The version of AOS installed on the remote host is prior to 6.6.2.6. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.6.2.6 advisory.

  - Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap     buffer overflow when octet-counted framing is used. This can result in a segfault or some other     malfunction. As of our understanding, this vulnerability can not be used for remote code execution. But     there may still be a slight chance for experts to do that. The bug occurs when the octet count is read.
    While there is a check for the maximum number of octets, digits are written to a heap buffer even when the     octet count is over the maximum, This can be used to overrun the memory buffer. However, once the sequence     of digits stop, no additional characters can be added to the buffer. In our opinion, this makes remote     exploits impossible or at least highly complex. Octet-counted framing is one of two potential framing     modes. It is relatively uncommon, but enabled by default on receivers. Modules `imtcp`, `imptcp`,     `imgssapi`, and `imhttp` are used for regular syslog message reception. It is best practice not to     directly expose them to the public. When this practice is followed, the risk is considerably lower. Module     `imdiag` is a diagnostics module primarily intended for testbench runs. We do not expect it to be present     on any production installation. Octet-counted framing is not very common. Usually, it needs to be     specifically enabled at senders. If users do not need it, they can turn it off for the most important     modules. This will mitigate the vulnerability. (CVE-2022-24903)

  - Integer underflow in grub_net_recv_ip4_packets; A malicious crafted IP packet can lead to an integer     underflow in grub_net_recv_ip4_packets() function on rsm->total_len value. Under certain circumstances the     total_len value may end up wrapping around to a small integer number which will be used in memory     allocation. If the attack succeeds in such way, subsequent operations can write past the end of the     buffer. (CVE-2022-28733)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.6.2.6)

high Nessus Plugin ID 178216

Version 1.2

Version 1.1

Version 1.1

Version 1.0

Version 1.2 Feb 1, 2024, 2:31 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202402011431
Version 1.1 Oct 23, 2023, 4:39 PM CVSSv3 score source (set to "CVE-2022-28733") Plugin Feed: 202310231639
Version 1.1 Feb 1, 2024, 12:41 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202402011241
Version 1.0 Jul 13, 2023, 4:02 AM New Plugin Feed: 202307130402