On Wed, Dec 26, 2001 at 11:39:31PM -0500, Thomas Reinke wrote:
> Remote SSH version : ssh-1.5-openssh_2.5.2p2
>
> Does anyone know if an SSH server returning the sig above
> is vulnerable to the series of problems with OpenSSH reported
> by various scripts, including:
>
>
> openssh_adv_option.nasl
> openssh_301.nasl
> It seems that these nasl scripts test the banner in such a way
> as to not report the server vulnerable...but it appears that
> it might very well be.
Good catch. Fix is below.
-- Renaud
Index: openssh_adv_option.nasl
===================================================================
RCS file: /usr/local/cvs/nessus-plugins/scripts/openssh_adv_option.nasl,v
retrieving revision 1.5
diff -r1.5 openssh_adv_option.nasl
65a66,67
>
>
79d80
< b = banner - string("\r\n");
80a82
> banner = tolower(banner);
82c84
< if(ereg(pattern:".*[oO]penSSH.*2\.(([5-8]\..*)|(9\.[0-8])).*",
---
> if(ereg(pattern:".*openssh.*2\.(([5-8]\..*)|(9\.[0-8])).*",
Index: openssh_301.nasl
===================================================================
RCS file: /usr/local/cvs/nessus-plugins/scripts/openssh_301.nasl,v
retrieving revision 1.5
diff -r1.5 openssh_301.nasl
81,82c81,82
< b = banner - string("\r\n");
<
---
> if(string("\r\n") >< banner)
> banner = banner - string("\r\n");
83a84
> banner = tolower(banner);
86c87
< if(ereg(pattern:"openssh[-_](1\..*|2\..*|3\.0[^\.])[^0-9]*", string:banner))
---
> if(ereg(pattern:".*openssh[-_]((1\..*)|(2\..*)|(3\.0[^\.]))[^0-9]*", string:banner))
