Cisco IP Phones 7800 and 8800 Series Cisco Discovery Protocol and Link Layer Discovery Protocol Denial of Service (CVE-2019-1684)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502124);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/18");

  script_cve_id("CVE-2019-1684");

  script_name(english:"Cisco IP Phones 7800 and 8800 Series Cisco Discovery Protocol and Link Layer Discovery Protocol Denial of Service (CVE-2019-1684)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the Cisco Discovery Protocol or Link Layer
Discovery Protocol (LLDP) implementation for the Cisco IP Phone 7800
and 8800 Series could allow an unauthenticated, adjacent attacker to
cause an affected phone to reload unexpectedly, resulting in a
temporary denial of service (DoS) condition. The vulnerability is due
to missing length validation of certain Cisco Discovery Protocol or
LLDP packet header fields. An attacker could exploit this
vulnerability by sending a malicious Cisco Discovery Protocol or LLDP
packet to the targeted phone. A successful exploit could allow the
attacker to cause the affected phone to reload unexpectedly, resulting
in a temporary DoS condition. Versions prior to 12.6(1)MN80 are
affected.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/107104");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-cdp-lldp-dos
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5f756843");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-1684");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(119);

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/02/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/02/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/03/18");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ip_phone_7800_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ip_phone_7811_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ip_phone_7821_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ip_phone_7841_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ip_phone_7861_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ip_phone_8800_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ip_phone_8811_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ip_phone_8841_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ip_phone_8845_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ip_phone_8851_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ip_phone_8861_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ip_phone_8865_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:ip_phone_8800_firmware" :
        {"versionEndExcluding" : "12.6(1)mn80", "family" : "CiscoIPPhones"},
    "cpe:/o:cisco:ip_phone_7800_firmware" :
        {"versionEndExcluding" : "12.6(1)mn80", "family" : "CiscoIPPhones"},
    "cpe:/o:cisco:ip_phone_7811_firmware" :
        {"versionEndExcluding" : "12.6(1)mn80", "family" : "CiscoIPPhones"},
    "cpe:/o:cisco:ip_phone_7821_firmware" :
        {"versionEndExcluding" : "12.6(1)mn80", "family" : "CiscoIPPhones"},
    "cpe:/o:cisco:ip_phone_7841_firmware" :
        {"versionEndExcluding" : "12.6(1)mn80", "family" : "CiscoIPPhones"},
    "cpe:/o:cisco:ip_phone_7861_firmware" :
        {"versionEndExcluding" : "12.6(1)mn80", "family" : "CiscoIPPhones"},
    "cpe:/o:cisco:ip_phone_8811_firmware" :
        {"versionEndExcluding" : "12.6(1)mn80", "family" : "CiscoIPPhones"},
    "cpe:/o:cisco:ip_phone_8841_firmware" :
        {"versionEndExcluding" : "12.6(1)mn80", "family" : "CiscoIPPhones"},
    "cpe:/o:cisco:ip_phone_8845_firmware" :
        {"versionEndExcluding" : "12.6(1)mn80", "family" : "CiscoIPPhones"},
    "cpe:/o:cisco:ip_phone_8851_firmware" :
        {"versionEndExcluding" : "12.6(1)mn80", "family" : "CiscoIPPhones"},
    "cpe:/o:cisco:ip_phone_8861_firmware" :
        {"versionEndExcluding" : "12.6(1)mn80", "family" : "CiscoIPPhones"},
    "cpe:/o:cisco:ip_phone_8865_firmware" :
        {"versionEndExcluding" : "12.6(1)mn80", "family" : "CiscoIPPhones"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);