| code | #TRUSTED 935fb3dcecd35894e9ea46c70a34dc31b50f31fb12fc266f77ec664af699ed1aa1f9b9656077dfdcffabe05c8da2b3b8629c6013fd9f277c1474b4c0298abb5a4265f52d7650bc0249f1bd164b9f537c0ee919a0122f68a15ceefe68c509648c525a7b6ffde0d2268c0a284735238c1fd2d85604ffdd336b1b9789eb74382eb86ea1031fac94a1cdfdbf1fd693ea299c8b82e19c8ebc0c120fbea27d6721099a913482830322c4567acf46d4a21fb182038b76754d6fdde1e3eb25c0c8195e68742067d17cb81ba3dbe77e270a47dbf010d06556ebfba9b1138ac76d10cbe9f0ecac4d76530b932f67fb6fbfa08b3a2b3dcfc6a3369522adc8f2d52366e135009fa8084092c9bd3648f70c4ed8450499ad3261f91a5b9e77560b7b60b09c84bdf943acd521376faf7adc31325a4dc99a1574b5969f499cce30a59643409dc9549035896acfaf60d87995f3b87d50d42de6227a7e51ced870108dc37327904b5f0d8de7f5bb1bc988a7e7e7e4754be91407c17b99001372e4bc42cabcc609ee2f7a27b90ab60da436777e8fe21ab609c5014e07e6f978cab6e1523538a04d32fdd4f3584dbc2454cb740ff5871f3c25146363a9eb6d50a2fdb3726cc0cae2f7ad1a7d7860a62ada62da6ae915e44ec73482075c48eca4e73a470f33c64235d44b700dcc7d3ab46b55925924d26fee02f97dfd99bb6a0f80332ee2f84d267013f6
#
# (C) Tenable Network Security, Inc.
#
include("compat.inc");
if (description)
{
script_id(103669);
script_version("1.9");
script_cvs_date("Date: 2019/11/12");
script_cve_id("CVE-2017-12231");
script_bugtraq_id(101039);
script_xref(name:"CISCO-BUG-ID", value:"CSCvc57217");
script_xref(name:"CISCO-SA", value:"cisco-sa-20170927-nat");
script_name(english:"Cisco IOS Software NAT denial of service (cisco-sa-20170927-nat)");
script_summary(english:"Checks the IOS version.");
script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
script_set_attribute(attribute:"description", value:
"According to its self-reported version and configuration, the Cisco
IOS software running on the remote device is affected by a denial of
service vulnerability in the Network Address Translation (NAT)
feature. An unauthenticated, remote attacker can exploit this, via
specially crafted NAT requests, to cause the switch to stop processing
traffic, requiring a device restart to regain functionality.");
# https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-nat
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a7014611");
script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID
CSCvc57217");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"vuln_publication_date", value:"2017/09/27");
script_set_attribute(attribute:"patch_publication_date", value:"2017/09/27");
script_set_attribute(attribute:"plugin_publication_date", value:"2017/10/05");
script_set_attribute(attribute:"plugin_type", value:"combined");
script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"CISCO");
script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("cisco_ios_version.nasl");
script_require_keys("Host/Cisco/IOS/Version");
exit(0);
}
include("audit.inc");
include("cisco_func.inc");
include("cisco_kb_cmd_func.inc");
flag = 0;
override = 0;
ver = get_kb_item_or_exit("Host/Cisco/IOS/Version");
vuln_versions = make_list(
'15.2(4)M8',
'15.2(4)M10',
'15.2(4)M9',
'15.3(3)S6',
'15.2(1)EY1',
'12.4(25e)JAO3a',
'12.4(25e)JAO20s',
'15.3(3)M6',
'15.5(2)S',
'15.3(3)JN',
'15.5(3)M',
'15.1(4)M11',
'15.4(1)T4',
'15.6(1)S',
'15.5(3)S',
'15.3(3)SA',
'15.6(1)T',
'15.5(2)T',
'15.4(3)S3',
'15.2(2)E3',
'15.4(3)M3',
'12.4(25e)JAP3',
'12.4(25e)JAO5m',
'15.1(4)M12',
'15.2(3)EA1',
'15.2(1)EY2',
'15.2(2)JA3',
'15.2(4)JB8',
'15.2(4)S7',
'15.3(3)JAX3',
'15.3(3)JN5',
'15.3(3)M7',
'15.3(3)S7',
'15.4(3)M4',
'15.4(1)S4',
'15.4(2)S4',
'15.4(3)S4',
'15.4(3)SN2',
'15.4(2)T4',
'15.5(1)S2',
'15.5(1)S3',
'15.5(2)S1',
'15.5(2)S2',
'15.5(2)SN0a',
'15.5(1)T2',
'15.5(1)T3',
'15.5(2)T1',
'15.5(2)T2',
'15.6(2)S',
'15.6(2)T',
'15.3(3)S8',
'15.5(3)M1',
'15.3(3)M8',
'15.5(3)SN1',
'15.3(3)JN6',
'15.5(3)M0a',
'15.3(3)JBB3',
'15.5(3)S1',
'15.2(4)S8',
'15.2(4)M11',
'15.4(3)S5',
'15.5(2)T3',
'15.5(3)S1a',
'15.4(3)M5',
'15.5(2)S3',
'15.5(3)M2',
'15.6(2)S1',
'12.4(25e)JAP1n',
'15.6(1)T0a',
'15.5(3)S2',
'15.3(3)JBB7',
'15.6(2)SP',
'15.6(1)S1',
'15.3(3)JC30',
'15.6(1)T1',
'15.2(3)E2a',
'15.5(3)S0a',
'15.5(2)XB',
'15.3(3)S6a',
'15.3(3)S9',
'15.5(3)S3',
'15.5(3)M2a',
'15.5(3)S2a',
'15.3(3)JBB6a',
'15.5(3)M3',
'15.2(3)EX',
'15.4(3)S6',
'15.5(2)T4',
'15.3(3)JPB',
'15.6(3)M',
'15.6(1)S2',
'15.4(3)M6',
'15.5(1)S4',
'15.5(1)T4',
'15.3(3)JNP2',
'15.6(2)S0a',
'15.6(2)T1',
'15.4(3)S5a',
'15.5(3)S2b',
'15.6(1)S1a',
'15.6(1)T2',
'15.6(2)T0a',
'12.4(25e)JAP9',
'15.2(4)EC',
'15.5(2)S4',
'15.1(2)SG7a',
'15.5(3)S3a',
'15.3(3)JC50',
'15.3(3)JC51',
'15.6(2)S2',
'15.6(2)T2',
'15.3(3)JN10',
'15.2(4)EB',
'15.5(3)M4',
'15.5(3)S4',
'15.6(3)M1',
'15.4(3)S7',
'15.6(2)SP1',
'15.6(3)M0a',
'15.1(4)M12a',
'15.3(3)M8a',
'15.3(3)S8a',
'15.4(3)M6a',
'15.4(3)S6a',
'15.3(3)JPB2',
'15.5(3)S4a',
'15.5(3)M4a',
'15.5(3)S4b',
'15.2(2)E5b',
'15.6(1)S3',
'15.5(3)M4b',
'15.5(3)S5',
'15.2(5a)E1',
'15.5(3)M4c',
'15.6(2)SP1b',
'15.5(3)S4d',
'15.6(3)M1a',
'15.6(2)SP1c',
'15.6(3)M1b',
'15.6(2)SP2',
'15.2(4a)EA5',
'15.5(3)S4e',
'15.3(3)JPC3',
'15.3(3)JDA3',
'15.5(3)S5a',
'15.4(3)S6b',
'15.4(3)S7a',
'15.3(3)JNC4',
'15.4(3)M7a',
'15.5(3)S5b',
'15.6(2)S3',
'15.3(3)JC7',
'15.6(2)SP2a',
'15.3(3)JND2',
'15.3(3)JCA7',
'15.0(2)SQD7',
'15.3(3)JNP4',
'15.2(5)E2a',
'15.2(5)E2b',
'15.3(3)JE1',
'15.3(3)JN12',
'15.6(2)S4',
'15.3(3)JD7',
'15.3(3)JF1'
);
# Check for vuln version
foreach version (vuln_versions)
{
if (version == ver)
{
flag++;
break;
}
}
# Check that NAT is enabled
if (flag && get_kb_item("Host/local_checks_enabled"))
{
flag = 0;
buf = cisco_command_kb_item("Host/Cisco/Config/show_run_|_include_ip_nat",
"show run | include ip nat");
if (check_cisco_result(buf))
{
if (preg(multiline:TRUE, pattern:"ip nat", string:buf))
{
# we also need to check if NAT ALG is enabled for H.323 RAS messages
buf = cisco_command_kb_item("Host/Cisco/Config/show_run_|_include_ip_nat_service_ras",
"show run | include ip nat service ras");
if (!preg(multiline:TRUE, pattern:"no ip nat service ras", string:buf))
flag++;
}
}
else if (cisco_needs_enable(buf))
{
flag++;
override++;
}
}
if (flag)
{
security_report_cisco(
port : 0,
severity : SECURITY_HOLE,
override : override,
version : ver,
bug_id : 'CSCvc57217',
cmds : make_list('show running-config', 'show run | include ip nat', 'show run | include ip nat service ras')
);
}
else audit(AUDIT_INST_VER_NOT_VULN, "Cisco IOS software", ver);
|