[Openvas-commits] r2663 - in trunk/openvas-plugins: . scripts
scm-commit@wald.intevation.org
scm-commit at wald.intevation.org
Thu Mar 5 06:26:00 CET 2009
Author: chandra
Date: 2009-03-05 06:25:55 +0100 (Thu, 05 Mar 2009)
New Revision: 2663
Added:
trunk/openvas-plugins/scripts/gb_apple_safari_uri_dos_vuln_win.nasl
trunk/openvas-plugins/scripts/secpod_ms_dns_mem_corr_vuln.nasl
Modified:
trunk/openvas-plugins/ChangeLog
Log:
Added new plugins
Modified: trunk/openvas-plugins/ChangeLog
===================================================================
--- trunk/openvas-plugins/ChangeLog 2009-03-04 13:45:17 UTC (rev 2662)
+++ trunk/openvas-plugins/ChangeLog 2009-03-05 05:25:55 UTC (rev 2663)
@@ -1,3 +1,8 @@
+2009-03-05 Chandrashekhar B <bchandra at secpod.com>
+ * scripts/gb_apple_safari_uri_dos_vuln_win.nasl,
+ scripts/secpod_ms_dns_mem_corr_vuln.nasl:
+ Added new plugins
+
2009-03-04 Vlatko Kosturjak <kost at linux.hr>
* plugins/linux_tftp/Makefile.darwin, plugins/linux_tftp/Makefile,
Added: trunk/openvas-plugins/scripts/gb_apple_safari_uri_dos_vuln_win.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_apple_safari_uri_dos_vuln_win.nasl 2009-03-04 13:45:17 UTC (rev 2662)
+++ trunk/openvas-plugins/scripts/gb_apple_safari_uri_dos_vuln_win.nasl 2009-03-05 05:25:55 UTC (rev 2663)
@@ -0,0 +1,87 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: gb_apple_safari_uri_dos_vuln_win.nasl 629 2009-03-04 10:40:26Z mar $
+#
+# Apple Safari URI NULL Pointer Dereference DoS Vulnerability (Win)
+#
+# Authors:
+# Nikita MR <rnikita at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2009 Intevation GmbH, http://www.intevation.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+ script_id(800524);
+ script_version("$Revision: 1.0 $");
+ script_cve_id("CVE-2009-0744");
+ script_bugtraq_id(33909);
+ script_name(english:"Apple Safari URI NULL Pointer Dereference DoS Vulnerability (Win)");
+ desc["english"] = "
+
+ Overview: This host is running Apple Safari web browser and is prone
+ to denial of service vulnerability.
+
+ Vulnerability Insight:
+ Browser fails to adequately sanitize user supplied input in URI feeds.
+ Hence when certain characters are passed at the begining of the URI,
+ the NULL Pointer Dereference bug occurs, using '%', '{', '}', '`', '^', '|'
+ and '&' characters.
+
+ Impact:
+ Successful exploitation could allow remote attackers to cause browser crash.
+
+ Impact Level: Application
+
+ Affected Software/OS:
+ Apple Safari version 4 beta and prior on Windows.
+
+ Fix: No solution or patch is available as on 04th March, 2009. Information
+ regarding this issue will be updated once the solution details are available.
+ For updates refer, http://www.apple.com/support/downloads
+
+ References:
+ http://xforce.iss.net/xforce/xfdb/48943
+ http://www.securityfocus.com/archive/1/archive/1/501229/100/0/threaded
+
+ CVSS Score:
+ CVSS Base Score : 5.0 (AV:N/AC:L/Au:NR/C:N/I:N/A:P)
+ CVSS Temporal Score : 4.5
+ Risk factor : Medium";
+
+ script_description(english:desc["english"]);
+ script_summary(english:"Check for the version of Apple Safari");
+ script_category(ACT_GATHER_INFO);
+ script_copyright(english:"Copyright (C) 2009 Intevation GmbH");
+ script_family(english:"Denial of Service");
+ script_dependencies("secpod_apple_safari_detect_win_900003.nasl");
+ script_require_keys("AppleSafari/Version");
+ exit(0);
+}
+
+
+include("version_func.inc");
+
+safariVer = get_kb_item("AppleSafari/Version");
+if(!safariVer){
+ exit(0);
+}
+
+# Apple Safari Version <= (4.28.16.0) 4 build 528.16
+if(version_is_less_equal(version:safariVer, test_version:"4.28.16.0")){
+ security_warning(0);
+}
Added: trunk/openvas-plugins/scripts/secpod_ms_dns_mem_corr_vuln.nasl
===================================================================
--- trunk/openvas-plugins/scripts/secpod_ms_dns_mem_corr_vuln.nasl 2009-03-04 13:45:17 UTC (rev 2662)
+++ trunk/openvas-plugins/scripts/secpod_ms_dns_mem_corr_vuln.nasl 2009-03-05 05:25:55 UTC (rev 2663)
@@ -0,0 +1,126 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: secpod_ms_dns_mem_corr_vuln.nasl 1050 2009-03-03 15:00:29Z mar $
+#
+# Microsoft Windows DNS Memory Corruption Vulnerability - Mar09
+#
+# Authors:
+# Sujit Ghosal <sghosal at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2009 SecPod, http://www.secpod.com
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+ script_id(900465);
+ script_version("$Revision: 1.0 $");
+ script_cve_id("CVE-2008-6194");
+ script_name(english:"Microsoft Windows DNS Memory Corruption Vulnerability - Mar09");
+ desc["english"] = "
+
+ Overview: This host is running Microsoft Windows and is prone to DNS Memory
+ Corruption Vulnerability.
+
+ Vulnerability Insight:
+ This flaw is due to memory leak vulnerability in Microsoft Windows DNS
+ Server through DNS packets.
+
+ Impact:
+ Successful exploitation will let the attacker execute arbitrary codes in
+ the context of the application and can cause memory corruption in the DNS
+ service.
+
+ Impact level: System
+
+ Affected Software/OS:
+ Microsoft Windows Server 2000 and 2003.
+
+ Fix: No solution or patch is available as on 04th March, 2009. Information
+ regarding this issue will be updated once the solution details are available.
+ For further updates refer, http://www.microsoft.com
+
+ References:
+ http://www.microsoft.com/technet/security/bulletin/ms07-062.mspx
+ http://www.securityfocus.com/archive/1/archive/1/491831/100/0/threaded
+ http://www.securityfocus.com/archive/1/archive/1/491815/100/0/threaded
+
+ CVSS Score:
+ CVSS Base Score : 7.8 (AV:N/AC:L/Au:NR/C:N/I:N/A:C)
+ CVSS Temporal Score : 6.6
+ Risk factor: High";
+
+ script_description(english:desc["english"]);
+ script_summary(english:"Check for the version of DNS Executable");
+ script_category(ACT_GATHER_INFO);
+ script_copyright(english:"Copyright (C) 2009 SecPod");
+ script_family(english:"Windows");
+ script_dependencies("secpod_reg_enum.nasl");
+ script_require_keys("SMB/WindowsVersion");
+ exit(0);
+}
+
+
+include("smb_nt.inc");
+include("secpod_reg.inc");
+include("version_func.inc");
+include("secpod_smb_func.inc");
+
+if(!get_kb_item("SMB/WindowsVersion")){
+ exit(0);
+}
+
+if(hotfix_check_sp(win2k:5, win2003:3) <= 0){
+ exit(0);
+}
+
+sys32Path = registry_get_sz(key:"SOFTWARE\Microsoft\COM3\Setup",
+ item:"Install Path");
+if(!sys32Path){
+ exit(0);
+}
+
+share = ereg_replace(pattern:"([A-Z]):.*", replace:"\1$", string:sys32Path);
+file = ereg_replace(pattern:"[A-Z]:(.*)", replace:"\1", string:sys32Path + "\dns.exe");
+
+dnsVer = GetVer(file:file, share:share);
+if(dnsVer != NULL)
+{
+ if(get_kb_item("SMB/Win2K/ServicePack")) # Win-2000 SP4 and prior
+ {
+ if(version_is_less_equal(version:dnsVer, test_version:"5.0.2195.7147")){
+ security_hole(0);
+ }
+ exit(0);
+ }
+
+ SP = get_kb_item("SMB/Win2003/ServicePack");
+ if("Service Pack 1" >< SP) # Win-2003 SP1
+ {
+ if(version_is_less_equal(version:dnsVer, test_version:"5.2.3790.3027")){
+ security_hole(0);
+ }
+ exit(0);
+ }
+ else if("Service Pack 2" >< SP) # Win-2003 SP2
+ {
+ if(version_is_less_equal(version:dnsVer, test_version:"5.2.3790.4171")){
+ security_hole(0);
+ }
+ exit(0);
+ }
+ security_hole(0);
+}
Property changes on: trunk/openvas-plugins/scripts/secpod_ms_dns_mem_corr_vuln.nasl
___________________________________________________________________
Name: svn:executable
+ *
More information about the Openvas-commits
mailing list