Cisco IOS Software Multicast Routing Denial of Service Vulnerabilities

# SPDX-FileCopyrightText: 2016 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/o:cisco:ios";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.106311");
  script_cve_id("CVE-2016-6392", "CVE-2016-6382");
  script_tag(name:"cvss_base", value:"7.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_version("2023-07-20T05:05:17+0000");

  script_name("Cisco IOS Software Multicast Routing Denial of Service Vulnerabilities");

  script_xref(name:"URL", value:"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-msdp");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"solution", value:"See the referenced vendor advisory for a solution.");

  script_tag(name:"summary", value:"Multiple vulnerabilities in the multicast subsystem of Cisco IOS Software
could allow an unauthenticated, remote attacker to create a denial of service (DoS) condition. The issues
are in IPv4 Multicast Source Discovery Protocol (MSDP) and IPv6 Protocol Independent Multicast (PIM).");

  script_tag(name:"insight", value:"The first vulnerability (Cisco bug ID CSCud36767) is due to insufficient
checking of MSDP Source-Active (SA) messages received from a configured MSDP peer. An attacker who can send
traffic to the IPv4 address of a device could exploit this vulnerability by sending a packet designed to
trigger the issue to the affected device.

The second vulnerability (Cisco bug ID CSCuy16399) is due to insufficient checking of packets encapsulated
in a PIM register message. An attacker who can send a malformed IPv6 PIM register packet to a PIM rendezvous
point (RP) could exploit the vulnerability.");

  script_tag(name:"impact", value:"A successful exploit could cause the affected device to restart.");

  script_tag(name:"qod_type", value:"package");
  script_tag(name:"solution_type", value:"VendorFix");

  script_tag(name:"last_modification", value:"2023-07-20 05:05:17 +0000 (Thu, 20 Jul 2023)");
  script_tag(name:"severity_vector", value:"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2017-11-08 12:57:00 +0000 (Wed, 08 Nov 2017)");
  script_tag(name:"creation_date", value:"2016-09-29 15:26:42 +0700 (Thu, 29 Sep 2016)");
  script_category(ACT_GATHER_INFO);
  script_family("CISCO");
  script_copyright("Copyright (C) 2016 Greenbone AG");
  script_dependencies("gb_ssh_cisco_ios_get_version.nasl");
  script_mandatory_keys("cisco_ios/version");
  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if( ! version = get_app_version( cpe:CPE ) ) exit( 0 );

affected = make_list(
  '12.2(33)CX',
  '12.2(33)CY',
  '12.2(33)CY1',
  '12.2(58)EX',
  '12.2(58)EY',
  '12.2(58)EY1',
  '12.2(58)EY2',
  '12.2(58)EZ',
  '12.2(60)EZ',
  '12.2(60)EZ1',
  '12.2(60)EZ2',
  '12.2(60)EZ3',
  '12.2(60)EZ4',
  '12.2(60)EZ5',
  '12.2(60)EZ6',
  '12.2(60)EZ7',
  '12.2(60)EZ8',
  '12.2(60)EZ9',
  '12.2(33)IRA',
  '12.2(33)IRB',
  '12.2(33)IRC',
  '12.2(33)IRD',
  '12.2(33)IRE',
  '12.2(33)IRE1',
  '12.2(33)IRE2',
  '12.2(33)IRF',
  '12.2(33)IRG',
  '12.2(33)IRG1',
  '12.2(33)IRH',
  '12.2(33)IRH1',
  '12.2(33)IRI',
  '12.2(33)MRA',
  '12.2(33)MRB',
  '12.2(33)MRB1',
  '12.2(33)MRB2',
  '12.2(33)MRB3',
  '12.2(33)MRB4',
  '12.2(33)MRB5',
  '12.2(33)MRB6',
  '12.2(33)SB',
  '12.2(33)SB1',
  '12.2(33)SB10',
  '12.2(33)SB11',
  '12.2(33)SB12',
  '12.2(33)SB13',
  '12.2(33)SB14',
  '12.2(33)SB15',
  '12.2(33)SB16',
  '12.2(33)SB17',
  '12.2(33)SB2',
  '12.2(33)SB3',
  '12.2(33)SB4',
  '12.2(33)SB5',
  '12.2(33)SB6',
  '12.2(33)SB7',
  '12.2(33)SB8',
  '12.2(33)SB9',
  '12.2(33)SCA',
  '12.2(33)SCA1',
  '12.2(33)SCA2',
  '12.2(33)SCB',
  '12.2(33)SCB1',
  '12.2(33)SCB10',
  '12.2(33)SCB11',
  '12.2(33)SCB2',
  '12.2(33)SCB3',
  '12.2(33)SCB4',
  '12.2(33)SCB5',
  '12.2(33)SCB6',
  '12.2(33)SCB7',
  '12.2(33)SCB8',
  '12.2(33)SCB9',
  '12.2(33)SCC',
  '12.2(33)SCC1',
  '12.2(33)SCC2',
  '12.2(33)SCC3',
  '12.2(33)SCC4',
  '12.2(33)SCC5',
  '12.2(33)SCC6',
  '12.2(33)SCC7',
  '12.2(33)SCD',
  '12.2(33)SCD1',
  '12.2(33)SCD2',
  '12.2(33)SCD3',
  '12.2(33)SCD4',
  '12.2(33)SCD5',
  '12.2(33)SCD6',
  '12.2(33)SCD7',
  '12.2(33)SCD8',
  '12.2(33)SCE',
  '12.2(33)SCE1',
  '12.2(33)SCE2',
  '12.2(33)SCE3',
  '12.2(33)SCE4',
  '12.2(33)SCE5',
  '12.2(33)SCE6',
  '12.2(33)SCF',
  '12.2(33)SCF1',
  '12.2(33)SCF2',
  '12.2(33)SCF3',
  '12.2(33)SCF4',
  '12.2(33)SCF5',
  '12.2(33)SCG',
  '12.2(33)SCG1',
  '12.2(33)SCG2',
  '12.2(33)SCG3',
  '12.2(33)SCG4',
  '12.2(33)SCG5',
  '12.2(33)SCG6',
  '12.2(33)SCG7',
  '12.2(33)SCH',
  '12.2(33)SCH0a',
  '12.2(33)SCH1',
  '12.2(33)SCH2',
  '12.2(33)SCH2a',
  '12.2(33)SCH3',
  '12.2(33)SCH4',
  '12.2(33)SCH5',
  '12.2(33)SCH6',
  '12.2(33)SCI',
  '12.2(33)SCI1',
  '12.2(33)SCI1a',
  '12.2(33)SCI2',
  '12.2(33)SCI2a',
  '12.2(33)SCI3',
  '12.2(33)SCJ',
  '12.2(58)SE',
  '12.2(58)SE1',
  '12.2(58)SE2',
  '12.2(33)SRB',
  '12.2(33)SRB1',
  '12.2(33)SRB2',
  '12.2(33)SRB3',
  '12.2(33)SRB4',
  '12.2(33)SRB5',
  '12.2(33)SRB5a',
  '12.2(33)SRB6',
  '12.2(33)SRB7',
  '12.2(33)SRC',
  '12.2(33)SRC1',
  '12.2(33)SRC2',
  '12.2(33)SRC3',
  '12.2(33)SRC4',
  '12.2(33)SRC5',
  '12.2(33)SRC6',
  '12.2(33)SRD',
  '12.2(33)SRD1',
  '12.2(33)SRD2',
  '12.2(33)SRD2a',
  '12.2(33)SRD3',
  '12.2(33)SRD4',
  '12.2(33)SRD5',
  '12.2(33)SRD6',
  '12.2(33)SRD7',
  '12.2(33)SRD8',
  '12.2(33)SRE',
  '12.2(33)SRE0a',
  '12.2(33)SRE1',
  '12.2(33)SRE10',
  '12.2(33)SRE11',
  '12.2(33)SRE12',
  '12.2(33)SRE13',
  '12.2(33)SRE14',
  '12.2(33)SRE2',
  '12.2(33)SRE3',
  '12.2(33)SRE4',
  '12.2(33)SRE5',
  '12.2(33)SRE6',
  '12.2(33)SRE7',
  '12.2(33)SRE7a',
  '12.2(33)SRE8',
  '12.2(33)SRE9',
  '12.2(33)SRE9a',
  '12.2(33)XN1',
  '15.0(2)ED',
  '15.0(2)ED1',
  '15.0(2)EH',
  '15.0(2)EJ',
  '15.0(2)EJ1',
  '15.0(2)EK',
  '15.0(2)EK1',
  '15.0(1)EX',
  '15.0(2)EX',
  '15.0(2)EX1',
  '15.0(2)EX3',
  '15.0(2)EX4',
  '15.0(2)EX5',
  '15.0(2a)EX5',
  '15.0(2)EY',
  '15.0(2)EY1',
  '15.0(2)EY2',
  '15.0(2)EY3',
  '15.0(2)EZ',
  '15.0(1)M',
  '15.0(1)M1',
  '15.0(1)M10',
  '15.0(1)M2',
  '15.0(1)M3',
  '15.0(1)M4',
  '15.0(1)M5',
  '15.0(1)M6',
  '15.0(1)M7',
  '15.0(1)M8',
  '15.0(1)M9',
  '15.0(1)MR',
  '15.0(2)MR',
  '15.0(1)S',
  '15.0(1)S1',
  '15.0(1)S2',
  '15.0(1)S3a',
  '15.0(1)S4',
  '15.0(1)S4a',
  '15.0(1)S5',
  '15.0(1)S6',
  '15.0(1)SE',
  '15.0(1)SE1',
  '15.0(1)SE2',
  '15.0(1)SE3',
  '15.0(2)SE',
  '15.0(2)SE1',
  '15.0(2)SE2',
  '15.0(2)SE3',
  '15.0(2)SE4',
  '15.0(2)SE5',
  '15.0(2)SE6',
  '15.0(2)SE7',
  '15.0(2)SE9',
  '15.0(1)SY',
  '15.0(1)SY1',
  '15.0(1)SY10',
  '15.0(1)SY2',
  '15.0(1)SY3',
  '15.0(1)SY4',
  '15.0(1)SY5',
  '15.0(1)SY6',
  '15.0(1)SY7',
  '15.0(1)SY7a',
  '15.0(1)SY8',
  '15.0(1)SY9',
  '15.0(1)XA',
  '15.0(1)XA1',
  '15.0(1)XA2',
  '15.0(1)XA3',
  '15.0(1)XA4',
  '15.0(1)XA5',
  '15.1(2)EY',
  '15.1(2)EY1a',
  '15.1(2)EY2',
  '15.1(2)EY2a',
  '15.1(2)EY3',
  '15.1(2)EY4',
  '15.1(2)GC',
  '15.1(2)GC1',
  '15.1(2)GC2',
  '15.1(4)GC',
  '15.1(4)GC1',
  '15.1(4)GC2',
  '15.1(4)M',
  '15.1(4)M1',
  '15.1(4)M10',
  '15.1(4)M2',
  '15.1(4)M3',
  '15.1(4)M3a',
  '15.1(4)M4',
  '15.1(4)M5',
  '15.1(4)M6',
  '15.1(4)M7',
  '15.1(4)M8',
  '15.1(4)M9',
  '15.1(1)MR',
  '15.1(1)MR1',
  '15.1(1)MR2',
  '15.1(1)MR3',
  '15.1(1)MR4',
  '15.1(3)MR',
  '15.1(3)MRA',
  '15.1(3)MRA1',
  '15.1(3)MRA2',
  '15.1(1)S',
  '15.1(1)S1',
  '15.1(1)S2',
  '15.1(2)S',
  '15.1(2)S1',
  '15.1(2)S2',
  '15.1(3)S',
  '15.1(3)S0a',
  '15.1(3)S1',
  '15.1(3)S2',
  '15.1(3)S3',
  '15.1(3)S4',
  '15.1(3)S5',
  '15.1(3)S5a',
  '15.1(3)S6',
  '15.1(1)SG',
  '15.1(1)SG1',
  '15.1(1)SG2',
  '15.1(2)SG',
  '15.1(2)SG1',
  '15.1(2)SG2',
  '15.1(2)SG3',
  '15.1(2)SG4',
  '15.1(2)SG5',
  '15.1(2)SG6',
  '15.1(2)SG7',
  '15.1(2)SNG',
  '15.1(2)SNH',
  '15.1(2)SNI',
  '15.1(2)SNI1',
  '15.1(1)SY',
  '15.1(1)SY1',
  '15.1(1)SY2',
  '15.1(1)SY3',
  '15.1(1)SY4',
  '15.1(1)SY5',
  '15.1(1)SY6',
  '15.1(2)SY',
  '15.1(2)SY1',
  '15.1(2)SY2',
  '15.1(2)SY3',
  '15.1(2)SY4',
  '15.1(2)SY4a',
  '15.1(2)SY5',
  '15.1(2)SY6',
  '15.1(2)SY7',
  '15.1(1)T',
  '15.1(1)T1',
  '15.1(1)T2',
  '15.1(1)T3',
  '15.1(1)T4',
  '15.1(1)T5',
  '15.1(2)T',
  '15.1(2)T0a',
  '15.1(2)T1',
  '15.1(2)T2',
  '15.1(2)T2a',
  '15.1(2)T3',
  '15.1(2)T4',
  '15.1(2)T5',
  '15.1(3)T',
  '15.1(3)T1',
  '15.1(3)T2',
  '15.1(3)T3',
  '15.1(3)T4',
  '15.1(1)XB',
  '15.2(1)E',
  '15.2(1)E1',
  '15.2(1)E2',
  '15.2(1)E3',
  '15.2(2)E',
  '15.2(2)E1',
  '15.2(2)E2',
  '15.2(2)E4',
  '15.2(2a)E1',
  '15.2(3)E',
  '15.2(3)E1',
  '15.2(3)E2',
  '15.2(3)E3',
  '15.2(3a)E',
  '15.2(3m)E2',
  '15.2(4)E',
  '15.2(4)E1',
  '15.2(4m)E1',
  '15.2(2)EB',
  '15.2(2)EB1',
  '15.2(2)EB2',
  '15.2(2)EA1',
  '15.2(2)EA2',
  '15.2(2)EA3',
  '15.2(3)EA',
  '15.2(4)EA',
  '15.2(4)EA1',
  '15.2(4)EA3',
  '15.2(1)EY',
  '15.2(1)GC',
  '15.2(1)GC1',
  '15.2(1)GC2',
  '15.2(2)GC',
  '15.2(3)GC',
  '15.2(3)GC1',
  '15.2(4)GC',
  '15.2(4)GC1',
  '15.2(4)GC2',
  '15.2(4)GC3',
  '15.2(4)M',
  '15.2(4)M1',
  '15.2(4)M10',
  '15.2(4)M2',
  '15.2(4)M3',
  '15.2(4)M4',
  '15.2(4)M5',
  '15.2(4)M6',
  '15.2(4)M6a',
  '15.2(4)M7',
  '15.2(4)M8',
  '15.2(4)M9',
  '15.2(1)S',
  '15.2(1)S1',
  '15.2(1)S2',
  '15.2(2)S',
  '15.2(2)S0a',
  '15.2(2)S0c',
  '15.2(2)S1',
  '15.2(2)S2',
  '15.2(4)S',
  '15.2(4)S1',
  '15.2(4)S2',
  '15.2(4)S3',
  '15.2(4)S3a',
  '15.2(4)S4',
  '15.2(4)S4a',
  '15.2(4)S5',
  '15.2(4)S6',
  '15.2(4)S7',
  '15.2(2)SNG',
  '15.2(2)SNH1',
  '15.2(2)SNI',
  '15.2(1)SY',
  '15.2(1)SY0a',
  '15.2(1)SY1',
  '15.2(1)SY1a',
  '15.2(2)SY',
  '15.2(2)SY1',
  '15.2(1)T',
  '15.2(1)T1',
  '15.2(1)T2',
  '15.2(1)T3',
  '15.2(1)T3a',
  '15.2(1)T4',
  '15.2(2)T',
  '15.2(2)T1',
  '15.2(2)T2',
  '15.2(2)T3',
  '15.2(2)T4',
  '15.2(3)T',
  '15.2(3)T1',
  '15.2(3)T2',
  '15.2(3)T3',
  '15.2(3)T4',
  '15.3(3)M',
  '15.3(3)M1',
  '15.3(3)M2',
  '15.3(3)M3',
  '15.3(3)M4',
  '15.3(3)M5',
  '15.3(3)M6',
  '15.3(3)M7',
  '15.3(1)S',
  '15.3(1)S1',
  '15.3(1)S2',
  '15.3(2)S',
  '15.3(2)S0a',
  '15.3(2)S1',
  '15.3(2)S2',
  '15.3(3)S',
  '15.3(3)S1',
  '15.3(3)S1a',
  '15.3(3)S2',
  '15.3(3)S3',
  '15.3(3)S4',
  '15.3(3)S5',
  '15.3(3)S6',
  '15.3(3)S7',
  '15.3(1)SY',
  '15.3(1)T',
  '15.3(1)T1',
  '15.3(1)T2',
  '15.3(1)T3',
  '15.3(1)T4',
  '15.3(2)T',
  '15.3(2)T1',
  '15.3(2)T2',
  '15.3(2)T3',
  '15.3(2)T4',
  '15.4(1)CG',
  '15.4(1)CG1',
  '15.4(2)CG',
  '15.4(3)M',
  '15.4(3)M1',
  '15.4(3)M2',
  '15.4(3)M3',
  '15.4(3)M4',
  '15.4(3)M5',
  '15.4(1)S',
  '15.4(1)S1',
  '15.4(1)S2',
  '15.4(1)S3',
  '15.4(1)S4',
  '15.4(2)S',
  '15.4(2)S1',
  '15.4(2)S2',
  '15.4(2)S3',
  '15.4(2)S4',
  '15.4(3)S',
  '15.4(3)S1',
  '15.4(3)S2',
  '15.4(3)S3',
  '15.4(3)S4',
  '15.4(3)S5',
  '15.4(1)T',
  '15.4(1)T1',
  '15.4(1)T2',
  '15.4(1)T3',
  '15.4(1)T4',
  '15.4(2)T',
  '15.4(2)T1',
  '15.4(2)T2',
  '15.4(2)T3',
  '15.4(2)T4',
  '15.5(3)M',
  '15.5(3)M0a',
  '15.5(3)M1',
  '15.5(3)M2',
  '15.5(1)S',
  '15.5(1)S1',
  '15.5(1)S2',
  '15.5(1)S3',
  '15.5(2)S',
  '15.5(2)S1',
  '15.5(2)S2',
  '15.5(3)S',
  '15.5(3)S0a',
  '15.5(3)S1',
  '15.5(3)S1a',
  '15.5(3)S2',
  '15.5(3)SN',
  '15.5(1)T4',
  '15.5(1)T',
  '15.5(1)T1',
  '15.5(1)T2',
  '15.5(1)T3',
  '15.5(2)T',
  '15.5(2)T1',
  '15.5(2)T2',
  '15.5(2)T3',
  '15.6(1)S',
  '15.6(1)S1',
  '15.6(1)T',
  '15.6(1)T0a',
  '15.6(1)T1',
  '15.6(2)T' );

foreach af ( affected )
{
  if( version == af )
  {
    report = report_fixed_ver(  installed_version:version, fixed_version: "See advisory" );
    security_message( port:0, data:report );
    exit( 0 );
  }
}

exit( 99 );