Retina finds the Xexcg50 vulnerability on a host I'm working on but Nessus
does not. Below is the results from testing the NASL manually. The Nessus
plugin contains the string "^354 Send Binary Data". The actual grab is
"354 Send Binary Data". The "carrot" is the difference. Is this a fat
finger in the Nessus plugin? I need to find out what tool is correct...
Retina or Nessus. Thanks.
>From Nessus Plugin: 11889
if(debug) display("HELO: ", ok, "\n");
if("XEXCH50" >!< ok)exit(0);
send(socket:soc, data:string("MAIL FROM: Administrator\r\n"));
ok = smtp_recv_line(socket:soc);
if (! ok) exit(0);
if(debug) display("MAIL: ", ok, "\n");
send(socket:soc, data:string("RCPT TO: Administrator\r\n"));
ok = smtp_recv_line(socket:soc);
if (! ok) exit(0);
if(debug) display("RCPT: ", ok, "\n");
send(socket:soc, data:string("XEXCH50 2 2\r\n"));
ok = smtp_recv_line(socket:soc);
if (! ok) exit(0);
if(debug) display("XEXCH50: ", ok, "\n");
if (egrep(string:ok, pattern:"^354 Send binary")) security_hole(port:port);
Data collected:
linux:~ # telnet 123.123.123.123 25
Trying 123.123.123.123...
Connected to 123.123.123.123.
Escape character is '^]'.
220 wxyz1.abcd.LOCAL Microsoft ESMTP MAIL Service, Version: 5.0.2195.6713
ready at Mon, 22 May 2006 12:03:30 -0400
helo
250 wxyz1.abcd.LOCAL Hello [11.22.33.44]
mail from: administrator
250 2.1.0 [EMAIL PROTECTED] OK
rcpt to: administrator
250 2.1.5 [EMAIL PROTECTED]
xexch50 2 2
354 Send binary data
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
_______________________________________________
Nessus mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus
