Author: chandra
Date: 2008-10-17 14:35:03 +0200 (Fri, 17 Oct 2008)
New Revision: 1568
Added:
trunk/openvas-plugins/scripts/gb_dovecot_mult_sec_bypass_vuln.nasl
trunk/openvas-plugins/scripts/gb_firefox_url_file_info_dis_vuln.nasl
trunk/openvas-plugins/scripts/gb_vlc_media_player_mem_crptn_vuln_lin.nasl
trunk/openvas-plugins/scripts/gb_vlc_media_player_mem_crptn_vuln_win.nasl
Modified:
trunk/openvas-plugins/ChangeLog
Log:
Added new plugins
Modified: trunk/openvas-plugins/ChangeLog
===================================================================
--- trunk/openvas-plugins/ChangeLog 2008-10-17 12:33:50 UTC (rev 1567)
+++ trunk/openvas-plugins/ChangeLog 2008-10-17 12:35:03 UTC (rev 1568)
@@ -1,3 +1,10 @@
+2008-10-17 Chandrashekhar B <[EMAIL PROTECTED]>
+ * scripts/gb_firefox_url_file_info_dis_vuln.nasl,
+ scripts/gb_dovecot_mult_sec_bypass_vuln.nasl,
+ scripts/gb_vlc_media_player_mem_crptn_vuln_lin.nasl,
+ scripts/gb_vlc_media_player_mem_crptn_vuln_win.nasl:
+ Added new plugins
+
2008-10-17 Vlatko Kosturjak <[EMAIL PROTECTED]>
* scripts/find_service2.nasl: fixed subversion detection
Added: trunk/openvas-plugins/scripts/gb_dovecot_mult_sec_bypass_vuln.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_dovecot_mult_sec_bypass_vuln.nasl
2008-10-17 12:33:50 UTC (rev 1567)
+++ trunk/openvas-plugins/scripts/gb_dovecot_mult_sec_bypass_vuln.nasl
2008-10-17 12:35:03 UTC (rev 1568)
@@ -0,0 +1,96 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: gb_dovecot_mult_sec_bypass_vuln.nasl 344 2008-10-17 11:17:55Z oct $
+#
+# Dovecot ACL Plugin Security Bypass Vulnerabilities
+#
+# Authors:
+# Chandan S <[EMAIL PROTECTED]>
+#
+# Copyright:
+# Copyright (c) 2008 Intevation GmbH, http://www.intevation.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+
+if(description)
+{
+ script_id(800030);
+ script_version("$Revision: 1.0 $");
+ script_cve_id("CVE-2008-4577", "CVE-2008-4578");
+ script_bugtraq_id(31587);
+ script_name(english:"Dovecot ACL Plugin Security Bypass Vulnerabilities");
+ desc["english"] = "
+ Overview: This host has Dovecot ACL Plugin installed and is prone to
+ multiple security bypass vulnerabilities.
+
+ Vulnerability Insight:
+ The flaws are due to,
+ - the ACL plugin interprets negative access rights as positive access rights,
+ potentially giving an unprivileged user access to restricted resources.
+ - an error in the ACL plugin when imposing mailbox creation restrictions to
+ to create parent/child/child mailboxes.
+
+ Impact: Successful attack could allow malicious people to bypass certain
+ security restrictions or manipulate certain data.
+
+ Impact Level: Application
+
+ Affected Software/OS:
+ Dovecot versions prior to 1.1.4 on Linux
+
+ Fix: Upgrade to Dovecot version 1.1.4
+ http://www.dovecot.org/download.html
+
+ References:
+ http://www.frsirt.com/english/advisories/2008/2745
+ http://www.dovecot.org/list/dovecot-news/2008-October/000085.html
+
+ CVSS Score:
+ CVSS Base Score : 5.8 (AV:N/AC:M/Au:NR/C:P/I:P/A:N)
+ CVSS Temporal Score : 4.3
+ Risk factor : Medium";
+
+ script_description(english:desc["english"]);
+ script_summary(english:"Check for the version of Dovecot");
+ script_category(ACT_GATHER_INFO);
+ script_copyright(english:"Copyright (C) 2008 Intevation GmbH");
+ script_family(english:"Misc.");
+ exit(0);
+}
+
+
+include("version_func.inc");
+
+sock = ssh_login_or_reuse_connection();
+if(!sock){
+ exit(0);
+}
+
+getPath = find_bin(prog_name:"dovecot", sock:sock);
+foreach binary_File (getPath)
+{
+ doveVer = get_bin_version(full_prog_name:chomp(binary_File),
version_argv:"--version",
+ ver_pattern:"[0-9.]+", sock:sock);
+ if(doveVer)
+ {
+ if(version_is_less(version:doveVer[0], test_version:"1.1.4")){
+ security_warning(0);
+ }
+ ssh_close_connection();
+ exit(0);
+ }
+}
+ssh_close_connection();
Added: trunk/openvas-plugins/scripts/gb_firefox_url_file_info_dis_vuln.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_firefox_url_file_info_dis_vuln.nasl
2008-10-17 12:33:50 UTC (rev 1567)
+++ trunk/openvas-plugins/scripts/gb_firefox_url_file_info_dis_vuln.nasl
2008-10-17 12:35:03 UTC (rev 1568)
@@ -0,0 +1,78 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: gb_firefox_url_file_info_dis_vuln.nasl 342 2008-10-17 12:47:33Z oct $
+#
+# Firefox .url Shortcut File Information Disclosure Vulnerability
+#
+# Authors:
+# Chandan S <[EMAIL PROTECTED]>
+#
+# Copyright:
+# Copyright (c) 2008 Intevation GmbH, http://www.intevation.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+ script_id(800031);
+ script_version("$Revision: 1.0 $");
+ script_cve_id("CVE-2008-4582");
+ script_bugtraq_id(31747);
+ script_name(english:"Firefox .url Shortcut File Information Disclosure
Vulnerability");
+ desc["english"] = "
+
+ Overview: The host is installed with Mozilla Firefox browser, that is prone
+ to information disclosure vulnerability.
+
+ Vulnerability Insight:
+ Issue is caused due an error when processing .url shortcuts in HTML elements.
+
+ Impact: Successful remote exploitation could result in disclosure of
sensitive
+ information from the cache.
+
+ Impact Level: System
+
+ Affected Software/OS:
+ Firefox version 3.0.1 to 3.0.3 on Windows.
+
+ Fix: No solution/patch is available as on 17th October, 2008. Information
+ regarding this issue will be updated once the solution details are available.
+
+ References:
+ http://liudieyu0.blog124.fc2.com/blog-entry-6.html
+ http://www.securityfocus.com/archive/1/archive/1/497091/100/0/threaded
+
+ CVSS Score:
+ CVSS Base Score : 4.3 (AV:N/AC:M/Au:NR/C:P/I:N/A:N)
+ CVSS Temporal Score : 3.9
+ Risk factor : Medium";
+
+ script_description(english:desc["english"]);
+ script_summary(english:"Check for the version of Firefox");
+ script_category(ACT_GATHER_INFO);
+ script_copyright(english:"Copyright (C) 2008 Intevation GmbH");
+ script_family(english:"Misc.");
+ script_dependencies("gb_firefox_detect_win.nasl");
+ exit(0);
+}
+
+
+include("version_func.inc");
+
+# Grep for firefox version 3.0.1 to 3.0.3
+if(version_in_range(version:get_kb_item("Firefox/Win/Ver"),
+ test_version:"3.0.1", test_version2:"3.0.3")){
+ security_warning(0);
+}
Property changes on:
trunk/openvas-plugins/scripts/gb_firefox_url_file_info_dis_vuln.nasl
___________________________________________________________________
Name: svn:executable
+ *
Added: trunk/openvas-plugins/scripts/gb_vlc_media_player_mem_crptn_vuln_lin.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_vlc_media_player_mem_crptn_vuln_lin.nasl
2008-10-17 12:33:50 UTC (rev 1567)
+++ trunk/openvas-plugins/scripts/gb_vlc_media_player_mem_crptn_vuln_lin.nasl
2008-10-17 12:35:03 UTC (rev 1568)
@@ -0,0 +1,98 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: gb_vlc_media_player_mem_crptn_vuln_lin.nasl 0341 2008-10-17 11:09:50Z
oct $
+#
+# VLC Media Player XSPF Playlist Memory Corruption Vulnerability (Linux)
+#
+# Authors:
+# Veerendra GG <[EMAIL PROTECTED]>
+#
+# Copyright:
+# Copyright (c) 2008 Intevation GmbH, http://www.intevation.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+ script_id(800113);
+ script_version("$Revision: 1.0 $");
+ script_cve_id("CVE-2008-4558");
+ script_bugtraq_id(31758);
+ script_name(english:"VLC Media Player XSPF Playlist Memory Corruption
Vulnerability (Linux)");
+ desc["english"] = "
+
+ Overview: This host is installed with VLC Media Player and is prone to
+ Memory Corruption Vulnerability.
+
+ Vulnerability Insight:
+ The flaw exists due to VLC (xspf.c) library does not properly perform bounds
+ checking on an identifier tag from an XSPF file before using it to index an
+ array on the heap.
+
+ Impact: Successful exploitation allows attackers to execute arbitrary code by
+ tricking a user into opening a specially crafted XSPF file or even can crash
+ an affected application.
+
+ Impact Level: Application
+
+ Affected Software/OS:
+ VLC media player 0.9.2 and prior Linux.
+
+ Fix: Upgrade to Version 0.9.3 or later,
+ http://www.videolan.org/vlc/
+
+ References:
+ http://secunia.com/advisories/32267/
+ http://www.frsirt.com/english/advisories/2008/2826/products
+ http://www.coresecurity.com/content/vlc-xspf-memory-corruption
+
+ CVSS Score:
+ CVSS Base Score : 8.3 (AV:N/AC:M/Au:NR/C:P/I:P/A:C)
+ CVSS Temporal Score : 6.5
+ Risk factor: High";
+
+ script_description(english:desc["english"]);
+ script_summary(english:"Check for the Version of VLC Media Player");
+ script_category(ACT_GATHER_INFO);
+ script_copyright(english:"Copyright (C) 2008 Intevation GmbH");
+ script_family(english:"Denial of Service");
+ exit(0);
+}
+
+
+include("version_func.inc");
+
+sock = ssh_login_or_reuse_connection();
+if(!sock){
+ exit(0);
+}
+
+vlcBinPath = find_bin(prog_name:"vlc", sock:sock);
+
+foreach binPath (vlcBinPath)
+{
+ vlcVer = get_bin_version(full_prog_name:chomp(binPath),
version_argv:"--version",
+ ver_pattern:"VLC version ([0-9.]+[a-z]?)",
sock:sock);
+ if(vlcVer)
+ {
+ # Check for VLC Media Player Version <= 0.9.2
+ if(version_is_less_equal(version:vlcVer[1] ,test_version:"0.9.2")){
+ security_hole(0);
+ }
+ ssh_close_connection();
+ exit(0);
+ }
+}
+ssh_close_connection();
Property changes on:
trunk/openvas-plugins/scripts/gb_vlc_media_player_mem_crptn_vuln_lin.nasl
___________________________________________________________________
Name: svn:executable
+ *
Added: trunk/openvas-plugins/scripts/gb_vlc_media_player_mem_crptn_vuln_win.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_vlc_media_player_mem_crptn_vuln_win.nasl
2008-10-17 12:33:50 UTC (rev 1567)
+++ trunk/openvas-plugins/scripts/gb_vlc_media_player_mem_crptn_vuln_win.nasl
2008-10-17 12:35:03 UTC (rev 1568)
@@ -0,0 +1,92 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: gb_vlc_media_player_mem_crptn_vuln_win.nasl 0341 2008-10-17 11:09:50Z
oct $
+#
+# VLC Media Player XSPF Playlist Memory Corruption Vulnerability (Win)
+#
+# Authors:
+# Veerendra GG <[EMAIL PROTECTED]>
+#
+# Copyright:
+# Copyright (c) 2008 Intevation GmbH, http://www.intevation.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+ script_id(800112);
+ script_version("$Revision: 1.0 $");
+ script_cve_id("CVE-2008-4558");
+ script_bugtraq_id(31758);
+ script_name(english:"VLC Media Player XSPF Playlist Memory Corruption
Vulnerability (Win)");
+ desc["english"] = "
+
+ Overview: This host is installed with VLC Media Player and is prone to
+ Memory Corruption Vulnerability.
+
+ Vulnerability Insight:
+ The flaw exists due to VLC (xspf.c) library does not properly perform bounds
+ checking on an identifier tag from an XSPF file before using it to index an
+ array on the heap.
+
+ Impact: Successful exploitation allows attackers to execute arbitrary code by
+ tricking a user into opening a specially crafted XSPF file or even can crash
+ an affected application.
+
+ Impact Level: Application
+
+ Affected Software/OS:
+ VLC media player 0.9.2 and prior Windows (Any).
+
+ Fix: Upgrade to Version 0.9.3 or later,
+ http://www.videolan.org/vlc/
+
+ References:
+ http://secunia.com/advisories/32267/
+ http://www.frsirt.com/english/advisories/2008/2826/products
+ http://www.coresecurity.com/content/vlc-xspf-memory-corruption
+
+ CVSS Score:
+ CVSS Base Score : 8.3 (AV:N/AC:M/Au:NR/C:P/I:P/A:C)
+ CVSS Temporal Score : 6.5
+ Risk factor: High";
+
+ script_description(english:desc["english"]);
+ script_summary(english:"Check for the Version of VLC Media Player");
+ script_category(ACT_GATHER_INFO);
+ script_copyright(english:"Copyright (C) 2008 Intevation GmbH");
+ script_family(english:"Denial of Service");
+ script_dependencies("secpod_reg_enum.nasl");
+ script_require_keys("SMB/WindowsVersion");
+ exit(0);
+}
+
+
+include("smb_nt.inc");
+include("version_func.inc");
+
+if(!get_kb_item("SMB/WindowsVersion")){
+ exit(0);
+}
+
+vlcVer = registry_get_sz(item:"Version", key:"SOFTWARE\VideoLAN\VLC");
+if(!vlcVer){
+ exit(0);
+}
+
+# Check for VLC Media Player Version <= 0.9.2
+if(version_is_less_equal(version:vlcVer, test_version:"0.9.2")){
+ security_hole(0);
+}
Property changes on:
trunk/openvas-plugins/scripts/gb_vlc_media_player_mem_crptn_vuln_win.nasl
___________________________________________________________________
Name: svn:executable
+ *
_______________________________________________
Openvas-commits mailing list
[email protected]
http://lists.wald.intevation.org/mailman/listinfo/openvas-commits
