[Openvas-commits] r6065 - in trunk/openvas-plugins: . scripts

scm-commit@wald.intevation.org scm-commit at wald.intevation.org
Sat Dec 5 12:49:19 CET 2009


Author: chandra
Date: 2009-12-05 12:49:16 +0100 (Sat, 05 Dec 2009)
New Revision: 6065

Added:
   trunk/openvas-plugins/scripts/gb_golden_ftp_server_detect.nasl
   trunk/openvas-plugins/scripts/gb_golden_ftp_server_dir_trav_vuln.nasl
   trunk/openvas-plugins/scripts/gb_ibm_db2_mult_vuln_lin_dec09.nasl
   trunk/openvas-plugins/scripts/gb_kaspersky_av_2010_dos_vuln.nasl
Modified:
   trunk/openvas-plugins/ChangeLog
   trunk/openvas-plugins/cve_current.txt
   trunk/openvas-plugins/scripts/cpe.inc
Log:
Added new plugins

Modified: trunk/openvas-plugins/ChangeLog
===================================================================
--- trunk/openvas-plugins/ChangeLog	2009-12-04 15:58:10 UTC (rev 6064)
+++ trunk/openvas-plugins/ChangeLog	2009-12-05 11:49:16 UTC (rev 6065)
@@ -1,3 +1,13 @@
+2009-12-05  Chandrashekhar B <bchandra at secpod.com>
+
+	* scripts/gb_golden_ftp_server_detect.nasl,
+	scripts/gb_golden_ftp_server_dir_trav_vuln.nasl,
+	scripts/gb_kaspersky_av_2010_dos_vuln.nasl,
+	scripts/gb_ibm_db2_mult_vuln_lin_dec09.nasl:
+	Added new plugins.
+
+	* scripts/cpe.inc: Added new CPE.
+
 2009-12-04  Thomas Reinke <reinke at securityspace.com>
 	* scripts/ubuntu_862_1.nasl:
 	Shortened description

Modified: trunk/openvas-plugins/cve_current.txt
===================================================================
--- trunk/openvas-plugins/cve_current.txt	2009-12-04 15:58:10 UTC (rev 6064)
+++ trunk/openvas-plugins/cve_current.txt	2009-12-05 11:49:16 UTC (rev 6065)
@@ -337,3 +337,7 @@
 CVE-2009-4018			SecPod		svn		R
 CVE-2009-2626			SecPod		svn		R
 CVE-2009-3672			SecPod		svn		L
+CVE-2009-4150			SecPod		svn		L
+CVE-2009-4194			SecPod		svn		R
+CVE-2009-4114			SecPod		svn		L
+

Modified: trunk/openvas-plugins/scripts/cpe.inc
===================================================================
--- trunk/openvas-plugins/scripts/cpe.inc	2009-12-04 15:58:10 UTC (rev 6064)
+++ trunk/openvas-plugins/scripts/cpe.inc	2009-12-05 11:49:16 UTC (rev 6065)
@@ -738,7 +738,9 @@
 "www/*/FrontAccounting", "^([0-9.]+\.[0-9])\.?([a-z0-9]+)?",  "cpe:/a:frontaccounting:frontaccounting:",
 "HomeFTPServer/Ver", "^([0-9.]+\.[0-9])\.?([a-z0-9]+)?", "cpe:/a:downstairs.dnsalias:home_ftp_server:",
 "Robo/FTP/Ver", "^([0-9.]+\.[0-9])\.?([a-z0-9]+)?" , "cpe:/a:robo-ftp:robo-ftp:",
-"TYPSoft/FTP/Ver", "^([0-9.]+\.[0-9])\.?([a-z0-9]+)?", "cpe:/a:typsoft:typsoft_ftp_server:"
+"TYPSoft/FTP/Ver", "^([0-9.]+\.[0-9])\.?([a-z0-9]+)?", "cpe:/a:typsoft:typsoft_ftp_server:",
+"Golden/FTP/Pro/Ver", "^([0-9.]+)", "cpe:/a:kmint21:golden_ftp_server:",
+"Golden/FTP/Free/Ver", "^([0-9.]+)", "cpe:/a:kmint21:golden_ftp_server:"
 );
 
 

Added: trunk/openvas-plugins/scripts/gb_golden_ftp_server_detect.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_golden_ftp_server_detect.nasl	2009-12-04 15:58:10 UTC (rev 6064)
+++ trunk/openvas-plugins/scripts/gb_golden_ftp_server_detect.nasl	2009-12-05 11:49:16 UTC (rev 6065)
@@ -0,0 +1,81 @@
+##############################################################################
+# OpenVAS Vulnerability Test
+# $Id: gb_golden_ftp_server_detect.nasl 6053 2009-12-04 17:05:29Z dec $
+#
+# Golden FTP Server Version Detection
+#
+# Authors:
+# Antu Sanadi <santu at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+################################################################################
+
+if(description)
+{
+  script_id(801072);
+  script_version ("$Revision: 1.0 $");
+  script_name("Golden FTP Server Version Detection");
+  desc = "
+  Overview: This script determines Golden FTP server version on the
+  remote host and sets the result in KB.
+
+  Risk factor : Informational";
+
+  script_description(desc);
+  script_summary("Sets KB for Golden FTP server version");
+  script_category(ACT_GATHER_INFO);
+  script_copyright("Copyright (C) 2009 Greenbone Networks GmbH");
+  script_family("Service detection");
+  script_dependencies("find_service.nes");
+  script_require_ports("Services/ftp", 21);
+  exit(0);
+}
+
+
+include("ftp_func.inc");
+
+port = get_kb_item("Services/ftp");
+if(!port){
+  port = 21;
+}
+
+if(!get_port_state(port)){
+  exit(0);
+}
+
+banner = get_ftp_banner(port:port);
+if(isnull(banner)){
+  exit(0);
+}
+
+if("220 Golden FTP Server Pro" >< banner)
+{
+  gftpVer = eregmatch(pattern:"v([0-9.]+)", string:banner);
+  if(gftpVer[1] != NULL)
+  {
+    set_kb_item(name:"Golden/FTP/Pro/Ver", value:gftpVer[1]);
+    break;
+  }
+}
+
+if(("220 Golden FTP Server" >< banner) && ("Pro"  >!<  banner))
+{
+  gfftpVer = eregmatch(pattern:"v([0-9.]+)", string:banner);
+  if(gfftpVer[1] != NULL){
+    set_kb_item(name:"Golden/FTP/Free/Ver", value:gfftpVer[1]);
+  }
+}

Added: trunk/openvas-plugins/scripts/gb_golden_ftp_server_dir_trav_vuln.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_golden_ftp_server_dir_trav_vuln.nasl	2009-12-04 15:58:10 UTC (rev 6064)
+++ trunk/openvas-plugins/scripts/gb_golden_ftp_server_dir_trav_vuln.nasl	2009-12-05 11:49:16 UTC (rev 6065)
@@ -0,0 +1,102 @@
+##############################################################################
+# OpenVAS Vulnerability Test
+# $Id: gb_golden_ftp_server_dir_trav_vuln.nasl 5967 2009-12-04 17:12:58Z dec $
+#
+# Golden FTP Server 'DELE' Command Directory Traversal Vulnerability
+#
+# Authors:
+# Antu Sanadi <santu at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+################################################################################
+
+if(description)
+{
+  script_id(801073);
+  script_version("$Revision: 1.0 $");
+  script_cve_id("CVE-2009-4194");
+  script_name("Golden FTP Server 'DELE' Command Directory Traversal Vulnerability");
+  desc = "
+  Overview: This host is running Golden FTP Server and is prone to Directory
+  Traversal vulnerability.
+
+  Vulnerability Insight:
+  The flaw is caused due to an input validation error in 'DELE' command. It is
+  possible to escape the FTP root and delete arbitrary files on the system via
+  directory traversal (../../) attack methods.
+
+  Impact:
+  Successful exploitation will allow the remote authenticated user to access
+  arbitrary folders and delete arbitrary files from the FTP directories.
+
+  Affected Software/OS:
+  Golden FTP Server Pro version 4.30 and prior.
+  Golden FTP Server Free version 4.30 and prior.
+
+  Fix:
+  No solution or patch is available as on 04th December 2009. Information
+  regarding this issue will be updated once the solution details are available.
+  For Updates Refer, http://www.goldenftpserver.com/download.html
+
+  References:
+  http://secunia.com/advisories/37527
+  http://xforce.iss.net/xforce/xfdb/54497
+  http://www.exploit-db.com/exploits/10258
+
+  CVSS Score:
+    CVSS Base Score      : 6.0 (AV:N/AC:M/Au:SI/C:P/I:P/A:P)
+    CVSS Temporal Score  : 5.4
+  Risk factor: High";
+
+  script_description(desc);
+  script_summary("Check for the version of Golden FTP Server");
+  script_category(ACT_GATHER_INFO);
+  script_copyright("Copyright (C) 2009 Greenbone Networks GmbH");
+  script_family("FTP");
+  script_dependencies("gb_golden_ftp_server_detect.nasl");
+  script_require_ports("Services/ftp", 21);
+  script_require_keys("Golden/FTP/Pro/Ver","Golden/FTP/Free/Ver");
+  exit(0);
+}
+
+
+include("version_func.inc");
+
+port = get_kb_item("Services/ftp");
+if(!port){
+  port = 21;
+}
+
+if(!get_port_state(port)){
+  exit(0);
+}
+
+if(gftpVer = get_kb_item("Golden/FTP/Pro/Ver"))
+{
+  # Golden FTP server Pro v4.30 = v4.50
+  if(version_is_less_equal(version:gftpVer, test_version:"4.50")){
+    security_hole(port);
+  }
+}
+
+else if(gfftpVer = get_kb_item("Golden/FTP/Free/Ver"))
+{
+  # Golden FTP server Free v4.30 = v4.50
+  if(version_is_less_equal(version:gfftpVer, test_version:"4.50")){
+    security_hole(port);
+  }
+}

Added: trunk/openvas-plugins/scripts/gb_ibm_db2_mult_vuln_lin_dec09.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_ibm_db2_mult_vuln_lin_dec09.nasl	2009-12-04 15:58:10 UTC (rev 6064)
+++ trunk/openvas-plugins/scripts/gb_ibm_db2_mult_vuln_lin_dec09.nasl	2009-12-05 11:49:16 UTC (rev 6065)
@@ -0,0 +1,99 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: gb_ibm_db2_mulptiple_vuln_lin_dec09.nasl 6030 2009-12-04 16:03:51Z dec $
+#
+# IBM DB2 Multiple Vulnerabilities - Dec09 (Linux)
+#
+# Authors:
+# Antu Sanadi <santu at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+  script_id(801071);
+  script_version("$Revision: 1.0 $");
+  script_cve_id("CVE-2009-4150");
+  script_name("IBM DB2 Multiple Vulnerabilities - Dec09 (Linux)");
+  desc = "
+  Overview: The host is installed with IBM DB2 and is prone to multiple
+  vulnerabilities.
+
+  Vulnerability Insight:
+  Multiple flaws are due to:
+  - Unspecified error exists related to a table function when the definer
+    loses required privileges.
+  - Unspecified error that can be exploited to insert, update, or delete rows
+    in a table without having required privileges.
+  - Unspecified error in the handling of 'SET SESSION AUTHORIZATION' statements.
+  - Error in 'DASAUTO' command, it can be run by non-privileged users.
+
+  Impact:
+  Successful exploitation allows the attacker to potentially perform certain
+  actions with escalated privileges or to bypass certain security restrictions.
+
+  Impact Level: System/Application
+
+  Affected Software/OS:
+  IBM DB2 version 8 prior to Fixpak 18
+  IBM DB2 version 9.1 prior to Fixpak 8
+  IBM DB2 version 9.5 prior to Fixpak 4
+  IBM DB2 version 9.7 prior to Fixpak 1
+
+  Fix:
+  Update DB2 8 Fixpak 18 or 9.1 Fixpak 8 or 9.5 Fixpak 4 or 9.7 Fixpak 1 or later.
+  For Updates Refer, http://www-01.ibm.com/support/docview.wss?rs=71&uid=swg27007053
+
+  References:
+  http://secunia.com/advisories/37454
+  http://securitytracker.com/id?1023242
+  http://www.vupen.com/english/advisories/2009/3340
+  http://www-01.ibm.com/support/docview.wss?uid=swg21386689
+  http://www-01.ibm.com/support/docview.wss?uid=swg21403619
+
+  CVSS Score:
+    CVSS Base Score      : 4.6 (AV:L/AC:L/Au:NR/C:P/I:P/A:P)
+    CVSS Temporal Score  : 3.4
+  Risk factor: Medium";
+
+  script_description(desc);
+  script_summary("Check for the version of IBM DB2");
+  script_category(ACT_GATHER_INFO);
+  script_copyright("Copyright (C) 2009 Greenbone Networks GmbH");
+  script_family("General");
+  script_dependencies("secpod_ibm_db2_detect_linux_900217.nasl");
+  script_require_keys("Linux/IBM_db2/Ver");
+  exit(0);
+}
+
+
+include("version_func.inc");
+
+ibmVer = get_kb_item("Linux/IBM_db2/Ver");
+if(!ibmVer){
+  exit(0);
+}
+
+# Check for IBM DB2 version 8 before FP18, 9.1 before FP8, 9.5 before FP4
+# 9.1 FP8 =>9.1.0.8, 9.5 FP4 =>9.5.0.4, 8 FP18 =>8.1.18, 9.7 FP1=> 9.7.0.1
+if(version_is_equal(version:ibmVer, test_version:"9.7.0.0")||
+   version_in_range(version:ibmVer, test_version:"8.0", test_version2:"8.1.17")||
+   version_in_range(version:ibmVer, test_version:"9.1", test_version2:"9.1.0.7")||
+   version_in_range(version:ibmVer, test_version:"9.5", test_version2:"9.5.0.3")){
+  security_warning(0);
+}

Added: trunk/openvas-plugins/scripts/gb_kaspersky_av_2010_dos_vuln.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_kaspersky_av_2010_dos_vuln.nasl	2009-12-04 15:58:10 UTC (rev 6064)
+++ trunk/openvas-plugins/scripts/gb_kaspersky_av_2010_dos_vuln.nasl	2009-12-05 11:49:16 UTC (rev 6065)
@@ -0,0 +1,84 @@
+##############################################################################
+# OpenVAS Vulnerability Test
+# $Id: gb_kaspersky_av_2010_dos_vuln.nasl 5989 2009-12-05 12:03:46Z dec $
+#
+# Kaspersky Anti-Virus 2010 'kl1.sys' Driver DoS Vulnerability
+#
+# Authors:
+# Veerendra GG <veernedragg at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+  script_id(800154);
+  script_version("$Revision: 1.0 $");
+  script_cve_id("CVE-2009-4114");
+  script_bugtraq_id(37044);
+  script_name("Kaspersky Anti-Virus 2010 'kl1.sys' Driver DoS Vulnerability");
+  desc = "
+  Overview: The host is installed with Kaspersky Anti-Virus 2010 and is prone
+  to Denial of Service vulnerability.
+
+  Vulnerability Insight:
+  The flaw is due to NULL pointer dereference in 'kl1.sys' driver via a
+  specially-crafted IOCTL 0x0022c008 call.
+
+  Impact:
+  Successful exploitation will let the attacker to execute arbitrary code with
+  elevated privileges or cause the kernel to crash.
+
+  Impact Level: System/Application
+
+  Affected Software/OS:
+  Kaspersky Anti-Virus 2010 before 9.0.0.736 on Windows.
+
+  Fix: Update to version 9.0.0.736 or later,
+  For Updates Refer, http://www.kaspersky.com/downloads
+
+  References:
+  http://secunia.com/advisories/37398
+  http://xforce.iss.net/xforce/xfdb/54309
+  http://www.securityfocus.com/archive/1/archive/1/507933/100/0/threaded
+
+  CVSS Score:
+    CVSS Base Score      : 4.9 (AV:L/AC:L/Au:NR/C:N/I:N/A:C)
+    CVSS Temporal Score  : 3.9
+  Risk factor: Medium";
+
+  script_description(desc);
+  script_summary("Check for the version of Kaspersky Anti-Virus");
+  script_category(ACT_GATHER_INFO);
+  script_copyright("Copyright (C) 2009 Greenbone Networks GmbH");
+  script_family("Denial of Service");
+  script_dependencies("gb_kaspersky_av_detect.nasl");
+  exit(0);
+}
+
+
+include("version_func.inc");
+
+## Get Version from KB
+kavVer = get_kb_item("Kaspersky/AV/Ver");
+if(kavVer != NULL)
+{
+  ## Kaspersky Anti-Virus 2010 before 9.0.0.736
+  if(version_in_range(version:kavVer, test_version:"9.0", test_version2:"9.0.0.735")){
+    security_warning(0);
+  }
+}


Property changes on: trunk/openvas-plugins/scripts/gb_kaspersky_av_2010_dos_vuln.nasl
___________________________________________________________________
Name: svn:executable
   + *



More information about the Openvas-commits mailing list