Author: chandra
Date: 2008-10-21 15:08:20 +0200 (Tue, 21 Oct 2008)
New Revision: 1590
Added:
trunk/openvas-plugins/scripts/secpod_hummingbird_activex_bof_vuln_900159.nasl
trunk/openvas-plugins/scripts/secpod_xm_easy_personal_ftpserver_dos_vuln_900158.nasl
Modified:
trunk/openvas-plugins/ChangeLog
Log:
Added new plugins
Modified: trunk/openvas-plugins/ChangeLog
===================================================================
--- trunk/openvas-plugins/ChangeLog 2008-10-21 08:02:48 UTC (rev 1589)
+++ trunk/openvas-plugins/ChangeLog 2008-10-21 13:08:20 UTC (rev 1590)
@@ -1,3 +1,8 @@
+2008-10-21 Chandrashekhar B <[EMAIL PROTECTED]>
+ * scripts/secpod_hummingbird_activex_bof_vuln_900159.nasl,
+ scripts/secpod_xm_easy_personal_ftpserver_dos_vuln_900158.nasl:
+ Added new plugins
+
2008-10-20 Vlatko Kosturjak <[EMAIL PROTECTED]>
* Removed obsolete C plugins: snmp_portscan is superseeded by
snmpwalk_portscan.nasl and hydra is superseeded by
Added:
trunk/openvas-plugins/scripts/secpod_hummingbird_activex_bof_vuln_900159.nasl
===================================================================
---
trunk/openvas-plugins/scripts/secpod_hummingbird_activex_bof_vuln_900159.nasl
2008-10-21 08:02:48 UTC (rev 1589)
+++
trunk/openvas-plugins/scripts/secpod_hummingbird_activex_bof_vuln_900159.nasl
2008-10-21 13:08:20 UTC (rev 1590)
@@ -0,0 +1,92 @@
+##############################################################################
+#
+# Hummingbird HostExplorer ActiveX Control BOF Vulnerability
+#
+# Copyright: SecPod
+#
+# Date Written: 2008/10/20
+#
+# Revision: 1.1
+#
+# Log : ssharath
+# Issue #0354
+# ------------------------------------------------------------------------
+# This program was written by SecPod and is licensed under the GNU GPL
+# license. Please refer to the below link for details,
+# http://www.gnu.org/licenses/gpl.html
+# This header contains information regarding licensing terms under the GPL,
+# and information regarding obtaining source code from the Author.
+# Consequently, pursuant to section 3(c) of the GPL, you must accompany the
+# information found in this header with any distribution you make of this
+# Program.
+# ------------------------------------------------------------------------
+##############################################################################
+
+if(description)
+{
+ script_id(900159);
+ script_bugtraq_id(31783);
+ script_copyright(english:"Copyright (C) 2008 SecPod");
+ script_version("Revision: 1.0 ");
+ script_category(ACT_GATHER_INFO);
+ script_family(english:"Denial of Service");
+ script_name(english:"Hummingbird HostExplorer ActiveX Control BOF
Vulnerability");
+ script_summary(english:"Check for vulnerable version of Hummingbird
HostExplorer ActiveX Control");
+ desc["english"] = "
+ Overview: This host has Hummingbird HostExplorer ActiveX Control installed
+ and is prone to stack based buffer overflow vulnerability.
+
+ The flaw is due to error in Hummingbird.XWebHostCtrl.1 ActiveX control in
+ hclxweb.dll file when handling the 'PlainTextPassword' function, which can
+ be exploited by assigning an overly long string.
+
+ Impact:
+ Successful exploitation will allow execution arbitrary code, and deny the
+ service.
+
+ Impact Level: Application
+
+ Affected Software/OS:
+ Hummingbird HostExplorer versions prior to 2008 on Windows (all)
+
+ Fix: Update to HostExplorer 2008
+ http://connectivity.hummingbird.com/products/nc/he/index.html
+
+ References:
+ http://milw0rm.com/exploits/6761
+ http://secunia.com/advisories/32319/
+
+ CVSS Score:
+ CVSS Base Score : 8.3 (AV:N/AC:M/Au:NR/C:P/I:P/A:C)
+ CVSS Temporal Score : 6.5
+ Risk factor : High";
+
+ script_description(english:desc["english"]);
+ script_dependencies("secpod_reg_enum.nasl");
+ script_require_keys("SMB/WindowsVersion");
+ exit(0);
+}
+
+
+include("smb_nt.inc");
+
+if(!get_kb_item("SMB/WindowsVersion")){
+ exit(0);
+}
+
+hostExpVer = registry_get_sz(key:"SOFTWARE\Hummingbird\Event Monitoring" +
+ "\Product Info\HostExplorer 2008" ,
+ item:"Version");
+if(!hostExpVer){
+ hostExpVer = registry_get_sz(key:"SOFTWARE\Hummingbird\Event Monitoring" +
+ "\Product Info\HostExplorer
2008\HostExplorer",
+ item:"Version");
+ if(!hostExpVer){
+ exit(0);
+ }
+}
+
+# Grep for HostExplorer 2008 version < 13.0.0.0
+if(ereg(pattern:"^(([0-9]|1[0-2])(\..*)?)($|[^.0-9])", string:hostExpVer)){
+ security_hole(0);
+}
Added:
trunk/openvas-plugins/scripts/secpod_xm_easy_personal_ftpserver_dos_vuln_900158.nasl
===================================================================
---
trunk/openvas-plugins/scripts/secpod_xm_easy_personal_ftpserver_dos_vuln_900158.nasl
2008-10-21 08:02:48 UTC (rev 1589)
+++
trunk/openvas-plugins/scripts/secpod_xm_easy_personal_ftpserver_dos_vuln_900158.nasl
2008-10-21 13:08:20 UTC (rev 1590)
@@ -0,0 +1,88 @@
+##############################################################################
+#
+# XM Easy Personal FTP Server 'NSLT' Command Remote DoS Vulnerability
+#
+# Copyright: SecPod
+#
+# Date Written: 2008/10/17
+#
+# Revision: 1.1
+#
+# Log : ssharath
+# Issue #0349
+# ------------------------------------------------------------------------
+# This program was written by SecPod and is licensed under the GNU GPL
+# license. Please refer to the below link for details,
+# http://www.gnu.org/licenses/gpl.html
+# This header contains information regarding licensing terms under the GPL,
+# and information regarding obtaining source code from the Author.
+# Consequently, pursuant to section 3(c) of the GPL, you must accompany the
+# information found in this header with any distribution you make of this
+# Program.
+# ------------------------------------------------------------------------
+##############################################################################
+
+if(description)
+{
+ script_id(900158);
+ script_bugtraq_id(31739);
+ script_copyright(english:"Copyright (C) 2008 SecPod");
+ script_version("Revision: 1.0 ");
+ script_category(ACT_GATHER_INFO);
+ script_family(english:"Denial of Service");
+ script_name(english:"XM Easy Personal FTP Server 'NSLT' Command Remote DoS
Vulnerability");
+ script_summary(english:"Check for vulnerable version of XM Easy Personal FTP
Server");
+ desc["english"] = "
+ Overview: The host is running XM Easy Personal FTP Server, which is prone to
+ denial of service vulnerability.
+
+ The vulnerability is due to an error when handling a malformed NLST command.
+
+ Impact:
+ Successful exploitation will cause denial of service to legitimate users.
+
+ Impact Level: Application
+
+ Affected Software/OS:
+ dxmsoft XM Easy Personal FTP Server version 5.6.0 and prior on Windows (all)
+
+ Fix: No solution/patch is available as on 17th October, 2008.
+
+ References:
+ http://www.dxm2008.com/
+ http://www.milw0rm.com/exploits/6741
+
+ CVSS Score:
+ CVSS Base Score : 6.3 (AV:N/AC:M/Au:SI/C:N/I:N/A:C)
+ CVSS Temporal Score : 5.7
+ Risk factor : High";
+
+ script_description(english:desc["english"]);
+ script_dependencie("find_service.nes");
+ script_require_ports("Services/ftp", 21);
+ exit(0);
+}
+
+
+include("ftp_func.inc");
+
+port = get_kb_item("Services/ftp");
+if(!port){
+ port = 21;
+}
+
+if(!get_port_state(port)){
+ exit(0);
+}
+
+banner = get_ftp_banner(port:port);
+if("DXM's FTP Server" >!< banner){
+ exit(0);
+}
+
+if(egrep(pattern:"DXM's FTP Server 5\.([0-5](\..*)?|6\.0)($|[^.0-9])",
+ string:banner))
+{
+ security_warning(port);
+ exit(0);
+}
_______________________________________________
Openvas-commits mailing list
[email protected]
http://lists.wald.intevation.org/mailman/listinfo/openvas-commits
