Cisco Catalyst Switches Network Mobility Services Protocol Port Information Disclosure Vulnerability (cisco-sa-20160413-nms)

# SPDX-FileCopyrightText: 2016 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/o:cisco:ios";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.106210");
  script_version("2026-03-18T05:59:10+0000");
  script_tag(name:"last_modification", value:"2026-03-18 05:59:10 +0000 (Wed, 18 Mar 2026)");
  script_tag(name:"creation_date", value:"2016-08-26 13:05:32 +0700 (Fri, 26 Aug 2016)");
  script_tag(name:"cvss_base", value:"5.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2016-12-03 03:20:00 +0000 (Sat, 03 Dec 2016)");

  script_cve_id("CVE-2016-1378");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Cisco Catalyst Switches Network Mobility Services Protocol Port Information Disclosure Vulnerability (cisco-sa-20160413-nms)");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2016 Greenbone AG");
  script_family("CISCO");
  script_dependencies("gb_cisco_ios_consolidation.nasl");
  script_mandatory_keys("cisco/ios/detected", "cisco/ios/model");

  script_tag(name:"summary", value:"Cisco Catalyst Switches running Cisco IOS Software releases may
  allow an unauthenticated, remote attacker to retrieve version information about the software
  release running on the device by accessing the Network Mobility Services Protocol (NMSP) port.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"The vulnerability is due to a failure to properly secure NMSP
  with authentication, which has been made standard in Cisco IOS Software releases 15.2(2)E1 and
  later.");

  script_tag(name:"impact", value:"An attacker could exploit earlier software releases to map the
  network and gather information for further attacks.");

  script_tag(name:"solution", value:"See the referenced vendor advisory for a solution.");

  script_xref(name:"URL", value:"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160413-nms");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if( ! model = get_kb_item( "cisco/ios/model" ) )
  exit( 0 );

if( model !~ "^WS-C[0-9]" || model =~ "WS-C60" )
  exit( 0 );

if( ! version = get_app_version( cpe:CPE, nofork:TRUE ) )
  exit( 0 );

affected = make_list(
  "15.1(1)SG",
  "15.1(1)SG1",
  "15.1(1)SG2",
  "15.1(2)SG",
  "15.1(2)SG1",
  "15.1(2)SG2",
  "15.1(2)SG3",
  "15.1(2)SG4",
  "15.1(2)SG5",
  "15.1(2)SG6",
  "15.1(2)SG7",
  "15.1(1)SY",
  "15.1(1)SY1",
  "15.1(1)SY2",
  "15.1(1)SY3",
  "15.1(1)SY4",
  "15.1(1)SY5",
  "15.1(1)SY6",
  "15.1(2)SY",
  "15.1(2)SY1",
  "15.1(2)SY2",
  "15.1(2)SY3",
  "15.1(2)SY4",
  "15.1(2)SY4a",
  "15.1(2)SY5",
  "15.1(2)SY6",
  "15.1(2)SY7",
  "15.1(2)SY8" );

foreach af ( affected ) {
  if( version == af ) {
    report = report_fixed_ver( installed_version:version, fixed_version:"See advisory" );
    security_message( port:0, data:report );
    exit( 0 );
  }
}

exit( 99 );