The version of AOS installed on the remote host is prior to 5.19.2. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.19.2 advisory.

  - Perl before 5.30.3 has an integer overflow related to mishandling of a PL_regkind[OP(n)] == NOTHING     situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction     injection. (CVE-2020-10878)

  - A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption     and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause     the system to crash or cause a denial of service. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability. (CVE-2020-25643)

  - Net-SNMP through 5.8 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB     provides the ability to run arbitrary commands as root. (CVE-2020-15862)

  - The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-     byte input sequences in the EUC-KR encoding, may have a buffer over-read. (CVE-2019-25013)

  - The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range     reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when     passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to     sysdeps/ieee754/ldbl-96/e_rem_pio2l.c. (CVE-2020-10029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.2)

medium Nessus Plugin ID 164578

Version 1.11

Version 1.10

Version 1.9

Version 1.8

Version 1.8

Version 1.7

Version 1.6

Version 1.6

Version 1.5

Version 1.4

Version 1.11 Jan 14, 2025, 1:29 AM CVSS metrics ("Cvssv4 score" set to 4.8) CVSS metrics ("Cvssv4 threat vector" set to "CVSS:4.0/E:A") CVSS metrics ("Cvssv4 vector" set to "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N") CVSSv2 severity (based on CVE-2020-15862, severity decreased from "High" to "Medium") Plugin metadata Plugin Feed: 202501140129
Version 1.10 Mar 12, 2024, 10:45 AM Plugin metadata Plugin Feed: 202403121045
Version 1.9 Feb 2, 2024, 8:33 AM Plugin metadata Plugin Feed: 202402020833
Version 1.8 Feb 1, 2024, 7:16 AM Plugin metadata Plugin Feed: 202402010716
Version 1.8 Feb 2, 2024, 5:31 AM Plugin metadata Plugin Feed: 202402020531
Version 1.7 Nov 24, 2023, 12:01 AM Detection (updated detection logic) Plugin Feed: 202311240001
Version 1.6 Feb 23, 2023, 6:16 PM Plugin metadata Plugin Feed: 202302231816
Version 1.6 Nov 23, 2023, 9:50 PM Detection (updated detection logic) Plugin Feed: 202311232150
Version 1.5 Jan 12, 2023, 6:19 PM Exploit attributes ("Exploit framework core" set to "True") Plugin Feed: 202301121819
Version 1.4 Dec 6, 2022, 4:40 AM Reference Plugin Feed: 202212060440