Author: reinke
Date: 2008-10-03 23:16:57 +0200 (Fri, 03 Oct 2008)
New Revision: 1484
Added:
trunk/openvas-plugins/scripts/freebsd_bitlbee.nasl
trunk/openvas-plugins/scripts/freebsd_lighttpd5.nasl
trunk/openvas-plugins/scripts/freebsd_mplayer9.nasl
trunk/openvas-plugins/scripts/freebsd_mysql-client0.nasl
trunk/openvas-plugins/scripts/freebsdsa_nd6.nasl
Modified:
trunk/openvas-plugins/ChangeLog
Log:
New scripts added
Modified: trunk/openvas-plugins/ChangeLog
===================================================================
--- trunk/openvas-plugins/ChangeLog 2008-10-03 13:12:54 UTC (rev 1483)
+++ trunk/openvas-plugins/ChangeLog 2008-10-03 21:16:57 UTC (rev 1484)
@@ -1,3 +1,8 @@
+2008-10-03 Thomas Reinke <[EMAIL PROTECTED]>
+ * script/freebsd_lighttpd5.nasl script/freebsd_mplayer9.nasl
+ script/freebsd_mysql-client0.nasl script/freebsdsa_nd6.nasl
+ Added new plugins
+
2008-10-03 Chandrashekhar B <[EMAIL PROTECTED]>
* scripts/secpod_phpmyadmin_detect_900129.nasl,
scripts/secpod_phpmyadmin_remote_command_exe_vuln_900130.nasl,
Added: trunk/openvas-plugins/scripts/freebsd_bitlbee.nasl
===================================================================
--- trunk/openvas-plugins/scripts/freebsd_bitlbee.nasl 2008-10-03 13:12:54 UTC
(rev 1483)
+++ trunk/openvas-plugins/scripts/freebsd_bitlbee.nasl 2008-10-03 21:16:57 UTC
(rev 1484)
@@ -0,0 +1,92 @@
+#
+#VID 24ec781b-8c11-11dd-9923-0016d325a0ed
+# OpenVAS Vulnerability Test
+# $
+# Description: Auto generated from VID 24ec781b-8c11-11dd-9923-0016d325a0ed
+#
+# Authors:
+# Thomas Reinke <[EMAIL PROTECTED]>
+#
+# Copyright:
+# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com
+# Text descriptions are largely excerpted from the referenced
+# advisories, and are Copyright (c) the respective author(s)
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2,
+# as published by the Free Software Foundation
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+
+if(description)
+{
+ script_id(61680);
+ script_cve_id("CVE-2008-3920", "CVE-2008-3969");
+ script_version ("$");
+ name["english"] = "FreeBSD Ports: bitlbee";
+ script_name(english:name["english"]);
+
+ desc["english"] = "
+The remote host is missing an update to the system
+as announced in the referenced advisory.
+
+The following package is affected: bitlbee
+
+CVE-2008-3920
+Unspecified vulnerability in BitlBee before 1.2.2 allows remote
+attackers to 'recreate' and 'hijack' existing accounts via unspecified
+vectors.
+CVE-2008-3969
+Multiple unspecified vulnerabilities in BitlBee before 1.2.3 allow
+remote attackers to 'overwrite' and 'hijack' existing accounts via
+unknown vectors. NOTE: this issue exists because of an incomplete fix
+for CVE-2008-3920.
+
+Solution:
+Update your system with the appropriate patches or
+software upgrades.
+
+http://secunia.com/advisories/31633/
+http://www.vuxml.org/freebsd/24ec781b-8c11-11dd-9923-0016d325a0ed.html
+
+Risk factor : High";
+
+ script_description(english:desc["english"]);
+
+ summary["english"] = "FreeBSD Ports: bitlbee";
+ script_summary(english:summary["english"]);
+
+ script_category(ACT_GATHER_INFO);
+
+ script_copyright(english:"Copyright (c) 2008 E-Soft Inc.
http://www.securityspace.com";);
+ family["english"] = "FreeBSD Local Security Checks";
+ script_family(english:family["english"]);
+ script_dependencies("gather-package-list.nasl");
+ script_require_keys("ssh/login/freebsdrel");
+ exit(0);
+}
+
+#
+# The script code starts here
+#
+
+include("revisions-lib.inc");
+include("pkg-lib-bsd.inc");
+vuln = 0;
+bver = portver(pkg:"bitlbee");
+if(!isnull(bver) && revcomp(a:bver, b:"1.2.3")<0) {
+ security_note(0, data:"Package bitlbee version " + bver + " is installed
which is known to be vulnerable.");
+ vuln = 1;
+}
+
+if(vuln) {
+ security_hole(0);
+}
Added: trunk/openvas-plugins/scripts/freebsd_lighttpd5.nasl
===================================================================
--- trunk/openvas-plugins/scripts/freebsd_lighttpd5.nasl 2008-10-03
13:12:54 UTC (rev 1483)
+++ trunk/openvas-plugins/scripts/freebsd_lighttpd5.nasl 2008-10-03
21:16:57 UTC (rev 1484)
@@ -0,0 +1,84 @@
+#
+#VID fb911e31-8ceb-11dd-bb29-000c6e274733
+# OpenVAS Vulnerability Test
+# $
+# Description: Auto generated from VID fb911e31-8ceb-11dd-bb29-000c6e274733
+#
+# Authors:
+# Thomas Reinke <[EMAIL PROTECTED]>
+#
+# Copyright:
+# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com
+# Text descriptions are largely excerpted from the referenced
+# advisories, and are Copyright (c) the respective author(s)
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2,
+# as published by the Free Software Foundation
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+
+if(description)
+{
+ script_id(61701);
+ script_bugtraq_id(31434);
+ script_version ("$");
+ name["english"] = "FreeBSD Ports: lighttpd";
+ script_name(english:name["english"]);
+
+ desc["english"] = "
+The remote host is missing an update to the system
+as announced in the referenced advisory.
+
+The following package is affected: lighttpd
+
+Solution:
+Update your system with the appropriate patches or
+software upgrades.
+
+http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt
+http://www.lighttpd.net/security/lighttpd_sa_2008_06.txt
+http://www.lighttpd.net/security/lighttpd_sa_2008_07.txt
+http://www.vuxml.org/freebsd/fb911e31-8ceb-11dd-bb29-000c6e274733.html
+
+Risk factor : High";
+
+ script_description(english:desc["english"]);
+
+ summary["english"] = "FreeBSD Ports: lighttpd";
+ script_summary(english:summary["english"]);
+
+ script_category(ACT_GATHER_INFO);
+
+ script_copyright(english:"Copyright (c) 2008 E-Soft Inc.
http://www.securityspace.com";);
+ family["english"] = "FreeBSD Local Security Checks";
+ script_family(english:family["english"]);
+ script_dependencies("gather-package-list.nasl");
+ script_require_keys("ssh/login/freebsdrel");
+ exit(0);
+}
+
+#
+# The script code starts here
+#
+
+include("revisions-lib.inc");
+include("pkg-lib-bsd.inc");
+vuln = 0;
+bver = portver(pkg:"lighttpd");
+if(!isnull(bver) && revcomp(a:bver, b:"1.4.19_3")<0) {
+ security_note(0, data:"Package lighttpd version " + bver + " is installed
which is known to be vulnerable.");
+ vuln = 1;
+}
+
+if(vuln) {
+ security_hole(0);
+}
Added: trunk/openvas-plugins/scripts/freebsd_mplayer9.nasl
===================================================================
--- trunk/openvas-plugins/scripts/freebsd_mplayer9.nasl 2008-10-03 13:12:54 UTC
(rev 1483)
+++ trunk/openvas-plugins/scripts/freebsd_mplayer9.nasl 2008-10-03 21:16:57 UTC
(rev 1484)
@@ -0,0 +1,119 @@
+#
+#VID 724e6f93-8f2a-11dd-821f-001cc0377035
+# OpenVAS Vulnerability Test
+# $
+# Description: Auto generated from VID 724e6f93-8f2a-11dd-821f-001cc0377035
+#
+# Authors:
+# Thomas Reinke <[EMAIL PROTECTED]>
+#
+# Copyright:
+# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com
+# Text descriptions are largely excerpted from the referenced
+# advisories, and are Copyright (c) the respective author(s)
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2,
+# as published by the Free Software Foundation
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+
+if(description)
+{
+ script_id(61700);
+ script_cve_id("CVE-2008-3827");
+ script_version ("$");
+ name["english"] = "mplayer -- multiple integer overflows";
+ script_name(english:name["english"]);
+
+ desc["english"] = "
+The remote host is missing an update to the system
+as announced in the referenced advisory.
+
+The following packages are affected:
+ mplayer
+ mplayer-esound
+ mplayer-gtk
+ mplayer-gtk2
+ mplayer-gtk-esound
+ mplayer-gtk2-esound
+
+CVE-2008-3827
+Multiple integer underflows in MPlayer 1.0_rc2 and earlier allow
+remote attackers to cause a denial of service (process termination)
+and possibly execute arbitrary code via a crafted video file that
+causes the stream_read function to read or write arbitrary memory.
+
+Solution:
+Update your system with the appropriate patches or
+software upgrades.
+
+http://www.ocert.org/advisories/ocert-2008-013.html
+http://www.vuxml.org/freebsd/724e6f93-8f2a-11dd-821f-001cc0377035.html
+
+Risk factor : High";
+
+ script_description(english:desc["english"]);
+
+ summary["english"] = "mplayer -- multiple integer overflows";
+ script_summary(english:summary["english"]);
+
+ script_category(ACT_GATHER_INFO);
+
+ script_copyright(english:"Copyright (c) 2008 E-Soft Inc.
http://www.securityspace.com";);
+ family["english"] = "FreeBSD Local Security Checks";
+ script_family(english:family["english"]);
+ script_dependencies("gather-package-list.nasl");
+ script_require_keys("ssh/login/freebsdrel");
+ exit(0);
+}
+
+#
+# The script code starts here
+#
+
+include("revisions-lib.inc");
+include("pkg-lib-bsd.inc");
+vuln = 0;
+bver = portver(pkg:"mplayer");
+if(!isnull(bver) && revcomp(a:bver, b:"0.99.11_7")<0) {
+ security_note(0, data:"Package mplayer version " + bver + " is installed
which is known to be vulnerable.");
+ vuln = 1;
+}
+bver = portver(pkg:"mplayer-esound");
+if(!isnull(bver) && revcomp(a:bver, b:"0.99.11_7")<0) {
+ security_note(0, data:"Package mplayer-esound version " + bver + " is
installed which is known to be vulnerable.");
+ vuln = 1;
+}
+bver = portver(pkg:"mplayer-gtk");
+if(!isnull(bver) && revcomp(a:bver, b:"0.99.11_7")<0) {
+ security_note(0, data:"Package mplayer-gtk version " + bver + " is
installed which is known to be vulnerable.");
+ vuln = 1;
+}
+bver = portver(pkg:"mplayer-gtk2");
+if(!isnull(bver) && revcomp(a:bver, b:"0.99.11_7")<0) {
+ security_note(0, data:"Package mplayer-gtk2 version " + bver + " is
installed which is known to be vulnerable.");
+ vuln = 1;
+}
+bver = portver(pkg:"mplayer-gtk-esound");
+if(!isnull(bver) && revcomp(a:bver, b:"0.99.11_7")<0) {
+ security_note(0, data:"Package mplayer-gtk-esound version " + bver + " is
installed which is known to be vulnerable.");
+ vuln = 1;
+}
+bver = portver(pkg:"mplayer-gtk2-esound");
+if(!isnull(bver) && revcomp(a:bver, b:"0.99.11_7")<0) {
+ security_note(0, data:"Package mplayer-gtk2-esound version " + bver + " is
installed which is known to be vulnerable.");
+ vuln = 1;
+}
+
+if(vuln) {
+ security_hole(0);
+}
Added: trunk/openvas-plugins/scripts/freebsd_mysql-client0.nasl
===================================================================
--- trunk/openvas-plugins/scripts/freebsd_mysql-client0.nasl 2008-10-03
13:12:54 UTC (rev 1483)
+++ trunk/openvas-plugins/scripts/freebsd_mysql-client0.nasl 2008-10-03
21:16:57 UTC (rev 1484)
@@ -0,0 +1,82 @@
+#
+#VID 4775c807-8f30-11dd-821f-001cc0377035
+# OpenVAS Vulnerability Test
+# $
+# Description: Auto generated from VID 4775c807-8f30-11dd-821f-001cc0377035
+#
+# Authors:
+# Thomas Reinke <[EMAIL PROTECTED]>
+#
+# Copyright:
+# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com
+# Text descriptions are largely excerpted from the referenced
+# advisories, and are Copyright (c) the respective author(s)
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2,
+# as published by the Free Software Foundation
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+
+if(description)
+{
+ script_id(61699);
+ script_bugtraq_id(31486);
+ script_version ("$");
+ name["english"] = "FreeBSD Ports: mysql-client";
+ script_name(english:name["english"]);
+
+ desc["english"] = "
+The remote host is missing an update to the system
+as announced in the referenced advisory.
+
+The following package is affected: mysql-client
+
+Solution:
+Update your system with the appropriate patches or
+software upgrades.
+
+http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability/
+http://www.vuxml.org/freebsd/4775c807-8f30-11dd-821f-001cc0377035.html
+
+Risk factor : High";
+
+ script_description(english:desc["english"]);
+
+ summary["english"] = "FreeBSD Ports: mysql-client";
+ script_summary(english:summary["english"]);
+
+ script_category(ACT_GATHER_INFO);
+
+ script_copyright(english:"Copyright (c) 2008 E-Soft Inc.
http://www.securityspace.com";);
+ family["english"] = "FreeBSD Local Security Checks";
+ script_family(english:family["english"]);
+ script_dependencies("gather-package-list.nasl");
+ script_require_keys("ssh/login/freebsdrel");
+ exit(0);
+}
+
+#
+# The script code starts here
+#
+
+include("revisions-lib.inc");
+include("pkg-lib-bsd.inc");
+vuln = 0;
+bver = portver(pkg:"mysql-client");
+if(!isnull(bver) && revcomp(a:bver, b:"0")>0) {
+ security_note(0, data:"Package mysql-client version " + bver + " is
installed which is known to be vulnerable.");
+ vuln = 1;
+}
+
+if(vuln) {
+ security_hole(0);
+}
Added: trunk/openvas-plugins/scripts/freebsdsa_nd6.nasl
===================================================================
--- trunk/openvas-plugins/scripts/freebsdsa_nd6.nasl 2008-10-03 13:12:54 UTC
(rev 1483)
+++ trunk/openvas-plugins/scripts/freebsdsa_nd6.nasl 2008-10-03 21:16:57 UTC
(rev 1484)
@@ -0,0 +1,90 @@
+#
+#ADV FreeBSD-SA-08:10.nd6.asc
+# OpenVAS Vulnerability Test
+# $
+# Description: Auto generated from ADV FreeBSD-SA-08:10.nd6.asc
+#
+# Authors:
+# Thomas Reinke <[EMAIL PROTECTED]>
+#
+# Copyright:
+# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com
+# Text descriptions are largely excerpted from the referenced
+# advisories, and are Copyright (c) the respective author(s)
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2,
+# as published by the Free Software Foundation
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+
+if(description)
+{
+ script_id(61702);
+ script_cve_id("CVE-2008-2476");
+ script_version ("$");
+ name["english"] = "FreeBSD Security Advisory (FreeBSD-SA-08:10.nd6.asc)";
+ script_name(english:name["english"]);
+
+ desc["english"] = "
+The remote host is missing an update to the system
+as announced in the referenced advisory FreeBSD-SA-08:10.nd6.asc
+
+IPv6 nodes use the Neighbor Discovery protocol to determine the link-layer
+address of other nodes, find routers, and maintain reachability information.
+The Neighbor Discovery protocol uses Neighbor Solicitation (ICMPv6 type 135)
+to query target nodes for their link-layer addresses.
+
+IPv6 routers may allow on-link IPv6 nodes to create and update the
+router's neighbor cache and forwarding information. A malicious IPv6 node
+sharing a common router but on a different physical segment from another
+node may be able to spoof Neighbor Discovery messages, allowing it to update
+router information for the victim node.
+
+Solution:
+Upgrade your system to the appropriate stable release
+or security branch dated after the correction date
+
+https://secure1.securityspace.com/smysecure/catid.html?in=FreeBSD-SA-08:10.nd6.asc
+Risk factor : High";
+
+ script_description(english:desc["english"]);
+
+ summary["english"] = "FreeBSD Security Advisory (FreeBSD-SA-08:10.nd6.asc)";
+ script_summary(english:summary["english"]);
+
+ script_category(ACT_GATHER_INFO);
+
+ script_copyright(english:"Copyright (c) 2008 E-Soft Inc.
http://www.securityspace.com";);
+ family["english"] = "FreeBSD Local Security Checks";
+ script_family(english:family["english"]);
+ script_dependencies("gather-package-list.nasl");
+ script_require_keys("ssh/login/freebsdpatchlevel");
+ exit(0);
+}
+
+#
+# The script code starts here
+#
+
+include("revisions-lib.inc");
+include("pkg-lib-bsd.inc");
+vuln = 0;
+if(patchlevelcmp(rel:"7.0", patchlevel:"5")<0) {
+ vuln = 1;
+}
+if(patchlevelcmp(rel:"6.3", patchlevel:"5")<0) {
+ vuln = 1;
+}
+
+if(vuln) {
+ security_hole(0);
+}
_______________________________________________
Openvas-commits mailing list
[email protected]
http://lists.wald.intevation.org/mailman/listinfo/openvas-commits
