Cisco IOS Software SSH X.509 Authentication Bypass Vulnerability (cisco-sa-20161207-ios-xe-x509)

# SPDX-FileCopyrightText: 2016 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/o:cisco:ios";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.106447");
  script_version("2026-02-02T05:59:28+0000");
  script_tag(name:"last_modification", value:"2026-02-02 05:59:28 +0000 (Mon, 02 Feb 2026)");
  script_tag(name:"creation_date", value:"2016-12-08 14:16:20 +0700 (Thu, 08 Dec 2016)");
  script_tag(name:"cvss_base", value:"5.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:N/C:P/I:P/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2017-01-05 12:58:00 +0000 (Thu, 05 Jan 2017)");

  script_cve_id("CVE-2016-6474");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Cisco IOS Software SSH X.509 Authentication Bypass Vulnerability (cisco-sa-20161207-ios-xe-x509)");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2016 Greenbone AG");
  script_family("CISCO");
  script_dependencies("gb_cisco_ios_consolidation.nasl");
  script_mandatory_keys("cisco/ios/detected");

  script_tag(name:"summary", value:"A vulnerability in the implementation of X.509 Version 3 for
  SSH authentication functionality in Cisco IOS and IOS XE Software could allow an unauthenticated,
  remote attacker to bypass authentication on an affected system.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"The vulnerability is due to improper validation of X.509
  signatures during the SSH authentication phase. An attacker could exploit this vulnerability by
  presenting an invalid X.509 signature to an affected system.");

  script_tag(name:"impact", value:"A successful exploit could allow the attacker to impersonate an
  existing valid user over an SSH connection.");

  script_tag(name:"solution", value:"See the referenced vendor advisory for a solution.");

  script_xref(name:"URL", value:"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-ios-xe-x509");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if( ! version = get_app_version( cpe:CPE, nofork:TRUE ) )
  exit( 0 );

if( version == "15.5(2.25)T" ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"See advisory" );
  security_message( port:0, data:report );
  exit( 0 );
}

exit( 99 );