cve_2020_3259_cisco_asa_ftd

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# Filename: cve_2020_3259_cisco_asa_ftd.py
# Version: 1.0.0
# Author: Jeoi Reqi
# Vulnerability Source: https://nvd.nist.gov/vuln/detail/CVE-2020-3259

"""
Description:
This script checks for the presence of vulnerable configurations related to the CVE-2020-3259 vulnerability
on Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software.
It retrieves a list of installed software using the WMI module and compares it with a predefined list
of vulnerable configurations associated with the CVE. If any vulnerable configurations are found,
it displays a warning message to prompt the user to take immediate action to mitigate the vulnerability.

Requirements:
- Python 3.x: The script is written in Python 3 and requires a Python interpreter of version 3 or higher to run.
- WMI Module: The script uses the WMI module to interact with the Windows Management Instrumentation (WMI) API
  to retrieve a list of installed software on a Windows system. Ensure that the WMI module is installed.
  You can install it using pip: `pip install WMI`.

Usage:
1. Ensure Python 3.x is installed on your system.
2. Install the WMI module by running `pip install WMI`.
3. Run the script using the command `python cve_2020_3259_asa_ftd.py`.
4. The script will verify if any vulnerable configurations are installed on your machine
   and provide instructions for mitigation if necessary.

Functions:
- get_installed_software(): Retrieves a list of installed software on the user's machine using the WMI module.
- check_for_vulnerabilities(): Compares the list of installed software with a predefined list of vulnerable
  configurations and displays a warning message if any vulnerable configurations are found.

Important Notes:
- The predefined list of vulnerable configurations in this script corresponds to the CVE-2020-3259 vulnerability.
"""

import wmi

def get_installed_software():
    """
    Retrieves a list of installed software on the user's machine using the WMI module.

    Returns:
        list: A list containing the names of installed software.
    """
    c = wmi.WMI()
    installed_software = []
    for item in c.Win32_Product():
        installed_software.append(item.Caption)
    return installed_software

def check_for_vulnerabilities():
    """
    Compares the list of installed software with a predefined list of vulnerable configurations
    and displays a warning message if any vulnerable configurations are found.
    """
    installed_software = get_installed_software()
    vulnerable_versions = [
        "Cisco Firepower Threat Defense 6.2.3 up to (excluding) 6.2.3.16",
        "Cisco Firepower Threat Defense 6.3.0 up to (excluding) 6.3.0.6",
        "Cisco Firepower Threat Defense 6.4.0 up to (excluding) 6.4.0.9",
        "Cisco Firepower Threat Defense 6.5.0 up to (excluding) 6.5.0.5",
        "Cisco Adaptive Security Appliance (ASA) Software 9.8 up to (excluding) 9.8.4.20",
        "Cisco Adaptive Security Appliance (ASA) Software 9.9 up to (excluding) 9.9.2.67",
        "Cisco Adaptive Security Appliance (ASA) Software 9.10 up to (excluding) 9.10.1.40",
        "Cisco Adaptive Security Appliance (ASA) Software 9.12 up to (excluding) 9.12.3.9",
        "Cisco Adaptive Security Appliance (ASA) Software 9.13 up to (excluding) 9.13.1.10"
    ]
    vulnerable_installed = [software for software in installed_software if software in vulnerable_versions]
    if vulnerable_installed:
        print("\nWarning:\nThe following vulnerable configurations are installed on your machine:")
        for software in vulnerable_installed:
            print("- " + software)
        print("\nPlease take immediate action to mitigate the vulnerability by applying mitigations per vendor instructions or discontinuing use of the product if mitigations are unavailable.\n")
    else:
        print("\nAll clear!\nNone of the vulnerable configurations are installed on your machine.\n")

if __name__ == "__main__":
    print("Verifying vulnerable configurations...")
    check_for_vulnerabilities()