The version of AOS installed on the remote host is prior to 5.15.3. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.15.3 advisory.

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of     coders/sgi.c. (CVE-2019-19948)

  - The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable     to a frame validation bypass. If the brcmfmac driver receives a firmware event frame from a remote source,     the is_wlc_event_frame function will cause this frame to be discarded and unprocessed. If the driver     receives the firmware event frame from the host, the appropriate handler is called. This frame validation     can be bypassed if the bus used is USB (for instance by a wifi dongle). This can allow firmware event     frames from a remote source to be processed. In the worst case scenario, by sending specially-crafted WiFi     packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system.
    More typically, this vulnerability will result in denial-of-service conditions. (CVE-2019-9503)

  - An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap     overflow in the parser for AIX log messages. The parser tries to locate a log message delimiter (in this     case, a space or a colon) but fails to account for strings that do not satisfy this constraint. If the     string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check     that detects invalid log messages. The message will then be considered valid, and the parser will eat up     the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was     zero and now becomes minus one. The following step in the parser is to shift left the contents of the     message. To do this, it will call memmove with the right pointers to the target and destination strings,     but the lenMsg will now be interpreted as a huge value, causing a heap overflow. (CVE-2019-17041)

  - An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in     the parser for Cisco log messages. The parser tries to locate a log message delimiter (in this case, a     space or a colon), but fails to account for strings that do not satisfy this constraint. If the string     does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that     detects invalid log messages. The message will then be considered valid, and the parser will eat up the     nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero     and now becomes minus one. The following step in the parser is to shift left the contents of the message.
    To do this, it will call memmove with the right pointers to the target and destination strings, but the     lenMsg will now be interpreted as a huge value, causing a heap overflow. (CVE-2019-17042)

  - An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-     daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local     attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use     this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus     clients. (CVE-2020-12049)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Plugins Search

high