Cisco IP Phones 8800 Series File Upload Denial of Service (CVE-2019-1766)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502113);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/18");

  script_cve_id("CVE-2019-1766");

  script_name(english:"Cisco IP Phones 8800 Series File Upload Denial of Service (CVE-2019-1766)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the web-based management interface of Session
Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series
could allow an unauthenticated, remote attacker to cause high disk
utilization, resulting in a denial of service (DoS) condition. The
vulnerability exists because the affected software does not restrict
the maximum size of certain files that can be written to disk. An
attacker who has valid administrator credentials for an affected
system could exploit this vulnerability by sending a crafted, remote
connection request to an affected system. A successful exploit could
allow the attacker to write a file that consumes most of the available
disk space on the system, causing application functions to operate
abnormally and leading to a DoS condition. This vulnerability affects
Cisco IP Phone 8800 Series products running a SIP Software release
prior to 12.5(1)SR1.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190320-ipfudos
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f98d382f");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-1766");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20);

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/03/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/03/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/03/18");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ip_phone_8821_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ip_phone_8821-ex_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ip_phone_8831_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ip_phone_8832_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ip_phone_8800_series_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:ip_phone_8821_firmware" :
        {"versionEndExcluding" : "0", "family" : "CiscoIPPhones"}, # Excluding
    "cpe:/o:cisco:ip_phone_8821-ex_firmware" :
        {"versionEndExcluding" : "0", "family" : "CiscoIPPhones"}, # Excluding
    "cpe:/o:cisco:ip_phone_8831_firmware" :
        {"versionEndExcluding" : "0", "family" : "CiscoIPPhones"}, # Excluding
    "cpe:/o:cisco:ip_phone_8832_firmware" :
        {"versionEndExcluding" : "0", "family" : "CiscoIPPhones"}, # Excluding
    "cpe:/o:cisco:ip_phone_8800_series_firmware" :
        {"versionEndExcluding" : "12.5(1)sr1", "family" : "CiscoIPPhones"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);