[Openvas-commits] r6063 - in trunk/openvas-plugins: . scripts

scm-commit@wald.intevation.org scm-commit at wald.intevation.org
Fri Dec 4 14:18:02 CET 2009


Author: chandra
Date: 2009-12-04 14:17:59 +0100 (Fri, 04 Dec 2009)
New Revision: 6063

Added:
   trunk/openvas-plugins/scripts/gb_ms_ie_style_object_remote_code_exec_vuln.nasl
   trunk/openvas-plugins/scripts/gb_mysql_auth_bypass_vuln.nasl
   trunk/openvas-plugins/scripts/gb_mysql_auth_bypass_vuln_lin.nasl
   trunk/openvas-plugins/scripts/gb_mysql_dos_n_spoofing_vuln.nasl
   trunk/openvas-plugins/scripts/gb_php_mult_vuln_dec09.nasl
Modified:
   trunk/openvas-plugins/ChangeLog
   trunk/openvas-plugins/cve_current.txt
Log:
released

Modified: trunk/openvas-plugins/ChangeLog
===================================================================
--- trunk/openvas-plugins/ChangeLog	2009-12-04 11:32:23 UTC (rev 6062)
+++ trunk/openvas-plugins/ChangeLog	2009-12-04 13:17:59 UTC (rev 6063)
@@ -1,3 +1,12 @@
+2009-12-04  Chandrashekhar B <bchandra at secpod.com>
+
+	* scripts/gb_ms_ie_style_object_remote_code_exec_vuln.nasl,
+	scripts/gb_mysql_dos_n_spoofing_vuln.nasl,
+	scripts/gb_mysql_auth_bypass_vuln_lin.nasl,
+	scripts/gb_php_mult_vuln_dec09.nasl,
+	scripts/gb_mysql_auth_bypass_vuln.nasl:
+	Added new plugins.
+
 2009-12-03  Thomas Reinke <reinke at securityspace.com>
 
 	* scripts/deb_1939_1.nasl,

Modified: trunk/openvas-plugins/cve_current.txt
===================================================================
--- trunk/openvas-plugins/cve_current.txt	2009-12-04 11:32:23 UTC (rev 6062)
+++ trunk/openvas-plugins/cve_current.txt	2009-12-04 13:17:59 UTC (rev 6063)
@@ -330,3 +330,10 @@
 37180				Greenbone	svn		R
 33698				Greenbone	svn		R
 37185				Greenbone	svn		R
+CVE-2009-4019			SecPod		svn		R
+CVE-2008-7247			SecPod		svn		R
+CVE-2009-4030			SecPod		svn		R
+CVE-2009-4028			SecPod		svn		R
+CVE-2009-4018			SecPod		svn		R
+CVE-2009-2626			SecPod		svn		R
+CVE-2009-3672			SecPod		svn		L

Added: trunk/openvas-plugins/scripts/gb_ms_ie_style_object_remote_code_exec_vuln.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_ms_ie_style_object_remote_code_exec_vuln.nasl	2009-12-04 11:32:23 UTC (rev 6062)
+++ trunk/openvas-plugins/scripts/gb_ms_ie_style_object_remote_code_exec_vuln.nasl	2009-12-04 13:17:59 UTC (rev 6063)
@@ -0,0 +1,83 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: gb_ms_ie_style_object_remote_code_exe_vuln.nasl 6031 2009-12-03 11:17:55Z dec $
+#
+# MS Internet Explorer 'Style' Object Remote Code Execution Vulnerability
+#
+# Authors:
+# Sujit Ghosal <sghosal at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it undr the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+  script_id(800727);
+  script_version("$Revision: 1.0 $");
+  script_cve_id("CVE-2009-3672");
+  script_bugtraq_id(37085);
+  script_name("MS Internet Explorer 'Style' Object Remote Code Execution Vulnerability");
+  desc = "
+  Overview: This host has Microsoft Internet Explorer installed and is prone to
+  Remote Code Execution Vulnerability.
+
+  Vulnerability Insight:
+  This flaw is caused due to CSS information inside HTML rendering engine,
+  inside mshtml.dll library file. Malicious use of 'outerHTML' property
+  causes the remote browser to spray the heap memory allocated area.
+
+  Impact:
+  Successful attack could allow malicious people to execute arbitrary code in the
+  context of the user running the application or compromise the application and
+  possibly the system. failed attacks may cause denial-of-service condition.
+
+  Impact Level: System/Application
+
+  Affected Software/OS:
+  Microsoft Internet Explorer 6.x and 7.x
+
+  Fix:
+  No solution or patch is available as on 04th December, 2009. Information
+  regarding this issue will be updated once the solution details are available.
+  For updates refer, http://www.microsoft.com/technet/security/advisory/977981.mspx
+
+  References:
+  http://www.securityfocus.com/archive/1/archive/1/507984/100/0/threaded
+  http://www.symantec.com/connect/blogs/zero-day-internet-explorer-exploit-published
+
+  CVSS Score:
+    CVSS Base Score      : 9.3 (AV:N/AC:M/Au:NR/C:C/I:C/A:C)
+    CVSS Temporal Score  : 8.4
+  Risk factor: Critical";
+
+  script_description(desc);
+  script_summary("Check for the version of Microsoft Internet Explorer");
+  script_category(ACT_GATHER_INFO);
+  script_copyright("Copyright (C) 2009 Greenbone Networks GmbH");
+  script_family("General");
+  script_dependencies("gb_ms_ie_detect.nasl");
+  script_require_keys("MS/IE/Version");
+  exit(0);
+}
+
+
+include("version_func.inc");
+
+ieVer = get_kb_item("MS/IE/Version");
+if(ieVer =~ "^(6|7)\..*"){
+  security_hole(0);
+}


Property changes on: trunk/openvas-plugins/scripts/gb_ms_ie_style_object_remote_code_exec_vuln.nasl
___________________________________________________________________
Name: svn:executable
   + *

Added: trunk/openvas-plugins/scripts/gb_mysql_auth_bypass_vuln.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_mysql_auth_bypass_vuln.nasl	2009-12-04 11:32:23 UTC (rev 6062)
+++ trunk/openvas-plugins/scripts/gb_mysql_auth_bypass_vuln.nasl	2009-12-04 13:17:59 UTC (rev 6063)
@@ -0,0 +1,97 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: gb_mysql_auth_bypass_vuln.nasl 5988 2009-12-03 25:29:17Z dec $
+#
+# MySQL Authenticated Access Restrictions Bypass Vulnerability
+#
+# Authors:
+# Antu Sanadi <santu at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+  script_id(801066);
+  script_version("$Revision: 1.0 $");
+  script_cve_id("CVE-2009-4030");
+  script_name("MySQL Authenticated Access Restrictions Bypass Vulnerability");
+  desc = "
+  Overview: The host is running MySQL and is prone to Access restrictions Bypass
+  Vulnerability
+
+  Vulnerability Insight:
+  The flaw is due to an error while calling CREATE TABLE on a MyISAM table with modified
+  DATA DIRECTORY or INDEX DIRECTORY.
+
+  Impact:
+  Successful exploitation could allow users to bypass intended access restrictions
+  by calling CREATE TABLE with DATA DIRECTORY or INDEX DIRECTORY argument referring
+  to a subdirectory.
+
+  Impact Level: Application
+
+  Affected Software/OS:
+  MySQL 5.1.x before 5.1.41 on all running platform.
+
+  Fix: Upgrade to MySQL version 5.1.41
+  For Updates Refer, http://dev.mysql.com/downloads
+
+  References:
+  http://bugs.mysql.com/bug.php?id=32167
+  http://dev.mysql.com/doc/refman/5.1/en/news-5-1-41.html
+
+  CVSS Score:
+    CVSS Base Score      : 4.4 (AV:L/AC:M/Au:NR/C:P/I:P/A:P)
+    CVSS Temporal Score  : 3.2
+  Risk factor: Medium";
+
+  script_description(desc);
+  script_summary("Check for the version of MySQL");
+  script_category(ACT_GATHER_INFO);
+  script_copyright("Copyright (C) 2009 Greenbone Networks GmbH");
+  script_family("Denial of Service");
+  script_dependencies("mysql_version.nasl");
+  script_require_ports("Services/mysql", 3306);
+  exit(0);
+}
+
+
+include("misc_func.inc");
+include("version_func.inc");
+
+sqlPort = get_kb_item("Services/mysql");
+if(!sqlPort){
+  sqlPort = 3306;
+}
+
+if(!get_port_state(sqlPort)){
+  exit(0);
+}
+
+mysqlVer = get_mysql_version(port:sqlPort);
+if(!isnull(mysqlVer))
+{
+  mysqlVer = eregmatch(pattern:"([0-9.a-z]+)", string:mysqlVer);
+  if(!isnull(mysqlVer[1]))
+  {
+    if(version_in_range(version:mysqlVer[1], test_version:"5.1",test_version2:"5.1.40")){
+      security_warning(sqlPort);
+    }
+  }
+}
+


Property changes on: trunk/openvas-plugins/scripts/gb_mysql_auth_bypass_vuln.nasl
___________________________________________________________________
Name: svn:executable
   + *

Added: trunk/openvas-plugins/scripts/gb_mysql_auth_bypass_vuln_lin.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_mysql_auth_bypass_vuln_lin.nasl	2009-12-04 11:32:23 UTC (rev 6062)
+++ trunk/openvas-plugins/scripts/gb_mysql_auth_bypass_vuln_lin.nasl	2009-12-04 13:17:59 UTC (rev 6063)
@@ -0,0 +1,107 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: gb_mysql_auth_bypass_vuln_lin.nasl 5988 2009-12-03 23:29:17Z dec $
+#
+# MySQL Authenticated Access Restrictions Bypass Vulnerability (Linux)
+#
+# Authors:
+# Antu Sanadi <santu at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+  script_id(801065);
+  script_version("$Revision: 1.0 $");
+  script_cve_id("CVE-2008-7247");
+  script_name("MySQL Authenticated Access Restrictions Bypass Vulnerability (Linux)");
+  desc = "
+  Overview: The host is running MySQL and is prone to Access Restrictions Bypass
+  Vulnerability
+
+  Vulnerability Insight:
+  The flaw is due to an error in 'sql/sql_table.cc', when the data home directory
+  contains a symlink to a different filesystem.
+
+  Impact:
+  Successful exploitation could allow users to bypass intended access restrictions
+  by calling CREATE TABLE with  DATA DIRECTORY or INDEX DIRECTORY argument referring
+  to a subdirectory.
+
+  Impact Level: Application
+
+  Affected Software/OS:
+  MySQL 5.0.x before 5.0.88, 5.1.x before 5.1.41, 6.0 before 6.0.9-alpha
+
+  Fix: Upgrade to MySQL version 5.0.88 or 5.1.41 or 6.0.9-alpha
+  For Updates Refer, http://dev.mysql.com/downloads
+
+  References:
+  http://lists.mysql.com/commits/59711
+  http://bugs.mysql.com/bug.php?id=39277
+  http://marc.info/?l=oss-security&m=125908040022018&w=2
+
+  CVSS Score:
+    CVSS Base Score      : 6.0 (AV:N/AC:M/Au:SI/C:P/I:P/A:P)
+    CVSS Temporal Score  : 4.4
+  Risk factor: Medium";
+
+  script_description(desc);
+  script_summary("Check for the version of MySQL");
+  script_category(ACT_GATHER_INFO);
+  script_copyright("Copyright (C) 2009 Greenbone Networks GmbH");
+  script_family("Denial of Service");
+  script_dependencies("mysql_version.nasl");
+  script_require_ports("Services/mysql", 3306);
+  exit(0);
+}
+
+
+include("misc_func.inc");
+include("version_func.inc");
+
+sqlPort = get_kb_item("Services/mysql");
+if(!sqlPort){
+  sqlPort = 3306;
+}
+
+if(!get_port_state(sqlPort)){
+  exit(0);
+}
+
+mysqlVer = get_mysql_version(port:sqlPort);
+if(isnull(mysqlVer)){
+  exit(0);
+}
+
+mysqlVer = eregmatch(pattern:"([0-9.a-z]+)", string:mysqlVer);
+if(isnull(mysqlVer[1])){
+  exit(0);
+}
+
+if(version_in_range(version:mysqlVer[1], test_version:"5.0",test_version2:"5.0.87") ||
+   version_in_range(version:mysqlVer[1], test_version:"5.1",test_version2:"5.1.40")){
+  security_warning(sqlPort);
+}
+
+else if(mysqlVer[1] =~ "^6\.")
+{
+  if(version_is_less(version:mysqlVer[1],test_version:"6.0.9a")){
+    security_warning(sqlPort);
+  }
+}


Property changes on: trunk/openvas-plugins/scripts/gb_mysql_auth_bypass_vuln_lin.nasl
___________________________________________________________________
Name: svn:executable
   + *

Added: trunk/openvas-plugins/scripts/gb_mysql_dos_n_spoofing_vuln.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_mysql_dos_n_spoofing_vuln.nasl	2009-12-04 11:32:23 UTC (rev 6062)
+++ trunk/openvas-plugins/scripts/gb_mysql_dos_n_spoofing_vuln.nasl	2009-12-04 13:17:59 UTC (rev 6063)
@@ -0,0 +1,104 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: gb_mysql_dos_n_spoofing_vuln.nasl 5988 2009-12-03 21:29:17Z dec $
+#
+# MySQL Denial Of Service and Spoofing Vulnerabilities
+#
+# Authors:
+# Antu Sanadi <santu at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+  script_id(801064);
+  script_version("$Revision: 1.0 $");
+  script_cve_id("CVE-2009-4019","CVE-2009-4028");
+  script_name("MySQL Denial Of Service and Spoofing Vulnerabilities");
+  desc = "
+  Overview: The host is running MySQL and is prone to Denial Of Service
+  and Spoofing Vulnerabilities
+
+  Vulnerability Insight:
+  The flaws are due to:
+  - mysqld does not properly handle errors during execution of certain SELECT
+    statements with subqueries, and does not preserve certain null_value flags
+    during execution of statements that use the 'GeomFromWKB()' function.
+  - An error in 'vio_verify_callback()' function in 'viosslfactories.c', when
+    OpenSSL is used, accepts a value of zero for the depth of X.509 certificates.
+
+  Impact:
+  Successful exploitation could allow users to cause a Denial of Service and
+  man-in-the-middle attackers to spoof arbitrary SSL-based MySQL servers via
+  a crafted certificate.
+
+  Impact Level: Application
+
+  Affected Software/OS:
+  MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41 on all running platform.
+
+  Fix: Upgrade to MySQL version 5.0.88 or 5.1.41
+  For Updates Refer, http://dev.mysql.com/downloads
+
+  References:
+  http://bugs.mysql.com/47780
+  http://bugs.mysql.com/47320
+  http://marc.info/?l=oss-security&m=125881733826437&w=2
+  http://dev.mysql.com/doc/refman/5.0/en/news-5-0-88.html
+
+  CVSS Score:
+    CVSS Base Score      : 6.4 (AV:N/AC:L/Au:NR/C:N/I:P/A:P)
+    CVSS Temporal Score  : 4.7
+  Risk factor: Medium";
+
+  script_description(desc);
+  script_summary("Check for the version of MySQL");
+  script_category(ACT_GATHER_INFO);
+  script_copyright("Copyright (C) 2009 Greenbone Networks GmbH");
+  script_family("Denial of Service");
+  script_dependencies("mysql_version.nasl");
+  script_require_ports("Services/mysql", 3306);
+  exit(0);
+}
+
+
+include("misc_func.inc");
+include("version_func.inc");
+
+sqlPort = get_kb_item("Services/mysql");
+if(!sqlPort){
+  sqlPort = 3306;
+}
+
+if(!get_port_state(sqlPort)){
+  exit(0);
+}
+
+mysqlVer = get_mysql_version(port:sqlPort);
+if(isnull(mysqlVer)){
+  exit(0);
+}
+
+mysqlVer = eregmatch(pattern:"([0-9.a-z]+)", string:mysqlVer);
+if(!isnull(mysqlVer[1]))
+{
+  if(version_in_range(version:mysqlVer[1], test_version:"5.0",test_version2:"5.0.87") ||
+     version_in_range(version:mysqlVer[1], test_version:"5.1",test_version2:"5.1.40")){
+    security_warning(sqlPort);
+  }
+}


Property changes on: trunk/openvas-plugins/scripts/gb_mysql_dos_n_spoofing_vuln.nasl
___________________________________________________________________
Name: svn:executable
   + *

Added: trunk/openvas-plugins/scripts/gb_php_mult_vuln_dec09.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_php_mult_vuln_dec09.nasl	2009-12-04 11:32:23 UTC (rev 6062)
+++ trunk/openvas-plugins/scripts/gb_php_mult_vuln_dec09.nasl	2009-12-04 13:17:59 UTC (rev 6063)
@@ -0,0 +1,107 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: gb_php_mult_vuln_dec09.nasl 5956 2009-12-02 18:42:56Z dec $
+#
+# PHP Multiple Vulnerabilities Dec-09
+#
+# Authors:
+# Antu Sanadi <santu at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+  script_id(801060);
+  script_version("$Revision: 1.0 $");
+  script_cve_id("CVE-2009-4018","CVE-2009-2626");
+  script_bugtraq_id(37138, 36009);
+  script_name("PHP Multiple Vulnerabilities Dec-09");
+  desc = "
+  Overview: This host is running PHP and is prone to multiple vulnerabilities.
+
+  Vulnerability Insight:
+  Multiple flaws are due to:
+   - Error in 'proc_open()' function in 'ext/standard/proc_open.c' that does not
+     enforce the 'safe_mode_allowed_env_vars' and 'safe_mode_protected_env_vars'
+     directives, which allows attackers to execute programs with an arbitrary
+     environment via the env parameter.
+   - Error in 'zend_restore_ini_entry_cb()' function in 'zend_ini.c', which
+     allows attackers to obtain sensitive information.
+
+  Impact:
+  Successful exploitation could allow local attackers to bypass certain
+  security restrictions and cause denial of service.
+
+  Impact Level: Network
+
+  Affected Software/OS:
+  PHP version 5.2.10 and prior.
+  PHP version 5.3.x before 5.3.1
+
+  Fix: Upgrade to PHP version 5.3.1
+  http://www.php.net/downloads.php
+
+  References:
+  http://secunia.com/advisories/37482
+  http://bugs.php.net/bug.php?id=49026
+  http://securityreason.com/achievement_securityalert/65
+  http://www.openwall.com/lists/oss-security/2009/11/23/15
+
+  CVSS Score:
+    CVSS Base Score     : 7.5 (AV:N/AC:L/Au:NR/C:P/I:P/A:P)
+    CVSS Temporal Score : 5.9
+  Risk factor : High";
+
+  script_description(desc);
+  script_summary("Check for the version of PHP");
+  script_category(ACT_GATHER_INFO);
+  script_copyright("Copyright (C) 2009 Greenbone Networks GmbH");
+  script_family("Web application abuses");
+  script_dependencies("gb_php_detect.nasl");
+  script_require_ports("Services/www", 80);
+  exit(0);
+}
+
+
+include("version_func.inc");
+
+phpPort = get_kb_item("Services/www");
+if(!phpPort)
+{
+  phpPort = 80;
+  if(!get_port_state(phpPort)){
+    exit(0);
+  }
+}
+
+phpVer = get_kb_item("www/" + phpPort + "/PHP");
+if(!phpVer){
+  exit(0);
+}
+
+if(version_is_less(version:phpVer, test_version:"5.2.11")){
+  security_hole(0);
+  exit(0);
+}
+
+else if(phpVer =~ "^5\.3")
+{
+  if(version_is_less(version:phpVer, test_version:"5.3.1")){
+   security_hole(0);
+  }
+}


Property changes on: trunk/openvas-plugins/scripts/gb_php_mult_vuln_dec09.nasl
___________________________________________________________________
Name: svn:executable
   + *



More information about the Openvas-commits mailing list