On Wed, 21 Jul 2004, Renaud Deraison wrote: > I will elaborate on that last item : several persons (legitimately) > expressed concern over the new local security checks in Nessus 2.1, > since they can execute arbitrary commands on the remote hosts : if > www.nessus.org were to be compromised, then you do not want an attacker > to modify ssh_get_info.nasl to execute 'shutdown -h now' instead of > 'rpm -qa'.
The attacker compromising www.nessus.org (or hijacking the connection between the victim and the web server) could do many interesting things. For instance, it might be possible to replace a harmless (and enabled in most installations) plugin with the newest 0-day exploit. Or to add a cuckoo egg file (something like ../../../../../../../etc/passwd) to the plugin tarball. Have you considered signing the complete tarball as well? > I have also enabled the functions pread() and find_in_path(), which > also only run if the script has been signed, which allow nasl scripts > to execute local commands. We intend to use them in the future to get > rid of most of the remaining .nes plugins. I thought the plan was to put trusted scripts into a separate directory rather than mix them with ordinary "untrusted" scripts. Is it still true (with an extra layer of protection provided by signatures) or not? --Pavel Kankovsky aka Peak [ Boycott Microsoft--http://www.vcnet.com/bms ] "Resistance is futile. Open your source code and prepare for assimilation." _______________________________________________ Nessus mailing list [EMAIL PROTECTED] http://mail.nessus.org/mailman/listinfo/nessus
