Cisco NX-OS Software Internet Group Management Protocol Snooping Remote Code Execution and Denial of Service (CVE-2018-0292)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501327);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/07/26");

  script_cve_id("CVE-2018-0292");

  script_name(english:"Cisco NX-OS Software Internet Group Management Protocol Snooping Remote Code Execution and Denial of Service (CVE-2018-0292)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the Internet Group Management Protocol (IGMP)
Snooping feature of Cisco NX-OS Software could allow an
unauthenticated, adjacent attacker to execute arbitrary code and gain
full control of an affected system. The attacker could also cause an
affected system to reload, resulting in a denial of service (DoS)
condition. The vulnerability is due to a buffer overflow condition in
the IGMP Snooping subsystem. An attacker could exploit this
vulnerability by sending crafted IGMP packets to an affected system.
An exploit could allow the attacker to execute arbitrary code and gain
full control of the affected system or cause the affected system to
reload, resulting in a DoS condition. This vulnerability affects Nexus
2000 Series Switches, Nexus 3000 Series Switches, Nexus 3500 Platform
Switches, Nexus 3600 Platform Switches, Nexus 5500 Platform Switches,
Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000
Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Fabric
Switches in Application Centric Infrastructure (ACI) mode, Nexus 9000
Series Switches in standalone NX-OS mode. Cisco Bug IDs: CSCuv79620,
CSCvg71263.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"http://www.securitytracker.com/id/1041169");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-nxosigmp
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c23231bb");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-0292");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(119);

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/06/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/06/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/07/25");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:13");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:8");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:nx-os:7.3%283%29n1%281%29" :
        {"versionEndExcluding" : "7.3%283%29n1%281%29", "versionStartIncluding" : "6.0", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:8.1%282%29" :
        {"versionEndExcluding" : "8.1%282%29", "versionStartIncluding" : "6.2", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:13.1%281i%29" :
        {"versionEndExcluding" : "13.1%281i%29", "versionStartIncluding" : "12.1", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:7.0%283%29i7%281%29" :
        {"versionEndExcluding" : "7.0%283%29i7%281%29", "versionStartIncluding" : "7.0%283%29i5", "family" : "NXOS"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);