Rockwell Automation Stratix 5900 Improper Input Validation (CVE-2014-2111)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501804);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/09/04");

  script_cve_id("CVE-2014-2111");
  script_xref(name:"ICSA", value:"17-094-04");

  script_name(english:"Rockwell Automation Stratix 5900 Improper Input Validation (CVE-2014-2111)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the Application Layer Gateway (ALG) module of 
Cisco IOS Software could allow an unauthenticated, remote attacker 
to cause a reload of the affected device which could lead to a denial 
of service (DoS) condition. 
The vulnerability is due to the way certain malformed DNS packets are 
processed on an affected device when those packets undergo 
Network Address Translation (NAT). An attacker could exploit this vulnerability 
by sending malformed DNS packets to be processed and translated by an affected 
device. An exploit could allow the attacker to cause a reload of the affected 
device that would lead to a DoS condition. 

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-nat
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0a46bf69");
  # https://www.rockwellautomation.com/en-us/support/advisory.PN965.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?141f2981");
  # https://www.cisa.gov/news-events/ics-advisories/icsa-17-094-04
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c7bf8ef2");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-17-094-04");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Rockwell Automation has provided a new firmware version, Version 15.6.3, to mitigate these vulnerabilities.

Rockwell Automation encourages users of the affected versions to update to the latest available software versions
addressing the associated risk, and including improvements to further harden the software and enhance its resilience
against similar malicious attacks. Users can find the latest firmware version by searching for their device at the
following web site:

http://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?famID=15

Additional precautions and risk mitigation strategies specific to these types of attacks are recommended in the Rockwell
Automation security release. When possible, multiple strategies should be implemented simultaneously.

https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1041191

Please also refer to Cisco’s security advisories (linked below) for additional workarounds and details for these
vulnerabilities.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2014-2111");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(755);

  script_set_attribute(attribute:"vuln_publication_date", value:"2014/03/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2014/03/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/11/15");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:allen-bradley_stratix_5900_industrial_managed_ethernet_switch");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Rockwell");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Rockwell');

var asset = tenable_ot::assets::get(vendor:'Rockwell');

var vuln_cpes = {
    "cpe:/h:rockwellautomation:allen-bradley_stratix_5900_industrial_managed_ethernet_switch" :
        {"versionEndExcluding" : "15.6.3", "family" : "Stratix"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);