Qnap QTS Out-of-bounds Write (CVE-2021-28816)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502607);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/10/17");

  script_cve_id("CVE-2021-28816");

  script_name(english:"Qnap QTS Out-of-bounds Write (CVE-2021-28816)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A stack buffer overflow vulnerability has been reported to affect QNAP
device running QTS, QuTScloud, QuTS hero. If exploited, this
vulnerability allows attackers to execute arbitrary code. We have
already fixed this vulnerability in the following versions of QTS,
QuTScloud, QuTS hero: QTS 4.5.4.1715 build 20210630 and later QTS
5.0.0.1716 build 20210701 and later QTS 4.3.3.1693 build 20210624 and
later QTS 4.3.6.1750 build 20210730 and later QuTScloud c4.5.6.1755
and later QuTS hero h4.5.4.1771 build 20210825 and later

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://www.qnap.com/en/security-advisory/qsa-21-33");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-28816");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(787);

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/09/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2021/09/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/10/16");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:5.0.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:4.5.4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:4.3.6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:4.3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h4.5.4");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Qnap");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Qnap');

var asset = tenable_ot::assets::get(vendor:'Qnap');

var vuln_cpes = {
    "cpe:/o:qnap:qts:5.0.0" :
        {"versionStartIncluding" : "5.0.0", "versionEndExcluding" : "5.0.0.1716", "family" : "QTS"},
    "cpe:/o:qnap:qts:4.5.4" :
        {"versionStartIncluding" : "4.5.4", "versionEndExcluding" : "4.5.4.1715", "family" : "QTS"},
    "cpe:/o:qnap:qts:4.3.6" :
        {"versionStartIncluding" : "4.3.6", "versionEndExcluding" : "4.3.6.1750", "family" : "QTS"},
    "cpe:/o:qnap:qts:4.3.3" :
        {"versionStartIncluding" : "4.3.3", "versionEndExcluding" : "4.3.3.1693", "family" : "QTS"},
    "cpe:/o:qnap:quts_hero:h4.5.4" :
        {"versionStartIncluding" : "h4.5.4", "versionEndExcluding" : "h4.5.4.1771", "family" : "QuTShero"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);