CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
AI Score
Confidence
High
EPSS
Percentile
56.0%
A vulnerability in the TCP Input module of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of the affected device which could lead to a denial of service (DoS) condition. The vulnerability is due to the way certain sequences of TCP packets are processed on an affected device when those packets undergo Network Address Translation (NAT). An attacker could exploit this vulnerability by sending a specific sequence of TCP packets to be processed by an affected device. An exploit could allow the attacker to cause a memory leak or reload of the affected device that would lead to a DoS condition.
This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
include('compat.inc');
if (description)
{
script_id(501809);
script_version("1.5");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/09/04");
script_cve_id("CVE-2014-2109");
script_xref(name:"ICSA", value:"17-094-04");
script_name(english:"Rockwell Automation Stratix 5900 Improper Input Validation (CVE-2014-2109)");
script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
script_set_attribute(attribute:"description", value:
"A vulnerability in the TCP Input module of Cisco IOS Software
could allow an unauthenticated, remote attacker to cause a memory
leak or a reload of the affected device which could lead to a denial
of service (DoS) condition.
The vulnerability is due to the way certain sequences of TCP packets
are processed on an affected device when those packets undergo
Network Address Translation (NAT). An attacker could exploit this vulnerability
by sending a specific sequence of TCP packets to be processed by an affected device.
An exploit could allow the attacker to cause a memory leak or reload of the affected
device that would lead to a DoS condition.
This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
# https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-nat
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0a46bf69");
# https://www.rockwellautomation.com/en-us/support/advisory.PN965.html
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?141f2981");
# https://www.cisa.gov/news-events/ics-advisories/icsa-17-094-04
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c7bf8ef2");
script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-17-094-04");
script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.
Rockwell Automation has provided a new firmware version, Version 15.6.3, to mitigate these vulnerabilities.
Rockwell Automation encourages users of the affected versions to update to the latest available software versions
addressing the associated risk, and including improvements to further harden the software and enhance its resilience
against similar malicious attacks. Users can find the latest firmware version by searching for their device at the
following web site:
http://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?famID=15
Additional precautions and risk mitigation strategies specific to these types of attacks are recommended in the Rockwell
Automation security release. When possible, multiple strategies should be implemented simultaneously.
https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1041191
Please also refer to CiscoΓ’ΒΒs security advisories (linked below) for additional workarounds and details for these
vulnerabilities.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2014-2109");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_cwe_id(755);
script_set_attribute(attribute:"vuln_publication_date", value:"2014/03/27");
script_set_attribute(attribute:"patch_publication_date", value:"2014/03/27");
script_set_attribute(attribute:"plugin_publication_date", value:"2023/11/15");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:allen-bradley_stratix_5900_industrial_managed_ethernet_switch");
script_set_attribute(attribute:"generated_plugin", value:"former");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Tenable.ot");
script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("tenable_ot_api_integration.nasl");
script_require_keys("Tenable.ot/Rockwell");
exit(0);
}
include('tenable_ot_cve_funcs.inc');
get_kb_item_or_exit('Tenable.ot/Rockwell');
var asset = tenable_ot::assets::get(vendor:'Rockwell');
var vuln_cpes = {
"cpe:/h:rockwellautomation:allen-bradley_stratix_5900_industrial_managed_ethernet_switch" :
{"versionEndExcluding" : "15.6.3", "family" : "Stratix"}
};
tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);