Cisco ANI Configuration Overwrite DoS (CSCup62167)

#TRUSTED 0d84b7ecd55f7d8330072989a4d6aa9a564177db87acbdfe4c771a6bdfaa0748c9db8f59dcd3624be684a36b097848ecdc299431a0253e03c3d4a0673362b424a48b5185d4f9386c8e13dd3661677b1a4c69d0448b5ac6fdfdceb193c6b6a801e3427a3484c05af51f238cf10103afcbf71325d3230aff2ae4ebdd8797be7e46761b4690ae76937770262fc681dd191f8099aa422f64919b161933be7920e7181073f445aa4aaad83fb9d86a192b48daa335877e2eb8c15fdd168a6849c98c285aa301f92f050483a89d5fc0229875f0392c6e00a3c843b932de27c5c41a88ace6788884527982a7a6ad4bf857d0fa0eeb0fd2d324b04c575d6f271de1af248b3ad708907e94f7895a9c42ccaf65c6ca2f3dd440008b987c019f9bb1a98ae7eb2e61ae4a66ad06a612ec467d4160bd78aa3a8143e858c20a01e21cf8beeb7a363a6bc3ab611391924b55290b84fb99e1df83ec414174618c653952bbe7fd377bd70470b5d19fa1be48a1b0b88c4f62299ee4b96a1917259463f92d6cdd31428cc2c74ebc7bdb232802d9ba0f0e21ed7db6819fbd1a06e94a0d0b453b3c9d8c9a28fe8efca44ce05cd7de68656557334a3de22cbb46920bdb6ebae30d1e16aae142955566c8408d8a2ccae656fb51e2b7632c338d3b04b1914db9717fab51918bc72a17353c8bd5bfbe20a6623d828da03b60c041ca7ebae87aef705c3133b77a
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(83782);
  script_version("1.11");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/12/01");

  script_cve_id("CVE-2015-0669");
  script_bugtraq_id(73245);
  script_xref(name:"CISCO-BUG-ID", value:"CSCup62167");

  script_name(english:"Cisco ANI Configuration Overwrite DoS (CSCup62167)");
  script_summary(english:"Checks the IOS version.");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is affected by a denial of service vulnerability.");
  script_set_attribute(attribute:"description", value:
"The remote Cisco device is affected by a vulnerability in the
Autonomic Networking Infrastructure (ANI) due to insufficient
validation of received Autonomic Networking (AN) messages. A remote,
unauthenticated attacker, by sending specially crafted AN messages,
can exploit this to overwrite configuration settings, resulting in a
denial of service condition in a limited set of router services.");
  script_set_attribute(attribute:"see_also", value:"https://tools.cisco.com/security/center/viewAlert.x?alertId=37935");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID
CSCup62167.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2015-0669");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2015/03/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2015/03/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2015/05/22");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_version.nasl");
  script_require_keys("Host/Cisco/IOS/Version");

  exit(0);
}

include("audit.inc");
include("cisco_func.inc");
include("cisco_kb_cmd_func.inc");

flag = 0;
override = 0;

# According to CSCug65204, the following releases are affected :
# 15.4S 15.4(3)S 15.4(2.17)S0.7
version = get_kb_item_or_exit("Host/Cisco/IOS/Version");
if (
  version == '15.4S' ||
  version == '15.4(3)S' ||
  version == '15.4(2.17)S0.7'
) flag++;

# Check that ANI is running
if (flag && get_kb_item("Host/local_checks_enabled"))
{
  flag = 0;
  buf = cisco_command_kb_item("Host/Cisco/Config/show_run_autonomic","show run | include autonomic");
  if (check_cisco_result(buf))
  {
    if (
      ( !empty_or_null(buf) ) &&
      ( "no autonomic" >!< buf )
    ) flag = 1;
  }
  else if (cisco_needs_enable(buf))
  {
    flag = 1;
    override = 1;
  }
}

if (flag)
{
  if (report_verbosity > 0)
  {
    report =
    '\n  Cisco bug ID      : CSCup62167' +
    '\n  Installed release : ' + version +
    '\n';
    security_warning(port:0, extra:report + cisco_caveat(override));
  }
  else security_warning(port:0, extra:cisco_caveat(override));
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");