Cisco IOS Software Point-to-Point Tunneling Protocol Server Information Disclosure Vulnerability (cisco-sa-20160902-ios)

# SPDX-FileCopyrightText: 2016 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/o:cisco:ios";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.106222");
  script_version("2026-02-02T05:59:28+0000");
  script_tag(name:"last_modification", value:"2026-02-02 05:59:28 +0000 (Mon, 02 Feb 2026)");
  script_tag(name:"creation_date", value:"2016-09-05 09:36:53 +0700 (Mon, 05 Sep 2016)");
  script_tag(name:"cvss_base", value:"5.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2016-11-28 20:32:00 +0000 (Mon, 28 Nov 2016)");

  script_cve_id("CVE-2016-6398");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"Workaround");

  script_name("Cisco IOS Software Point-to-Point Tunneling Protocol Server Information Disclosure Vulnerability (cisco-sa-20160902-ios)");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2016 Greenbone AG");
  script_family("CISCO");
  script_dependencies("gb_cisco_ios_consolidation.nasl");
  script_mandatory_keys("cisco/ios/detected");

  script_tag(name:"summary", value:"A vulnerability in the implementation of Point-to-Point
  Tunneling Protocol (PPTP) server functionality in Cisco IOS Software could allow an
  unauthenticated, remote attacker to access data from a packet buffer that was previously used.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"The vulnerability is due to the use of a previously used packet
  buffer whose content was not cleared from memory. An attacker could exploit this vulnerability by
  sending a PPTP connection request to device that is running a vulnerable release of the affected
  software and is configured for PPTP server functionality.");

  script_tag(name:"impact", value:"A successful exploit could allow the attacker to access up to 63
  bytes of memory that were previously used for a packet and were either destined to the device or
  generated by the device. An exploit would not allow the attacker to access packet data from
  transit traffic. In addition, an exploit would not allow the attacker to access arbitrary memory
  locations that the attacker chooses.");

  script_tag(name:"solution", value:"See the referenced vendor advisory for a workaround.");

  script_xref(name:"URL", value:"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160902-ios");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if( ! version = get_app_version( cpe:CPE, nofork:TRUE ) )
  exit( 0 );

affected = make_list(
  "15.5(3)M" );

foreach af ( affected ) {
  if( version == af ) {
    report = report_fixed_ver( installed_version:version, fixed_version:"See advisory" );
    security_message( port:0, data:report );
    exit( 0 );
  }
}

exit( 99 );