Rockwell Automation Stratix IPv6 Neighbor Discovery Crafted Packet Denial of Service (CVE-2016-1409)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501830);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/01/17");

  script_cve_id("CVE-2016-1409");

  script_name(english:"Rockwell Automation Stratix IPv6 Neighbor Discovery Crafted Packet Denial of Service (CVE-2016-1409)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the IP Version 6 (IPv6) packet processing functions 
of multiple Cisco products could allow an unauthenticated, remote attacker 
to cause an affected device to stop processing IPv6 traffic, 
leading to a denial of service (DoS) condition on the device. 
The vulnerability is due to insufficient processing logic for crafted IPv6 
packets that are sent to an affected device. An attacker could exploit this 
vulnerability by sending crafted IPv6 Neighbor Discovery (ND) packets to an 
affected device for processing. A successful exploit could allow the attacker 
to cause the device to stop processing IPv6 traffic, 
leading to a DoS condition on the device. 

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160525-ipv6
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?647b7be7");
  # https://www.rockwellautomation.com/en-us/support/advisory.PN965.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?141f2981");
  # https://www.cisa.gov/news-events/ics-advisories/icsa-17-094-04
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c7bf8ef2");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Rockwell Automation has provided a new firmware version, Version 15.6.3, to mitigate these vulnerabilities.

Rockwell Automation encourages users of the affected versions to update to the latest available software versions
addressing the associated risk, and including improvements to further harden the software and enhance its resilience
against similar malicious attacks. Users can find the latest firmware version by searching for their device at the
following web site:

http://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?famID=15

Additional precautions and risk mitigation strategies specific to these types of attacks are recommended in the Rockwell
Automation security release. When possible, multiple strategies should be implemented simultaneously.

https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1041191

Please also refer to Cisco's security advisories (linked below) for additional workarounds and details for these
vulnerabilities.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-1409");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(755);

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/05/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/05/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/11/15");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:allen-bradley_stratix_5900_industrial_managed_ethernet_switch");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Rockwell");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Rockwell');

var asset = tenable_ot::assets::get(vendor:'Rockwell');

var vuln_cpes = {
    "cpe:/h:rockwellautomation:allen-bradley_stratix_5900_industrial_managed_ethernet_switch" :
        {"versionEndExcluding" : "15.6.3", "family" : "Stratix"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);