Author: kost
Date: 2008-10-24 19:51:47 +0200 (Fri, 24 Oct 2008)
New Revision: 1618
Added:
trunk/openvas-plugins/scripts/apcupsd_overflows.nasl
trunk/openvas-plugins/scripts/cvstrac_output_formatter_dos.nasl
trunk/openvas-plugins/scripts/kiwi_cattools_tftpd_dir_traversal.nasl
trunk/openvas-plugins/scripts/squid_2612.nasl
trunk/openvas-plugins/scripts/sybase_blank_password.nasl
trunk/openvas-plugins/scripts/symantec_ws_detection.nasl
trunk/openvas-plugins/scripts/symantec_ws_dos.nasl
trunk/openvas-plugins/scripts/webcalendar_info_disclosure.nasl
Modified:
trunk/openvas-plugins/ChangeLog
Log:
Added GPL plugins from Nessus, modified script_id number (+ added tag
kst-depend-misc)
Modified: trunk/openvas-plugins/ChangeLog
===================================================================
--- trunk/openvas-plugins/ChangeLog 2008-10-24 17:34:44 UTC (rev 1617)
+++ trunk/openvas-plugins/ChangeLog 2008-10-24 17:51:47 UTC (rev 1618)
@@ -1,17 +1,31 @@
-2008-10-20 Vlatko Kosturjak <[EMAIL PROTECTED]>
+2008-10-24 Vlatko Kosturjak <[EMAIL PROTECTED]>
+ * scripts/apcupsd_overflows.nasl
+ scripts/symantec_ws_detection.nasl
+ scripts/webcalendar_info_disclosure.nasl
+ scripts/symantec_ws_dos.nasl
+ scripts/sybase_blank_password.nasl
+ scripts/cvstrac_output_formatter_dos.nasl
+ scripts/squid_2612.nasl
+ scripts/kiwi_cattools_tftpd_dir_traversal.nasl:
+ Added GPL plugins from Nessus, modified script_id number
+ (+ added tag kst-depend-misc)
- scripts/hydra_postgres.nasl, scripts/hydra_mysql.nasl:
+2008-10-24 Vlatko Kosturjak <[EMAIL PROTECTED]>
+
+ * scripts/hydra_postgres.nasl, scripts/hydra_mysql.nasl:
Removed unexistant dependencies in order to work with OpenVAS
-2008-10-20 Vlatko Kosturjak <[EMAIL PROTECTED]>
+2008-10-24 Vlatko Kosturjak <[EMAIL PROTECTED]>
- scripts/hydra_postgres.nasl, scripts/hydra_mysql.nasl:
- Added GPL plugins from Nessus (+ added tag kst-4check)
+ * scripts/hydra_postgres.nasl, scripts/hydra_mysql.nasl:
+ Added GPL plugins from Nessus, modified script_id number
+ (+ added tag kst-4check)
-2008-10-20 Vlatko Kosturjak <[EMAIL PROTECTED]>
+2008-10-24 Vlatko Kosturjak <[EMAIL PROTECTED]>
* scripts/http_ids_evasion.nasl, scripts/ids_evasion.nasl:
- Added GPL plugins from Nessus (+ added tag kst-gplblah)
+ Added GPL plugins from Nessus, modified script_id number
+ (+ added tag kst-gplblah)
2008-10-24 Chandrashekhar B <[EMAIL PROTECTED]>
* scripts/gb_wireshark_mult_vuln_oct08_lin.nasl,
Added: trunk/openvas-plugins/scripts/apcupsd_overflows.nasl
===================================================================
--- trunk/openvas-plugins/scripts/apcupsd_overflows.nasl 2008-10-24
17:34:44 UTC (rev 1617)
+++ trunk/openvas-plugins/scripts/apcupsd_overflows.nasl 2008-10-24
17:51:47 UTC (rev 1618)
@@ -0,0 +1,62 @@
+#
+# This script was written by Renaud Deraison
+#
+# GPL
+#
+# kst-depend-misc
+
+if(description)
+{
+ script_id(80014);
+ script_bugtraq_id(2070, 6828, 7200);
+ script_cve_id("CVE-2001-0040", "CVE-2003-0098", "CVE-2003-0099");
+ script_xref(name:"OSVDB", value:"1683");
+ script_xref(name:"SuSE", value:"SUSE-SA:2003:022");
+
+
+ script_version ("$Revision: 1.8 $");
+
+ script_name(english:"apcupsd overflows");
+
+ desc["english"] = "
+The remote apcupsd, according to its version number,
+is vulnerable to a buffer overflow which could
+allow an attacker to gain a root shell on this host.
+
+*** Nessus solely relied on the version number of the
+*** remote server, so this might be a false positive
+
+Risk factor : High";
+
+ script_description(english:desc["english"]);
+
+ summary["english"] = "Checks the version of apcupsd";
+ script_summary(english:summary["english"]);
+
+ script_category(ACT_GATHER_INFO);
+
+ script_copyright(english:"This script is Copyright (C) 2003 Renaud
Deraison");
+ family["english"] = "Gain root remotely";
+ script_family(english:family["english"]);
+ script_dependencie("find_service1.nasl", "apcnisd_detect.nasl");
+ script_require_ports("Services/apcnisd", 7000);
+
+ exit(0);
+}
+
+port = get_kb_item("Services/apcnisd");
+if (! port) port = 7000;
+if (! get_port_state(port)) exit(0);
+
+soc = open_sock_tcp(port);
+if(!soc)exit(0);
+req = raw_string(0x00, 0x06) + "status";
+send(socket:soc, data:req);
+r = recv(socket:soc, length:4096);
+if("APC" >< r && "MODEL" >< r)
+{
+ r = strstr(r, "RELEASE");
+ if(ereg(pattern:"RELEASE.*:
(3\.([0-7]\..*|8\.[0-5][^0-9]|10\.[0-4])|[0-2]\..*)", string:r))
+ security_hole(port);
+
+}
Added: trunk/openvas-plugins/scripts/cvstrac_output_formatter_dos.nasl
===================================================================
--- trunk/openvas-plugins/scripts/cvstrac_output_formatter_dos.nasl
2008-10-24 17:34:44 UTC (rev 1617)
+++ trunk/openvas-plugins/scripts/cvstrac_output_formatter_dos.nasl
2008-10-24 17:51:47 UTC (rev 1618)
@@ -0,0 +1,77 @@
+# This script was written by David Maciejak <david dot maciejak at kyxar dot
fr>
+# This script is released under the GNU GPLv2
+# kst-depend-misc
+
+if(description)
+{
+ script_id(80015);
+ script_version ("$Revision: 1.3 $");
+
+ script_cve_id("CVE-2007-0347");
+ script_bugtraq_id(22296);
+ script_xref(name:"OSVDB", value:"31935");
+
+ name["english"] = "CVSTrac text output formatter DoS";
+
+ script_name(english:name["english"]);
+
+ desc["english"] = "
+Synopsis :
+
+The remote web server contains a CGI script or is itself subject to a
+denial of service attack.
+
+Description :
+
+According to its version number, the version of CVSTrac installed on
+the remote host contains a flaw related to its Wiki-style text output
+formatter that may allow an attacker to cause a partial denial of service,
+depending on the pages requested.
+
+See also :
+
+http://www.securityfocus.com/archive/1/458455/30/0/threaded
+
+Solution :
+
+Upgrade to CVSTrac 2.0.1 or later.
+
+Risk factor :
+
+Medium / CVSS Base Score : 4.3
+(CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)";
+
+
+ script_description(english:desc["english"]);
+
+ summary["english"] = "Checks CVSTrac version";
+
+ script_summary(english:summary["english"]);
+
+ script_category(ACT_GATHER_INFO);
+
+
+ script_copyright(english:"This script is Copyright (C) 2007 David Maciejak");
+ family["english"] = "CGI abuses";
+ script_family(english:family["english"]);
+ script_dependencie("cvstrac_detect.nasl");
+ script_require_ports("Services/www", 80);
+ exit(0);
+}
+
+#
+# The script code starts here
+#
+
+include("global_settings.inc");
+include("http_func.inc");
+
+if (report_paranoia < 2) exit(0);
+
+port = get_http_port(default:80);
+kb = get_kb_item("www/" + port + "/cvstrac" );
+if ( ! kb ) exit(0);
+stuff = eregmatch(pattern:"(.*) under (.*)", string:kb );
+version = stuff[1];
+if(ereg(pattern:"^([01]\.|2\.0\.0[^0-9.]?)", string:version))
+ security_warning(port);
Added: trunk/openvas-plugins/scripts/kiwi_cattools_tftpd_dir_traversal.nasl
===================================================================
--- trunk/openvas-plugins/scripts/kiwi_cattools_tftpd_dir_traversal.nasl
2008-10-24 17:34:44 UTC (rev 1617)
+++ trunk/openvas-plugins/scripts/kiwi_cattools_tftpd_dir_traversal.nasl
2008-10-24 17:51:47 UTC (rev 1618)
@@ -0,0 +1,96 @@
+#
+# Script Written By Ferdy Riphagen
+# Script distributed under the GNU GPLv2 License.
+#
+#
+# Changes by Tenable:
+# - re-did the description
+# - raised the risk
+#
+# kst-depend-misc
+
+ desc = "
+Synopsis :
+
+The remote TFTP server is affected by a directory traversal
+vulnerability.
+
+Description :
+
+The remote host appears to be running Kiwi CatTools, a freeware
+application for device configuration management.
+
+The TFTP server included with the version of Kiwi CatTools installed
+on the remote host fails to sanitize filenames of diretory traversal
+sequences. An attacker can exploit this issue to get or put arbitrary
+files on the affected host subject to the privileges of the user id
+under which the server operates, LOCAL SYSTEM by default.
+
+See also :
+
+http://www.securityfocus.com/archive/1/459500/30/0/threaded
+http://www.kiwisyslog.com/kb/idx/5/178/article/
+
+Solution :
+
+Upgrade to Kiwi CatTools version 3.2.9 or later.
+
+Risk factor :
+
+Critical / CVSS Base Score : 10.0
+(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)";
+
+
+if (description) {
+ script_id(80016);
+ script_version("$Revision: 1.5 $");
+
+ script_cve_id("CVE-2007-0888");
+ script_bugtraq_id(22490);
+ script_xref(name:"OSVDB", value:"33162");
+
+ name["english"] = "Kiwi CatTools < 3.2.9 Directory Traversal";
+ script_name(english:name["english"]);
+ script_description(english:desc);
+ summary["english"] = "Try to grab a file outside the tftp root";
+ script_summary(english:summary["english"]);
+
+ script_category(ACT_ATTACK);
+ script_family(english:"Remote file access");
+ script_copyright(english:"This script is Copyright (C) 2007 Ferdy Riphagen");
+
+ script_dependencies("tftpd_detect.nasl", "tftpd_backdoor.nasl");
+ script_require_keys("Services/udp/tftp");
+ script_exclude_keys('tftp/backdoor'); # Not wise but quicker
+ exit(0);
+}
+
+include("tftp.inc");
+
+port = get_kb_item("Services/udp/tftp");
+if (!port) port = 69;
+if (get_kb_item('tftp/'+port+'/backdoor')) exit(0);
+
+get = tftp_get(port:port, path:"z//..//..//..//..//..//boot.ini");
+if (isnull(get)) exit(0);
+# In case the backdoor was missed by tftpd_backdoor.nasl (UDP is not reliable)
+tftp_ms_backdoor(file: 'boot.ini', data: get, port: port);
+
+if (
+ ("ECHO" >< get) || ("SET " >< get) ||
+ ("export" >< get) || ("EXPORT" >< get) ||
+ ("mode" >< get) || ("MODE" >< get) ||
+ ("doskey" >< get) || ("DOSKEY" >< get) ||
+ ("[boot loader]" >< get) || ("[fonts]" >< get) ||
+ ("[extensions]" >< get) || ("[mci extensions]" >< get) ||
+ ("[files]" >< get) || ("[Mail]" >< get) ||
+ ("[operating systems]" >< get)
+)
+{
+ report = string(
+ desc, "\n\n", "Plugin output :\n\n",
+ "Here are the contents of the file '\\boot.ini' that Nessus\n",
+ "was able to read from the remote host :\n", get);
+ security_hole(port:port, protocol:"udp", data:report);
+}
+
Added: trunk/openvas-plugins/scripts/squid_2612.nasl
===================================================================
--- trunk/openvas-plugins/scripts/squid_2612.nasl 2008-10-24 17:34:44 UTC
(rev 1617)
+++ trunk/openvas-plugins/scripts/squid_2612.nasl 2008-10-24 17:51:47 UTC
(rev 1618)
@@ -0,0 +1,73 @@
+#
+# This script was written by David Maciejak <david dot maciejak at kyxar dot
fr>
+#
+# This script is released under the GNU GPLv2
+#
+# kst-depend-misc
+
+if (description)
+{
+script_id(80017);
+script_version("$Revision: 1.4 $");
+
+script_bugtraq_id(80017);
+script_xref(name:"OSVDB", value:"34367");
+script_cve_id("CVE-2007-1560");
+
+desc["english"] = "
+Synopsis :
+
+The remote proxy server is vulnerable to a denial of service
+vulnerability.
+
+Description :
+
+A vulnerability in TRACE request processing has been reported in Squid,
+which can be exploited by malicious people to cause a denial of service.
+
+See also :
+
+http://www.squid-cache.org/Advisories/SQUID-2007_1.txt
+
+Solution :
+
+Upgrade to squid 2.6.STABLE12 or newer.
+
+Risk factor :
+
+Medium / CVSS Base Score : 5.0
+(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)";
+script_description(english:desc["english"]);
+
+script_name(english:"Squid < 2.6.STABLE12");
+summary["english"] = "Determines squid version";
+script_summary(english:summary["english"]);
+
+script_category(ACT_GATHER_INFO);
+script_copyright(english:"This script is Copyright (C) 2007 David Maciejak");
+family["english"] = "Denial of Service";
+script_family(english:family["english"]);
+
+script_dependencies("proxy_use.nasl");
+script_require_ports("Services/http_proxy",3128, 8080);
+exit(0);
+}
+
+include("global_settings.inc");
+include("http_func.inc");
+include("http_keepalive.inc");
+
+# nb: only run the plugin if we're being paranoid to avoid false-positives,
+# which might arise because the software is open-source.
+if (report_paranoia < 2) exit(0);
+
+port = get_kb_item("Services/http_proxy");
+if(!port)port = 3128;
+if(!get_port_state(port))port = 8080;
+
+if(get_port_state(port))
+{
+ res = http_get_cache(item:"/", port:port);
+ if(res &&
egrep(pattern:"[Ss]quid/2\.([0-5]\.|6\.STABLE([0-9][^0-9]|1[01][^0-9]))",
string:res))
+ security_warning(port);
+}
Added: trunk/openvas-plugins/scripts/sybase_blank_password.nasl
===================================================================
--- trunk/openvas-plugins/scripts/sybase_blank_password.nasl 2008-10-24
17:34:44 UTC (rev 1617)
+++ trunk/openvas-plugins/scripts/sybase_blank_password.nasl 2008-10-24
17:51:47 UTC (rev 1618)
@@ -0,0 +1,189 @@
+#
+# (C) Tenable Network Security
+# This script is based on mssql_blank_password.nasl which is (C) H D Moore
+#
+# This script is released under the GPLv2
+#
+# kst-depend-misc
+
+if(description)
+{
+ script_id(80018);
+ script_version ("$Revision: 1.3 $");
+ name["english"] = "Sybase SQL Blank Password";
+ script_name(english:name["english"]);
+
+ desc["english"] = "
+Synopsis :
+
+The remote database service has an account with a blank password.
+
+Description :
+
+The remote Sybase SQL server has the default 'sa' account enabled
+without any password.
+
+An attacker may use this flaw to execute commands against the remote
+host as well as read database content.
+
+Solution :
+
+Either disable this account or set a password for it.
+
+Risk factor :
+
+High / CVSS Base Score : 7.5
+(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)";
+ script_description(english:desc["english"]);
+
+ summary["english"] = "Sybase SQL Blank Password";
+ script_summary(english:summary["english"]);
+
+ script_category(ACT_ATTACK);
+
+ script_copyright(english:"This script is Copyright (C) 2005-2008 Tenable
Network Security");
+ family["english"] = "Databases";
+ script_family(english:family["english"]);
+ script_require_ports("Services/sybase", 5000);
+ script_dependencies("sybase_detect.nasl");
+ exit(0);
+}
+
+#
+# The script code starts here
+#
+
+pkt_hdr = raw_string(
+ 0x02, 0x00, 0x02, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+);
+
+
+pkt_pt2 = raw_string (
+ 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x61, 0x30, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x20, 0x18, 0x81, 0xb8, 0x2c, 0x08, 0x03,
+ 0x01, 0x06, 0x0a, 0x09, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x73, 0x71, 0x75, 0x65, 0x6c, 0x64, 0x61,
+ 0x20, 0x31, 0x2e, 0x30, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x0b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00
+);
+
+pkt_pt3 = raw_string (
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x04, 0x02, 0x00, 0x00, 0x4d, 0x53, 0x44,
+ 0x42, 0x4c, 0x49, 0x42, 0x00, 0x00, 0x00, 0x07, 0x06, 0x00, 0x00,
+ 0x00, 0x00, 0x0d, 0x11, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+);
+
+pkt_lang = raw_string(
+ 0x02, 0x01, 0x00, 0x47, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x30, 0x30, 0x30, 0x00, 0x00,
+ 0x00, 0x03, 0x00, 0x00, 0x00
+);
+
+function make_sql_login_pkt (username, password)
+{
+ local_var nul, pblen, pbuf, plen, ppad, sql_packet, ublen, ubuf, ulen,
upad;
+
+ ulen = strlen(username);
+ plen = strlen(password);
+
+ upad = 30 - ulen;
+ ppad = 30 - plen;
+
+ ubuf = "";
+ pbuf = "";
+
+ nul = raw_string(0x00);
+
+ if(ulen)
+ {
+ ublen = raw_string(ulen % 255);
+ } else {
+ ublen = raw_string(0x00);
+ }
+
+ if(plen)
+ {
+ pblen = raw_string(plen % 255);
+ } else {
+ pblen = raw_string(0x00);
+ }
+
+ ubuf = string(username, crap(data:nul, length:upad));
+ pbuf = string(password, crap(data:nul, length:ppad));
+
+ sql_packet =
string(pkt_hdr,ubuf,ublen,pbuf,pblen,pkt_pt2,pblen,pbuf,pkt_pt3);
+
+ # returning this as a string is NOT working!
+ return sql_packet;
+}
+
+
+port = get_kb_item("Services/sybase");
+if(!port)port = 5000;
+
+found = 0;
+
+if(get_port_state(port))
+{
+ soc = open_sock_tcp(port);
+
+ if(soc)
+ {
+ # this creates a variable called sql_packet
+ sql_packet = make_sql_login_pkt(username:"sa", password:"");
+
+ send(socket:soc, data:sql_packet);
+ send(socket:soc, data:pkt_lang);
+
+ r = recv(socket:soc, length:255);
+ close(soc);
+
+ if(strlen(r) > 10 &&
+ ord(r[8]) == 0xE3)
+ {
+ version = substr(r, strlen(r) - 13, strlen(r) - 10 );
+ strver = NULL;
+ for ( i = 0 ; i < 4 ; i ++ )
+ {
+ if ( strver) strver += '.';
+ strver += ord(version[i]);
+ }
+ set_kb_item(name:"sybase/version", value:strver);
+ security_hole(port);
+ }
+ }
+}
Added: trunk/openvas-plugins/scripts/symantec_ws_detection.nasl
===================================================================
--- trunk/openvas-plugins/scripts/symantec_ws_detection.nasl 2008-10-24
17:34:44 UTC (rev 1617)
+++ trunk/openvas-plugins/scripts/symantec_ws_detection.nasl 2008-10-24
17:51:47 UTC (rev 1618)
@@ -0,0 +1,72 @@
+#
+# This script was written by David Maciejak <david dot maciejak at kyxar dot
fr>
+#
+# This script is released under the GNU GPL v2
+#
+# kst-depend-misc
+
+if(description)
+{
+ script_id(80019);
+ script_version("$Revision: 1.1 $");
+
+ name["english"] = "Symantec Web Security Detection";
+
+ script_name(english:name["english"]);
+
+ desc["english"] = "
+Synopsis :
+
+The remote service filters HTTP / FTP content.
+
+Description :
+
+The remote web server appears to be running Symantec Web Security,
+for filtering traffic of viruses and inappropriate content.
+
+Risk factor :
+
+None";
+
+ script_description(english:desc["english"]);
+
+ summary["english"] = "Checks for SWS";
+
+ script_summary(english:summary["english"]);
+
+ script_category(ACT_GATHER_INFO);
+
+ script_copyright(english:"This script is Copyright (C) 2007 David Maciejak");
+
+ family["english"] = "CGI abuses";
+ script_family(english:family["english"]);
+ script_dependencie("httpver.nasl");
+ script_require_ports("Services/www", 8002);
+ exit(0);
+}
+
+#
+# The script code starts here
+#
+
+include("http_func.inc");
+
+port = get_kb_item("Services/www");
+if ( ! port ) port = 8002;
+
+if(get_port_state(port))
+{
+ banner = get_http_banner(port:port);
+ if (
+ banner &&
+ "Server: SWS-" >< banner
+ ) {
+ ver = strstr(banner, "Server: SWS-") - "Server: SWS-";
+ if (ver) ver = ver - strstr(ver, '\r');
+ if (ver) ver = ver - strstr(ver, '\n');
+ if (ver && ver =~ "^[0-9]") {
+ security_note(port);
+ set_kb_item(name:string("www/", port, "/SWS"),value:string(ver));
+ }
+ }
+}
Added: trunk/openvas-plugins/scripts/symantec_ws_dos.nasl
===================================================================
--- trunk/openvas-plugins/scripts/symantec_ws_dos.nasl 2008-10-24 17:34:44 UTC
(rev 1617)
+++ trunk/openvas-plugins/scripts/symantec_ws_dos.nasl 2008-10-24 17:51:47 UTC
(rev 1618)
@@ -0,0 +1,75 @@
+#
+# This script was written by David Maciejak <david dot maciejak at kyxar dot
fr>
+#
+# This script is released under the GNU GPL v2
+#
+# kst-depend-misc
+
+if(description)
+{
+ script_id(80020);
+ script_version("$Revision: 1.4 $");
+
+ script_cve_id("CVE-2007-0563","CVE-2007-0564");
+ script_bugtraq_id(22184);
+ script_xref(name:"OSVDB", value:"32959");
+ script_xref(name:"OSVDB", value:"32960");
+ script_xref(name:"OSVDB", value:"32961");
+
+ name["english"] = "Symantec Web Security flaws";
+
+ script_name(english:name["english"]);
+
+ desc["english"] = "
+Synopsis :
+
+The remote service is affected by multiple vulnerabilities.
+
+Description :
+
+According to its banner, the version of Symantec Web Security on the
+remote host is vulnerable to denial of service and cross-site
+scripting attacks.
+
+Solution :
+
+Upgrade at least to version 3.0.1.85.
+
+Risk factor :
+
+Medium / CVSS Base Score : 4.3
+(CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)";
+
+ script_description(english:desc["english"]);
+
+ summary["english"] = "Checks for SWS flaws";
+
+ script_summary(english:summary["english"]);
+
+ script_category(ACT_GATHER_INFO);
+
+ script_copyright(english:"This script is Copyright (C) 2007 David Maciejak");
+
+ family["english"] = "CGI abuses";
+ script_family(english:family["english"]);
+ script_dependencie("symantec_ws_detection.nasl");
+ script_require_ports("Services/www", 8002);
+ exit(0);
+}
+
+#
+# The script code starts here
+#
+
+port = get_kb_item("Services/www");
+if ( ! port ) port = 8002;
+if(!get_port_state(port)) exit(0);
+
+version=get_kb_item(string("www/", port, "/SWS"));
+if (version) {
+ if (ereg(pattern:"^(2\.|3\.0\.(0|1\.([0-9]|[1-7][0-9]|8[0-4])$))",
string:version))
+ {
+ security_warning(port);
+ set_kb_item(name: 'www/'+port+'/XSS', value: TRUE);
+ }
+}
Added: trunk/openvas-plugins/scripts/webcalendar_info_disclosure.nasl
===================================================================
--- trunk/openvas-plugins/scripts/webcalendar_info_disclosure.nasl
2008-10-24 17:34:44 UTC (rev 1617)
+++ trunk/openvas-plugins/scripts/webcalendar_info_disclosure.nasl
2008-10-24 17:51:47 UTC (rev 1618)
@@ -0,0 +1,110 @@
+#
+# This script was written by David Maciejak <david dot maciejak at kyxar dot
fr>
+# This script is released under the GNU GPL v2
+#
+# kst-depend-misc
+
+if(description)
+{
+ script_id(80021);
+ script_version("$Revision: 1.3 $");
+ script_bugtraq_id(17853);
+ script_xref(name:"OSVDB", value:"25280");
+ script_cve_id("CVE-2006-2247");
+
+ name["english"] = "WebCalendar User Account Enumeration Disclosure Issue";
+ script_name(english:name["english"]);
+
+ desc["english"] = "
+Synopsis:
+
+The remote web server is affected by an information disclosure issue.
+
+Description:
+
+The version of WebCalendar on the remote host is prone to a user
+account enumeration weakness in that in response to login attempts it
+returns different error messages depending on whether the user exists
+or the password is invalid.
+
+See also:
+
+http://www.securityfocus.com/archive/1/433053/30/0/threaded
+http://www.securityfocus.com/archive/1/436263/30/0/threaded
+http://www.nessus.org/u?2fe61fc9
+
+Solution :
+
+Upgrade to WebCalendar 1.0.4 or later.
+
+Risk factor :
+
+Medium / CVSS Base Score : 5.0
+(CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)";
+ script_description(english:desc["english"]);
+
+ summary["english"] = "Checks for WebCalendar User Account Enumeration
Disclosure weakness";
+ script_summary(english:summary["english"]);
+
+ script_category(ACT_GATHER_INFO);
+
+ script_copyright(english:"This script is Copyright (C) 2006 David Maciejak");
+
+ family["english"] = "CGI abuses";
+ family["francais"] = "CGI abuses";
+ script_family(english:family["english"], francais:family["francais"]);
+
+ script_dependencies("webcalendar_detect.nasl");
+ script_exclude_keys("Settings/disable_cgi_scanning");
+ script_require_ports("Services/www", 80);
+
+ exit(0);
+}
+
+#code
+
+include("http_func.inc");
+include("http_keepalive.inc");
+
+port = get_http_port(default:80);
+if (!get_port_state(port)) exit(0);
+if (!can_host_php(port:port)) exit(0);
+
+
+# Test an install.
+install = get_kb_item(string("www/", port, "/webcalendar"));
+if (isnull(install)) exit(0);
+matches = eregmatch(string:install, pattern:"^(.+) under (/.*)$");
+if (!isnull(matches)) {
+ dir = matches[2];
+ url = string(dir, "/login.php");
+
+ req = http_get(item:url, port:port);
+ res = http_keepalive_send_recv(port:port, data:req, bodyonly:FALSE);
+ if (res == NULL) exit(0);
+
+ if ("webcalendar_session=deleted; expires" >< res && '<input name="login"
id="user"' >< res)
+ {
+ postdata=string(
+ "login=nessus", unixtime(), "&",
+ "password=nessus"
+ );
+ req = string(
+ "POST ", url, " HTTP/1.1\r\n",
+ "Host: ", get_host_name(), "\r\n",
+ "Content-Type: application/x-www-form-urlencoded\r\n",
+ "Content-Length: ", strlen(postdata), "\r\n",
+ "\r\n",
+ postdata
+ );
+
+ #display("req='", req, "'.\n");
+ res = http_keepalive_send_recv(port:port, data:req, bodyonly:TRUE);
+ #display("res='", res, "'.\n");
+ if (res == NULL) exit(0);
+
+ if ("Invalid login: no such user" >< res) {
+ security_warning(port);
+ }
+ }
+}
_______________________________________________
Openvas-commits mailing list
[email protected]
http://lists.wald.intevation.org/mailman/listinfo/openvas-commits
