On Thu, Jul 22, 2004 at 05:58:30PM +0200, Pavel Kankovsky wrote:
> The attacker compromising www.nessus.org (or hijacking the connection
> between the victim and the web server) could do many interesting things.
> For instance, it might be possible to replace a harmless (and enabled
> in most installations) plugin with the newest 0-day exploit. Or to add
> a cuckoo egg file (something like ../../../../../../../etc/passwd) to the
> plugin tarball.
Most recent versions of tar should not be vulnerable to that attack (as
far as I know), but your statement is correct. However this problem is
viewed as being less sensitive than execute commands against a host for
which the user gave privileges.
> Have you considered signing the complete tarball as
> well?
Yes, and we will eventually get there - probably in Nessus 2.1.2. The main
problem at this time is not really the implementation but rather the
infrastructure change which is required on my side (ie: we don't want
the key to be on www.nessus.org, as it would defeat the whole purpose,
so I need to set up a dedicated system on which the archive will be
signed then uploaded to www.nessus.org).
> > I have also enabled the functions pread() and find_in_path(), which
> > also only run if the script has been signed, which allow nasl scripts
> > to execute local commands. We intend to use them in the future to get
> > rid of most of the remaining .nes plugins.
>
> I thought the plan was to put trusted scripts into a separate directory
> rather than mix them with ordinary "untrusted" scripts. Is it still true
> (with an extra layer of protection provided by signatures) or not?
It's not true any more - the fact is that these scripts will need to be
updated over time as well. Having a separate directory means more
maintenance headaches both from my point of view and the one of the
users.
-- Renaud
_______________________________________________
Nessus mailing list
[EMAIL PROTECTED]
http://mail.nessus.org/mailman/listinfo/nessus
