaptive
Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA
Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600
Series Routers, Adaptive Security Virtual Appliance (ASAv), Firepower
2100 Series Security Appliance, Firepower 4100 Series Security
Appliance, Firepower 9300 ASA Security Module, FTD Virtual (FTDv).
Cisco Bug IDs: CSCve61540, CSCvh23085, CSCvh95456.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa_inspect
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?dcd24031");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/103934");
  script_set_attribute(attribute:"see_also", value:"https://ics-cert.us-cert.gov/advisories/ICSA-18-184-01");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Rockwell Automation will inform users of updated firmware as soon as it is available. Rockwell Automation recommends
that users using affected devices apply the following risk mitigation strategies:

- CVE-2018-0228 — The ASA and FTD configuration commands—set connection per-client-embryonic-max (TCP) and set
connection per-client-max (TCP, UDP, and Stream Control Transmission Protocol [SCTP])—can be configured to limit the
number of connection requests allowed. Using these configuration parameters can reduce the number of connections and
greatly reduce the impact of the DoS attack.
- CVE-2018-0227 — No workarounds available
- CVE-2018-0231 — No workarounds available
- CVE-2018-0240 — No workarounds available
- CVE-2018-0296 — Cisco has released Snort Rule 46897

For additional information please see the Rockwell Automation security notification at (login required):
https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1073860

Additionally the Cisco advisories can be found at the following links:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa2

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa1

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa3

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa_inspect

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-0240");
  script_cwe_id(399);

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/04/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/04/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/06");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:adaptive_security_appliance_software:9.6.0.0" :
        {"versionEndExcluding" : "9.6.4.6", "versionStartIncluding" : "9.6.0.0", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.7.0.0" :
        {"versionEndExcluding" : "9.7.1.24", "versionStartIncluding" : "9.7.0.0", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.8.0.0" :
        {"versionEndExcluding" : "9.8.2.24", "versionStartIncluding" : "9.8.0.0", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.9.0.0" :
        {"versionEndExcluding" : "9.9.1.4", "versionStartIncluding" : "9.9.0.0", "family" : "CiscoFirepower"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);