Axis Communication A1001 Heap-Based Buffer Overflow (CVE-2023-21406)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501934);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/02/15");

  script_cve_id("CVE-2023-21406");

  script_name(english:"Axis Communication A1001 Heap-Based Buffer Overflow (CVE-2023-21406)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Ariel Harush and Roy Hodir from OTORIO have found a flaw in the AXIS
A1001 when communicating over OSDP. A heap-based buffer overflow was
found in the pacsiod process which is handling the OSDP communication
allowing to write outside of the allocated buffer. By appending
invalid data to an OSDP message it was possible to write data beyond
the heap allocated buffer. The data written outside the buffer could
be used to execute arbitrary code. lease refer to the Axis security
advisory for more information, mitigation and affected products and
software versions.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.axis.com/dam/public/1b/21/5f/cve-2023-21406-en-US-407245.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5b0e2107");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-21406");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(787);

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/07/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/07/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/01/23");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:axis:a1001_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/AxisCommunication");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/AxisCommunication');

var asset = tenable_ot::assets::get(vendor:'AxisCommunication');

var vuln_cpes = {
    "cpe:/o:axis:a1001_firmware" :
        {"versionEndIncluding" : "1.65.4", "family" : "AxisCommunication"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);