Cisco ASA VPN XML Parser DoS Vulnerability (cisco-sa-20150408-asa)

# Copyright (C) 2015 Greenbone Networks GmbH
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-or-later
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

CPE = "cpe:/a:cisco:asa";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.106000");
  script_version("2022-02-09T09:27:46+0000");
  script_tag(name:"last_modification", value:"2022-02-09 09:27:46 +0000 (Wed, 09 Feb 2022)");
  script_tag(name:"creation_date", value:"2015-05-29 15:12:10 +0700 (Fri, 29 May 2015)");
  script_tag(name:"cvss_base", value:"7.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:N/A:C");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_cve_id("CVE-2015-0677");

  script_name("Cisco ASA VPN XML Parser DoS Vulnerability (cisco-sa-20150408-asa)");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2015 Greenbone Networks GmbH");
  script_family("CISCO");
  script_dependencies("gb_cisco_asa_version.nasl", "gb_cisco_asa_version_snmp.nasl");
  script_mandatory_keys("cisco_asa/version");

  script_tag(name:"summary", value:"Cisco ASA is prone to a DoS vulnerability in the VPN XML Parser.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"The vulnerability is due to insufficient hardening of the XML
  parser configuration. An attacker could exploit this vulnerability by sending a crafted XML
  message to the affected system. This vulnerability affects Cisco ASA appliances configured for
  Clientless or AnyConnect SSL VPN and AnyConnect IKEv2 VPN. All other VPN configurations are
  unaffected by this vulnerability. An unauthenticated, remote attacker could exploit this
  vulnerability by sending a crafted XML message to a targeted system.");

  script_tag(name:"impact", value:"A successful exploit could cause the WebVPN component on the
  system to crash, resulting in a DoS condition.");

  script_tag(name:"affected", value:"Cisco ASA version 8.4, 8.6, 9.0, 9.1, 9.2 and 9.3.");

  script_tag(name:"solution", value:"See the referenced vendor advisory for a solution.");

  script_xref(name:"URL", value:"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150408-asa");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (!version = get_app_version(cpe: CPE, nofork: TRUE))
  exit(0);

if (version_in_range_exclusive(version: version, test_version_lo: "8.4", test_version_up: "8.4.7.28")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "8.4(7.28)");
  security_message(port: 0, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "8.6", test_version_up: "8.6.1.17")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "8.6(1.17)");
  security_message(port: 0, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "9.0", test_version_up: "9.0.4.33")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "9.0(4.33)");
  security_message(port: 0, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "9.1", test_version_up: "9.1.6")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "9.1(6)");
  security_message(port: 0, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "9.2", test_version_up: "9.2.3.4")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "9.2(3.4)");
  security_message(port: 0, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "9.3", test_version_up: "9.3.3")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "9.3(3)");
  security_message(port: 0, data: report);
  exit(0);
}

exit(99);