Author: chandra
Date: 2008-10-03 15:12:54 +0200 (Fri, 03 Oct 2008)
New Revision: 1483
Added:
trunk/openvas-plugins/scripts/secpod_phpmyadmin_detect_900129.nasl
trunk/openvas-plugins/scripts/secpod_phpmyadmin_remote_command_exe_vuln_900130.nasl
trunk/openvas-plugins/scripts/secpod_phpmyadmin_xss_vuln_900134.nasl
Modified:
trunk/openvas-plugins/ChangeLog
trunk/openvas-plugins/scripts/gb_ms08-033.nasl
Log:
Added new plugins
Modified: trunk/openvas-plugins/ChangeLog
===================================================================
--- trunk/openvas-plugins/ChangeLog 2008-10-02 12:48:32 UTC (rev 1482)
+++ trunk/openvas-plugins/ChangeLog 2008-10-03 13:12:54 UTC (rev 1483)
@@ -1,3 +1,12 @@
+2008-10-03 Chandrashekhar B <[EMAIL PROTECTED]>
+ * scripts/secpod_phpmyadmin_detect_900129.nasl,
+ scripts/secpod_phpmyadmin_remote_command_exe_vuln_900130.nasl,
+ scripts/secpod_phpmyadmin_xss_vuln_900134.nasl:
+ Added new plugins
+
+ * scripts/gb_ms08-033.nasl:
+ Updated the regex
+
2008-10-01 Chandrashekhar B <[EMAIL PROTECTED]>
* scripts/gb_adobe_prdts_code_exec_vuln_win.nasl,
scripts/gb_openoffice_rtl_allocatememory_bof_vuln_lin.nasl,
Modified: trunk/openvas-plugins/scripts/gb_ms08-033.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_ms08-033.nasl 2008-10-02 12:48:32 UTC
(rev 1482)
+++ trunk/openvas-plugins/scripts/gb_ms08-033.nasl 2008-10-03 13:12:54 UTC
(rev 1483)
@@ -192,7 +192,7 @@
else if(egrep(pattern:"^4\.09", string:directXver))
{
# Grep Quartz.dll version < 6.5.1.909
- if(egrep(pattern:"^6\.05\.01\.0?([0-8]?[0-9]?[0-9]|90[0-8])$",
+ if(egrep(pattern:"^6\.05\.0?1\.0?([0-8]?[0-9]?[0-9]|90[0-8])$",
string:fileVer)){
security_hole(0);
}
Added: trunk/openvas-plugins/scripts/secpod_phpmyadmin_detect_900129.nasl
===================================================================
--- trunk/openvas-plugins/scripts/secpod_phpmyadmin_detect_900129.nasl
2008-10-02 12:48:32 UTC (rev 1482)
+++ trunk/openvas-plugins/scripts/secpod_phpmyadmin_detect_900129.nasl
2008-10-03 13:12:54 UTC (rev 1483)
@@ -0,0 +1,72 @@
+##############################################################################
+#
+# phpMyAdmin Version Detection
+#
+# Copyright: SecPod
+#
+# Date Written: 2008/09/23
+#
+# Revision: 1.1
+#
+# Log: ssharath
+# Issue #0252
+# ------------------------------------------------------------------------
+# This program was written by SecPod and is licensed under the GNU GPL
+# license. Please refer to the below link for details,
+# http://www.gnu.org/licenses/gpl.html
+# This header contains information regarding licensing terms under the GPL,
+# and information regarding obtaining source code from the Author.
+# Consequently, pursuant to section 3(c) of the GPL, you must accompany the
+# information found in this header with any distribution you make of this
+# Program.
+# ------------------------------------------------------------------------
+##############################################################################
+
+if(description)
+{
+ script_id(900129);
+ script_copyright(english:"Copyright (C) 2008 SecPod");
+ script_version("Revision: 1.1 ");
+ script_category(ACT_GATHER_INFO);
+ script_family(english:"General");
+ script_name(english:"phpMyAdmin Version Detection");
+ script_summary(english:"Set File Version of phpMyAdmin in KB");
+ desc["english"] = "
+ Overview : This script finds the phpMyAdmin installed version and
+ saves the version in KB.
+
+ Risk factor : Informational";
+
+ script_description(english:desc["english"]);
+ script_dependencies("http_version.nasl");
+ script_require_ports("Services/www", 80);
+ exit(0);
+}
+
+
+ include("http_func.inc");
+ include("http_keepalive.inc");
+
+ port = get_http_port(default:80);
+ if(!port){
+ exit(0);
+ }
+
+ foreach dir (make_list("/phpmyadmin", cgi_dirs()))
+ {
+ sndReq = http_get(item:string(dir, "/index.php"), port:port);
+ rcvRes = http_keepalive_send_recv(port:port, data:sndReq);
+ if(rcvRes == NULL){
+ exit(0);
+ }
+
+ if(egrep(pattern:"^HTTP/.* 200 OK", string:rcvRes))
+ {
+ phpmaVer = egrep(pattern:"phpMyAdmin [0-9.]+", string:rcvRes);
+ phpmaVer = eregmatch(pattern:"[0-9.]+", string:phpmaVer);
+ if(phpmaVer != NULL){
+ set_kb_item(name:"www/"+ port + "/phpMyAdmin",
+ value:phpmaVer[0] + " under " + dir);
+ }
+ }
+ }
Added:
trunk/openvas-plugins/scripts/secpod_phpmyadmin_remote_command_exe_vuln_900130.nasl
===================================================================
---
trunk/openvas-plugins/scripts/secpod_phpmyadmin_remote_command_exe_vuln_900130.nasl
2008-10-02 12:48:32 UTC (rev 1482)
+++
trunk/openvas-plugins/scripts/secpod_phpmyadmin_remote_command_exe_vuln_900130.nasl
2008-10-03 13:12:54 UTC (rev 1483)
@@ -0,0 +1,77 @@
+##############################################################################
+#
+# phpMyAdmin 'server_databases.php' Remote Command Execution Vulnerability
+#
+# Copyright: SecPod
+#
+# Date Written: 2008/09/17
+#
+# Revision: 1.1
+#
+# Log: ssharath
+# Issue #0252
+# ------------------------------------------------------------------------
+# This program was written by SecPod and is licensed under the GNU GPL
+# license. Please refer to the below link for details,
+# http://www.gnu.org/licenses/gpl.html
+# This header contains information regarding licensing terms under the GPL,
+# and information regarding obtaining source code from the Author.
+# Consequently, pursuant to section 3(c) of the GPL, you must accompany the
+# information found in this header with any distribution you make of this
+# Program.
+# ------------------------------------------------------------------------
+##############################################################################
+
+
+if(description)
+{
+ script_id(900130);
+ script_bugtraq_id(31188);
+ script_copyright(english:"Copyright (C) 2008 SecPod");
+ script_version("Revision: 1.1 ");
+ script_category(ACT_GATHER_INFO);
+ script_family(english:"CGI abuses");
+ script_name(english:"phpMyAdmin 'server_databases.php' Remote Command
Execution Vulnerability");
+ script_summary(english:"Check for vulnerable version of phpMyAdmin");
+ desc["english"] = "
+ Overview : phpMyAdmin is prone to Remote Command Execution vulnerability.
+
+ Vulnerability Insight :
+
+ This issue is caused by, sort_by parameter in server_databases.php
+ which is not properly sanitised before being used.
+
+ Impact : Successful exploitation allows execution of arbitrary
+ commands, and possibly compromise the affected application.
+
+ Impact Level : Application
+
+ Affected Software/OS :
+ phpMyAdmin versions prior to 2.11.9.1 on all platform
+
+ Fix : Upgrade to phpMyAdmin 2.11.9.1 or newer
+ http://www.phpmyadmin.net/home_page/downloads.php#2.11.9.1
+
+ References :
+ http://comments.gmane.org/gmane.comp.security.oss.general/947?set_lines=100000
+ http://fd.the-wildcat.de/pma_e36a091q11.php
+ http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7
+ http://www.securityfocus.com/bid/31188/exploit
+
+ CVSS Score :
+ CVSS Base Score : 6.0 (AV:N/AC:M/Au:SI/C:P/I:P/A:P)
+ CVSS Temporal Score : 4.7
+ Risk factor : Medium";
+
+ script_description(english:desc["english"]);
+ script_dependencies("secpod_phpmyadmin_detect_900129.nasl");
+ exit(0);
+}
+
+
+ include("http_func.inc");
+
+ if(egrep(pattern:"^([01]\..*|2\.(([0-9]|10)(\..*)|11\.([0-8](\..*)?|9\.0)))",
+ string:get_kb_item("www/" + port + "/phpMyAdmin"))){
+ security_hole(0);
+ }
Added: trunk/openvas-plugins/scripts/secpod_phpmyadmin_xss_vuln_900134.nasl
===================================================================
--- trunk/openvas-plugins/scripts/secpod_phpmyadmin_xss_vuln_900134.nasl
2008-10-02 12:48:32 UTC (rev 1482)
+++ trunk/openvas-plugins/scripts/secpod_phpmyadmin_xss_vuln_900134.nasl
2008-10-03 13:12:54 UTC (rev 1483)
@@ -0,0 +1,82 @@
+##############################################################################
+#
+# phpMyAdmin Cross-Site Scripting Vulnerability
+#
+# Copyright: SecPod
+#
+# Date Written: 2008/09/24
+#
+# Revision: 1.1
+#
+# Log: ssharath
+# Issue #0282
+# ------------------------------------------------------------------------
+# This program was written by SecPod and is licensed under the GNU GPL
+# license. Please refer to the below link for details,
+# http://www.gnu.org/licenses/gpl.html
+# This header contains information regarding licensing terms under the GPL,
+# and information regarding obtaining source code from the Author.
+# Consequently, pursuant to section 3(c) of the GPL, you must accompany the
+# information found in this header with any distribution you make of this
+# Program.
+# ------------------------------------------------------------------------
+##############################################################################
+
+
+if(description)
+{
+ script_id(900134);
+ script_bugtraq_id(31327);
+ script_copyright(english:"Copyright (C) 2008 SecPod");
+ script_version("Revision: 1.1 ");
+ script_category(ACT_GATHER_INFO);
+ script_family(english:"CGI abuses : XSS");
+ script_name(english:"phpMyAdmin Cross-Site Scripting Vulnerability");
+ script_summary(english:"Check for vulnerable version of phpMyAdmin");
+ desc["english"] = "
+ Overview : The host is running phpMyAdmin, which is prone to Cross-Site
+ Scripting Vulnerability.
+
+ Vulnerability Insight :
+
+ Error exists in the PMA_escapeJsString() function in js_escape.lib.php
+ file, which fails to sufficiently sanitize user-supplied data.
+
+ Impact : Execution of arbitrary HTML and script code will allow
attackers
+ to steal cookie-based authentication credentials and to launch other
+ attacks.
+
+ Impact Level : Application
+
+ Affected Software/OS :
+ phpMyAdmin versions prior to 2.11.9.2 on all platform
+
+ Fix : Update to version 2.11.9.2
+ http://www.phpmyadmin.net/home_page/downloads.php
+
+ *****
+ NOTE : Ignore this warning, if above mentioned Update is applied already.
+ *****
+
+ References :
+ http://www.phpmyadmin.net/home_page/downloads.php?relnotes=1
+ http://secunia.com/advisories/31974/
+ http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-8
+
+ CVSS Score :
+ CVSS Base Score : 7.9 (AV:N/AC:M/Au:SI/C:C/I:C/A:N)
+ CVSS Temporal Score : 5.9
+ Risk factor : High";
+
+ script_description(english:desc["english"]);
+ script_dependencies("secpod_phpmyadmin_detect_900129.nasl");
+ exit(0);
+}
+
+
+ include("http_func.inc");
+
+ if(egrep(pattern:"^2\.(([0-9]|10)(\..*)|11(\.[0-8](\..*)?|\.9(\.[01])))",
+ string:get_kb_item("www/" + port + "/phpMyAdmin"))){
+ security_hole(port:port);
+ }
_______________________________________________
Openvas-commits mailing list
[email protected]
http://lists.wald.intevation.org/mailman/listinfo/openvas-commits
