Cisco IOS XE Software Performance Routing Version 3 Denial of Service Vulnerability

#TRUSTED 2e05138fd67df8bb02a2b93fc01a5fc53a3842a713b126a97a1fe86b0f4349c536452d3c6ec8fcb0952a678f094983f70355f6de901025cccb5c2ff54638f72cb7c98fbce1d888f28f5d5d9641cf9612cd007c998e92646bab5152fde3128fafc47f5487e25a54b8508d652269f2748ab9bdae8fcd23ac7098348cc63ba111405efd0f0f5d7a712c0545bf80f3b8d3fe951c8499fdee9e38b65f4eca3882e72e7ab443b663656068d2b1261674218f2fce0b66f14456c856f641acdd42681354c1c2c4cf141ce6e753f447cf8cefd41fee7fa2804b9164e5033f38816e920fc2aade98d67caad5fe7297cd11373c5c591ba776515fd2e0498b84bcfc03bb707ddf97f8bab338bf4add007af1ba0ca6ef336e0eef96a6f18b7531638e1850a22615d4631488ce776d85071a0000a2fec57ee697e2572b3f61fdda3e12afff9631726642d7f89bd673e838e89f6f666202bd908954f8a5419f55dd8dcd4aaa4700f29e414a4db7da637af5e763b2766c244427f5f80fb962df5791eccfa19c6fa0ab50abbd974a1ff4e8f42d3308944993f1553ea83d4888d0d6b9a11452e2a9233d926a8477c9d60d9c09052cea78c5d8f6aa4665f31e2ce054220921971f918361c57d00de727ccbd02f40b5fdc27767f97626a6279b345e6fdd1495aa1f108c4b1e7f76d1243ee31f4d08662d3e35237fa5a22cad8532eded1221b553a30e06
#TRUST-RSA-SHA256 53c4918646856ec9740cfea2ccf6dcdecaecc06266e19a4c65d18f978a7187c9f0e00c2bfd3b853a7685a2916f280c6ab734afd7e207ae18f0156d9a824aa647a406220bef845a69106f952522f59fe78d849420f0c6b9c4f9307739ab3863812475c92e8d0a1f42fea3ee162cc943cd8d48ac79f8761c03711d1bf606c9cb812208621fc894d088c23f53de9038da0e7f2d7bda4ee94d942934888fc51c4860e6cc296fea997c416b2d1f2411b332f02353a9038c6baadea2e7ad84f38b3604483bd8bcad4d6e50e7a6627e05d93275994e57bc5ba8bbd39b7982bf33f0bc722ac07e6e197e6c8bc709e11d6547f81cc27758c646fd5c3619a0a036aca913b788acd70a30fe96e80e8f064f094c79e3938e10d9a2c39657ecb5ff87fe54a19332abefe77394d6c9650e0df7fac68d0d1cbf6080aabe1b473ebfe19b28ea57ec4c9c33b67971a3f7908606c7946193e63c104090b44e9e44b92648313cf6c48458623e370e0f2f6553805bddb6ab87bf6623f8154145f7f9c5586357e64f5994b24b0ef002ac2b2d687cfde51d15848809b7b0af02a1040af031b133095d775eea7c9478929771c1843b32638e6dddb696b7d7b555d3bcfc2406c3bfc3d88b0807287cc04330fc92ba2b980ba4614d72ec7834620bb66f71bb6b379770bab47aff39b06ccbdd2a83c37d76f175f644fc1c3b829c63099996d4e1b803d59846fc
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(123795);
  script_version("1.13");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/05/03");

  script_cve_id("CVE-2019-1760");
  script_xref(name:"CISCO-BUG-ID", value:"CSCvj55896");
  script_xref(name:"CISCO-SA", value:"cisco-sa-20190327-pfrv3");
  script_xref(name:"IAVA", value:"2019-A-0097-S");

  script_name(english:"Cisco IOS XE Software Performance Routing Version 3 Denial of Service Vulnerability");
  script_summary(english:"Checks the version of Cisco IOS XE Software");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS XE Software is
affected by following vulnerability

  - A vulnerability in Performance Routing Version 3 (PfRv3)
    of Cisco IOS XE Software could allow an unauthenticated,
    remote attacker to cause the affected device to
    reload.The vulnerability is due to the processing of
    malformed smart probe packets. An attacker could exploit
    this vulnerability by sending specially crafted smart
    probe packets at the affected device. A successful
    exploit could allow the attacker to reload the device,
    resulting in a denial of service (DoS) attack on an
    affected system. (CVE-2019-1760)

Please see the included Cisco BIDs and Cisco Security Advisory for
more information");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-pfrv3
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?250f85b5");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj55896");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID
CSCvj55896");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-1760");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(20);

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/03/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/03/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/04/05");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xe");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2019-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_xe_version.nasl");
  script_require_keys("Host/Cisco/IOS-XE/Version");

  exit(0);
}

include('audit.inc');
include('cisco_workarounds.inc');
include('ccf.inc');

product_info = cisco::get_product_info(name:'Cisco IOS XE Software');

version_list=make_list(
  '3.2.0JA',
  '3.16.7bS',
  '3.16.7aS',
  '3.16.7S',
  '3.16.6bS',
  '3.16.6S',
  '3.16.5bS',
  '3.16.5aS',
  '3.16.5S',
  '3.16.4gS',
  '3.16.4eS',
  '3.16.4dS',
  '3.16.4cS',
  '3.16.4bS',
  '3.16.4aS',
  '3.16.4S',
  '16.8.1s',
  '16.8.1c',
  '16.8.1b',
  '16.8.1a',
  '16.8.1',
  '16.7.1b',
  '16.7.1a',
  '16.7.1',
  '16.6.3',
  '16.6.2',
  '16.6.1',
  '16.5.3',
  '16.5.2',
  '16.5.1b',
  '16.5.1a',
  '16.5.1',
  '16.4.3',
  '16.4.2',
  '16.4.1',
  '16.3.6',
  '16.3.5b',
  '16.3.5',
  '16.3.4',
  '16.3.3',
  '16.3.2'
);

workarounds = make_list(CISCO_WORKAROUNDS['generic_workaround']);
workaround_params = WORKAROUND_CONFIG['pfrv3'];

reporting = make_array(
  'port'     , product_info['port'], 
  'severity' , SECURITY_HOLE,
  'version'  , product_info['version'],
  'bug_id'   , 'CSCvj55896',
  'cmds'     , make_list("show running-config")
);

cisco::check_and_report(
  product_info:product_info, 
  workarounds:workarounds, 
  workaround_params:workaround_params, 
  reporting:reporting, 
  vuln_versions:version_list
);