Cisco ASA Uncontrolled Resource Consumption (CVE-2018-15399)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(506049);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/06");

  script_cve_id("CVE-2018-15399");

  script_name(english:"Cisco ASA Uncontrolled Resource Consumption (CVE-2018-15399)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the TCP syslog module of Cisco Adaptive Security
Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD)
Software could allow an unauthenticated, remote attacker to exhaust
the 1550-byte buffers on an affected device, resulting in a denial of
service (DoS) condition. The vulnerability is due to a missing
boundary check in an internal function. An attacker could exploit this
vulnerability by establishing a man-in-the-middle position between an
affected device and its configured TCP syslog server and then
maliciously modifying the TCP header in segments that are sent from
the syslog server to the affected device. A successful exploit could
allow the attacker to exhaust buffer on the affected device and cause
all TCP-based features to stop functioning, resulting in a DoS
condition. The affected TCP-based features include AnyConnect SSL VPN,
clientless SSL VPN, and management connections such as Secure Shell
(SSH), Telnet, and HTTPS.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-asa-syslog-dos
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6fd359b3");
  script_set_attribute(attribute:"see_also", value:"http://www.securitytracker.com/id/1041785");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-15399");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(400, 770);

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/10/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/10/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/05");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.4%284%29");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.8%282%29");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:adaptive_security_appliance_software:9.4%284%29" :
        {"versionEndIncluding" : "9.4%284%29", "versionStartIncluding" : "9.4%284%29", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.8%282%29" :
        {"versionEndIncluding" : "9.8%282%29", "versionStartIncluding" : "9.8%282%29", "family" : "CiscoFirepower"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);