Cisco NX-OS Software Authenticated Simple Network Management Protocol Denial of Service (CVE-2018-0291)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501408);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/07/26");

  script_cve_id("CVE-2018-0291");

  script_name(english:"Cisco NX-OS Software Authenticated Simple Network Management Protocol Denial of Service (CVE-2018-0291)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the Simple Network Management Protocol (SNMP) input
packet processor of Cisco NX-OS Software could allow an authenticated,
remote attacker to cause the SNMP application on an affected device to
restart unexpectedly. The vulnerability is due to improper validation
of SNMP protocol data units (PDUs) in SNMP packets. An attacker could
exploit this vulnerability by sending a crafted SNMP packet to an
affected device. A successful exploit could allow the attacker to
cause the SNMP application to restart multiple times, leading to a
system-level restart and a denial of service (DoS) condition. This
vulnerability affects Nexus 2000 Series Switches, Nexus 3000 Series
Switches, Nexus 3500 Platform Switches, Nexus 3600 Platform Switches,
Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000
Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series
Switches, Nexus 9000 Series Switches in standalone NX-OS mode, Nexus
9500 R-Series Line Cards and Fabric Modules, UCS 6100 Series Fabric
Interconnects, UCS 6200 Series Fabric Interconnects, UCS 6300 Series
Fabric Interconnects. Cisco Bug IDs: CSCuw99630, CSCvg71290,
CSCvj67977.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"http://www.securitytracker.com/id/1041169");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-nxossnmp
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?20dbad53");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-0291");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(20);

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/06/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/06/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/07/25");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:7.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:8");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:nx-os:7.3%283%29n1%281%29" :
        {"versionEndExcluding" : "7.3%283%29n1%281%29", "versionStartIncluding" : "6.0", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:8.1%282%29" :
        {"versionEndExcluding" : "8.1%282%29", "versionStartIncluding" : "6.2", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:7.0%283%29i3" :
        {"versionEndExcluding" : "7.0%283%29i3", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:7.0%283%29i7%281%29" :
        {"versionEndExcluding" : "7.0%283%29i7%281%29", "versionStartIncluding" : "7.0%283%29i4", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:7.0" :
        {"versionEndIncluding" : "7.0", "versionStartIncluding" : "7.0", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:2.2" :
        {"versionEndExcluding" : "2.2", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:3.2%282b%29" :
        {"versionEndExcluding" : "3.2%282b%29", "versionStartIncluding" : "2.5", "family" : "NXOS"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);