CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
93.9%
The version of Nessus Network Monitor (NNM) installed on the remote host is prior to 6.0.0. It is, therefore, affected by multiple vulnerabilities:
Note that Nessus has not tested for this issue but has instead relied only on the application’s self-reported version number.
#%NASL_MIN_LEVEL 70300
##
# (C) Tenable, Inc.
##
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(160640);
script_version("1.3");
script_set_attribute(attribute:"plugin_modification_date", value:"2023/10/30");
script_cve_id("CVE-2021-3711", "CVE-2021-3712");
script_name(english:"Nessus Network Monitor < 6.0.0 Multiple Vulnerabilities (TNS-2022-02)");
script_set_attribute(attribute:"synopsis", value:
"A vulnerability scanner installed on the remote host is affected by multiple vulnerabilities.");
script_set_attribute(attribute:"description", value:
"The version of Nessus Network Monitor (NNM) installed on the remote host is prior to 6.0.0. It is, therefore, affected
by multiple vulnerabilities:
- ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer
holding the string data and a field holding the buffer length. This contrasts with normal C strings which
are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict
requirement, ASN.1 strings that are parsed using OpenSSL's own d2i functions (and other similar parsing
functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally
NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly
construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the data
and length fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function.
Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array
will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed.
Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains
ASN1_STRINGs that have been directly constructed by the application without NUL terminating the data field,
then a read buffer overrun can occur. The same thing can also occur during name constraints processing of
certificates (for example if a certificate has been directly constructed by the application instead of
loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING
structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp()
functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then
process it through one of the affected OpenSSL functions then this issue could be hit. This might result
in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory
contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).
Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y).
- In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt().
Typically an application will call this function twice. The first time, on entry, the out parameter can be
NULL and, on exit, the outlen parameter is populated with the buffer size required to hold the decrypted
plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again,
but this time passing a non-NULL value for the out parameter. A bug in the implementation of the SM2
decryption code means that the calculation of the buffer size required to hold the plaintext returned by the
first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can
lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer
that is too small. A malicious attacker who is able present SM2 content for decryption to an application
could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents
of other data held after the buffer, possibly changing application behaviour or causing the application to
crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in
OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported
version number.");
script_set_attribute(attribute:"see_also", value:"https://www.tenable.com/security/tns-2022-02");
script_set_attribute(attribute:"solution", value:
"Upgrade to Nessus Network Monitor version 6.0.0 or later.");
script_set_attribute(attribute:"agent", value:"all");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-3711");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2022/01/05");
script_set_attribute(attribute:"patch_publication_date", value:"2022/01/05");
script_set_attribute(attribute:"plugin_publication_date", value:"2022/05/06");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/a:tenable:nnm");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Misc.");
script_copyright(english:"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("nnm_installed_win.nbin", "nnm_installed_nix.nbin");
script_require_keys("installed_sw/Tenable NNM", "Host/nnm_installed");
exit(0);
}
include('vcf.inc');
var app_name = 'Tenable NNM';
var app_info = vcf::get_app_info(app:app_name);
vcf::check_granularity(app_info:app_info, sig_segments:3);
var constraints = [
{ 'max_version': '5.13.1', 'fixed_version' : '6.0.0' }
];
vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
93.9%