[Openvas-commits] r3248 - in trunk/openvas-plugins: . scripts
scm-commit@wald.intevation.org
scm-commit at wald.intevation.org
Wed May 6 08:04:30 CEST 2009
Author: chandra
Date: 2009-05-06 08:04:28 +0200 (Wed, 06 May 2009)
New Revision: 3248
Added:
trunk/openvas-plugins/scripts/gb_axigen_mail_server_detect.nasl
trunk/openvas-plugins/scripts/gb_axigen_mail_server_xss_vuln.nasl
trunk/openvas-plugins/scripts/secpod_xitami_mult_format_string_vuln.nasl
trunk/openvas-plugins/scripts/secpod_xitami_server_detect.nasl
trunk/openvas-plugins/scripts/secpod_xpdf_detect.nasl
trunk/openvas-plugins/scripts/secpod_xpdf_mult_vuln.nasl
Modified:
trunk/openvas-plugins/ChangeLog
Log:
Added new plugins
Modified: trunk/openvas-plugins/ChangeLog
===================================================================
--- trunk/openvas-plugins/ChangeLog 2009-05-06 04:18:55 UTC (rev 3247)
+++ trunk/openvas-plugins/ChangeLog 2009-05-06 06:04:28 UTC (rev 3248)
@@ -1,3 +1,12 @@
+2009-05-06 Chandrashekhar B <bchandra at secpod.com>
+ * scripts/gb_axigen_mail_server_xss_vuln.nasl,
+ scripts/gb_axigen_mail_server_detect.nasl,
+ scripts/secpod_xitami_server_detect.nasl,
+ scripts/secpod_xpdf_mult_vuln.nasl,
+ scripts/secpod_xitami_mult_format_string_vuln.nasl,
+ scripts/secpod_xpdf_detect.nasl:
+ Added new plugins
+
2009-05-05 Thomas Reinke <reinke at securityspace.com>
* deb_1779_1.nasl deb_1780_1.nasl deb_1781_1.nasl deb_1782_1.nasl
deb_1784_1.nasl deb_1785_1.nasl deb_1786_1.nasl deb_1787_1.nasl
Added: trunk/openvas-plugins/scripts/gb_axigen_mail_server_detect.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_axigen_mail_server_detect.nasl 2009-05-06 04:18:55 UTC (rev 3247)
+++ trunk/openvas-plugins/scripts/gb_axigen_mail_server_detect.nasl 2009-05-06 06:04:28 UTC (rev 3248)
@@ -0,0 +1,75 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: gb_axigen_mail_server_detect.nasl 2053 2009-05-05 20:07:05Z may $
+#
+# Axigen Mail Server Version Detection
+#
+# Authors:
+# Antu Sanadi <santu at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2009 Intevation GmbH, http://www.intevation.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+##############################################################################
+
+if(description)
+{
+ script_id(800603);
+ script_version("$Revision: 1.0 $");
+ script_name(english:"Axigen Mail Server Version Detection");
+ desc["english"] = "
+
+ Overview: The script detects the installed version of Axigen Mail
+ Server and sets the result in KB.
+
+ Risk factor: Informational";
+
+ script_description(english:desc["english"]);
+ script_summary(english:"Sets KB for the version of Axigen Mail Server");
+ script_category(ACT_GATHER_INFO);
+ script_copyright(english:"Copyright (C) 2009 Intevation GmbH");
+ script_family(english:"Service detection");
+ script_dependencies("find_service.nes", "http_version.nasl");
+ script_require_ports("Services/www", 9000);
+ exit(0);
+}
+
+
+include("http_func.inc");
+
+axigenPort = get_http_port(default:9000);
+
+if(!axigenPort){
+ axigenPort = 9000;
+}
+
+if(!get_port_state(axigenPort)){
+ exit(0);
+}
+
+request = http_get(item:string("/"), port:axigenPort);
+rcvRes = http_send_recv(port:axigenPort, data:request);
+
+if(rcvRes != NULL && "Axigen-Webadmin" >< rcvRes)
+{
+ axigenVer = eregmatch(pattern:"AXIGEN WebAdmin ([0-9.]+)",
+ string:rcvRes);
+
+ if(axigenVer[1] != NULL)
+ {
+ set_kb_item(name:"www/" + axigenPort + "/AxigenMailServer",
+ value:axigenVer[1]);
+ }
+}
Added: trunk/openvas-plugins/scripts/gb_axigen_mail_server_xss_vuln.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_axigen_mail_server_xss_vuln.nasl 2009-05-06 04:18:55 UTC (rev 3247)
+++ trunk/openvas-plugins/scripts/gb_axigen_mail_server_xss_vuln.nasl 2009-05-06 06:04:28 UTC (rev 3248)
@@ -0,0 +1,88 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: gb_axigen_mail_server_xss_vuln.nasl 2053 2009-05-05 17:05:29Z may $
+#
+# Axigen Mail Server Cross-Site Scripting Vulnerability
+#
+# Authors:
+# Antu Sanadi <santu at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2009 Intevation GmbH, http://www.intevation.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+ script_id(800604);
+ script_version("$Revision: 1.0 $");
+ script_cve_id("CVE-2009-1484");
+ script_bugtraq_id(34716);
+ script_name(english:"Axigen Mail Server Cross-Site Scripting Vulnerability");
+ desc["english"] = "
+
+ Overview:
+ The host is running Axigen Mail Server and is prone to Cross-Site Scripting
+ Vulnerability.
+
+ Vulnerability Insight:
+ The flaw is caused due to improper sanitization of user-supplied input passed
+ within the e-mail messages.
+
+ Impact:
+ Successful exploitation will allows the attacker to steal cookie-based
+ authentication credentials by injecting HTML and script code on a affected
+ application.
+
+ Affected Software/OS:
+ Axigen Mail Server Version 6.2.2 and prior.
+
+ Fix: Upgrade to version 7.1.0 or later
+ http://www.axigen.com/mail-server/download/
+
+ References:
+ http://secunia.com/advisories/34402
+
+ CVSS Score:
+ CVSS Base Score : 4.3 (AV:N/AC:M/Au:NR/C:N/I:P/A:N)
+ CVSS Temporal Score : 3.2
+ Risk factor : Medium";
+
+ script_description(english:desc["english"]);
+ script_summary(english:"Check for the version of Axigen Mail Server");
+ script_category(ACT_GATHER_INFO);
+ script_copyright(english:"Copyright (C) 2009 Intevation GmbH");
+ script_family(english:"Web application abuses");
+ script_dependencies("gb_axigen_mail_server_detect.nasl");
+ script_require_ports("Services/www", 9000);
+ exit(0);
+}
+
+
+include("http_func.inc");
+include("version_func.inc");
+
+axigenPort = get_http_port(default:9000);
+if(!axigenPort){
+ exit(0);
+}
+
+axigenVer = get_kb_item("www/" + axigenPort + "/AxigenMailServer");
+if(axigenVer != NULL)
+{
+ if(version_is_less_equal(version:axigenVer, test_version:"6.2.2")){
+ security_warning(axigenPort);
+ }
+}
Added: trunk/openvas-plugins/scripts/secpod_xitami_mult_format_string_vuln.nasl
===================================================================
--- trunk/openvas-plugins/scripts/secpod_xitami_mult_format_string_vuln.nasl 2009-05-06 04:18:55 UTC (rev 3247)
+++ trunk/openvas-plugins/scripts/secpod_xitami_mult_format_string_vuln.nasl 2009-05-06 06:04:28 UTC (rev 3248)
@@ -0,0 +1,89 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: secpod_xitami_mult_format_string_vuln.nasl 1210 2009-05-05 12:39:43Z apr $
+#
+# Xitami Multiple Format String Vulnerabilities
+#
+# Authors:
+# Nikita MR <rnikita at secpod.com>
+#
+# Copyright (c) 2009 SecPod, http://www.secpod.com
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+ script_id(900548);
+ script_version("$Revision: 1.0 $");
+ script_cve_id("CVE-2008-6519", "CVE-2008-6520");
+ script_bugtraq_id(28603);
+ script_name(english:"Xitami Multiple Format String Vulnerabilities");
+ desc["english"] = "
+
+ Overview: This host has Xitami web server installed and is prone to
+ Multiple Format String Vulnerabilities.
+
+ Vulnerability Insight:
+ - Error exists while handling a format string specifiers in a Long Running
+ Web Process (LRWP) request, which triggers incorrect logging code involving
+ the sendfmt function in the SMT kernel.
+ - Error in Server Side Includes (SSI) filter when processes requests with
+ specially crafted URIs ending in .ssi, .shtm, or .shtml, which triggers
+ incorrect logging code involving the sendfmt function in the SMT kernel.
+
+ Impact:
+ Successful exploitation will allow remote attackers to execute arbitrary code
+ and can lead to application crash.
+
+ Impact Level: Application
+
+ Affected Software/OS:
+ Xitami version 2.5c2 and prior.
+
+ Fix: No solution or patch is available as on 05th May, 2009. Information
+ regarding this issue will be updated once the solution details are available.
+ For updates refer, http://www.xitami.com/
+
+ References:
+ http://www.milw0rm.com/exploits/5354
+ http://xforce.iss.net/xforce/xfdb/41644
+ http://xforce.iss.net/xforce/xfdb/41645
+
+ CVSS Score:
+ CVSS Base Score : 10.0 (AV:N/AC:L/Au:NR/C:C/I:C/A:C)
+ CVSS Temporal Score : 9.0
+ Risk factor: Critical";
+
+ script_description(english:desc["english"]);
+ script_summary(english:"Check for the version of Xitami Web Server");
+ script_category(ACT_GATHER_INFO);
+ script_copyright(english:"Copyright (C) 2009 SecPod");
+ script_family(english:"Denial of Service");
+ script_dependencies("secpod_xitami_server_detect.nasl");
+ script_require_keys("Xitami/Ver");
+ exit(0);
+}
+
+
+include("version_func.inc");
+
+xVer = get_kb_item("Xitami/Ver");
+if(xVer == NULL){
+ exit(0);
+}
+
+if(version_is_less_equal(version:xVer, test_version:"2.5.c2")){
+ security_hole(0);
+}
Property changes on: trunk/openvas-plugins/scripts/secpod_xitami_mult_format_string_vuln.nasl
___________________________________________________________________
Name: svn:executable
+ *
Added: trunk/openvas-plugins/scripts/secpod_xitami_server_detect.nasl
===================================================================
--- trunk/openvas-plugins/scripts/secpod_xitami_server_detect.nasl 2009-05-06 04:18:55 UTC (rev 3247)
+++ trunk/openvas-plugins/scripts/secpod_xitami_server_detect.nasl 2009-05-06 06:04:28 UTC (rev 3248)
@@ -0,0 +1,103 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: secpod_xitami_server_detect.nasl 1210 2009-04-28 16:44:19Z apr $
+#
+# Xitami Server Version Detection
+#
+# Authors:
+# Nikita MR <rnikita at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2009 SecPod, http://www.secpod.com
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+ script_id(900547);
+ script_version("Revision: 1.0 ");
+ script_name(english:"Xitami Server Version Detection");
+ desc["english"] = "
+
+ Overview : This script detects the installed version of Xitami Server
+ and saves the result in KB.
+
+ Risk factor : Informational";
+
+ script_description(english:desc["english"]);
+ script_summary(english:"Set KB for the Version of Xitami Server");
+ script_category(ACT_GATHER_INFO);
+ script_copyright(english:"Copyright (C) 2009 SecPod");
+ script_family(english:"Service detection");
+ script_dependencies("find_service.nes");
+ script_require_ports("Services/www", 80, "Services/ftp", 21);
+ exit(0);
+}
+
+
+include("ftp_func.inc");
+include("http_func.inc");
+
+wwwPort = get_http_port(default:80);
+if(!wwwPort){
+ wwwPort = 80;
+}
+
+if(!get_port_state(wwwPort)){
+ exit(0);
+}
+
+soc = open_sock_tcp(wwwPort);
+req = string("GET /\r\n\r\n");
+send(socket:soc, data:req);
+rcvRes = http_recv(socket:soc);
+close(soc);
+
+if("Xitami" >!< rcvRes){
+ exit(0);
+}
+
+xitaVer = eregmatch(pattern:"Xitami\/([0-9]\.[0-9.]+)([a-z][0-9]?)?",
+ string:rcvRes);
+if(xitaVer == NULL)
+{
+ ftpPort = get_kb_item("Services/ftp");
+
+ if(!ftpPort){
+ ftpPort = 21;
+ }
+
+ if(!get_port_state(ftpPort)){
+ exit(0);
+ }
+
+ # Get the version from banner
+ banner = get_ftp_banner(port:ftpPort);
+ xitaVer = eregmatch(pattern:"Xitami.*([0-9]\.[0-9.]+)([a-z][0-9]?)?",
+ string: banner);
+}
+
+if(xitaVer[1] != NULL)
+{
+ if(xitaVer[2] != NULL){
+ xVer = xitaVer[1] + "." + xitaVer[2];
+ }
+ else
+ xVer = xitaVer[1];
+}
+
+if(xVer){
+ set_kb_item(name:"Xitami/Ver", value:xVer);
+}
Property changes on: trunk/openvas-plugins/scripts/secpod_xitami_server_detect.nasl
___________________________________________________________________
Name: svn:executable
+ *
Added: trunk/openvas-plugins/scripts/secpod_xpdf_detect.nasl
===================================================================
--- trunk/openvas-plugins/scripts/secpod_xpdf_detect.nasl 2009-05-06 04:18:55 UTC (rev 3247)
+++ trunk/openvas-plugins/scripts/secpod_xpdf_detect.nasl 2009-05-06 06:04:28 UTC (rev 3248)
@@ -0,0 +1,69 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: secpod_xpdf_detect.nasl 1933 2009-04-27 14:10:29Z apr $
+#
+# Xpdf Version Detection
+#
+# Authors:
+# Sujit Ghosal <sghosal at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2009 SecPod, http://www.secpod.com
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+ script_id(900466);
+ script_version("$Revision: 1.0 $");
+ script_name(english:"Xpdf Version Detection");
+ desc["english"] = "
+
+ Overview: The script detects the version of Xpdf for Linux on
+ remote host and sets the result into KB.
+
+ Risk Factor: Informational";
+
+ script_description(english:desc["english"]);
+ script_summary(english:"Check for Linux Xpdf version");
+ script_category(ACT_GATHER_INFO);
+ script_copyright(english:"Copyright (C) 2009 SecPod");
+ script_family(english:"Service detection");
+ exit(0);
+}
+
+
+include("version_func.inc");
+
+sock = ssh_login_or_reuse_connection();
+if(!sock){
+ exit(0);
+}
+
+xpdfPaths = find_file(file_name:"xpdf", file_path:"/", useregex:TRUE,
+ regexpar:"$", sock:sock);
+foreach xpdfBin (xpdfPaths)
+{
+ xpdfVer = get_bin_version(full_prog_name:chomp(xpdfBin), sock:sock,
+ version_argv:"-v",
+ ver_pattern:"xpdf version ([0-9]\.[0-9]+([a-z]?))");
+ if(xpdfVer[1] != NULL)
+ {
+ set_kb_item(name:"Xpdf/Linux/Ver", value:xpdfVer[1]);
+ ssh_close_connection();
+ exit(0);
+ }
+}
+ssh_close_connection();
Property changes on: trunk/openvas-plugins/scripts/secpod_xpdf_detect.nasl
___________________________________________________________________
Name: svn:executable
+ *
Added: trunk/openvas-plugins/scripts/secpod_xpdf_mult_vuln.nasl
===================================================================
--- trunk/openvas-plugins/scripts/secpod_xpdf_mult_vuln.nasl 2009-05-06 04:18:55 UTC (rev 3247)
+++ trunk/openvas-plugins/scripts/secpod_xpdf_mult_vuln.nasl 2009-05-06 06:04:28 UTC (rev 3248)
@@ -0,0 +1,90 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: secpod_xpdf_mult_vuln.nasl 1933 2009-04-27 14:21:29Z apr $
+#
+# Xpdf Multiple Vulnerabilities
+#
+# Authors:
+# Sujit Ghosal <sghosal at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2009 SecPod, http://www.secpod.com
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+ script_id(900457);
+ script_version("$Revision: 1.0 $");
+ script_bugtraq_id(34568, 34791);
+ script_cve_id("CVE-2009-0195", "CVE-2009-0166", "CVE-2009-0147", "CVE-2009-0146",
+ "CVE-2009-1183", "CVE-2009-1182", "CVE-2009-1181", "CVE-2009-1179",
+ "CVE-2009-0800", "CVE-2009-1180", "CVE-2009-0799", "CVE-2009-0165");
+ script_name(english:"Xpdf Multiple Vulnerabilities");
+ desc["english"] = "
+
+ Overview: This host is installed with Xpdf for Linux and is prone to Multiple
+ Vulnerabilities.
+
+ Vulnerability Insight:
+ - Integer overflow in Xpdf JBIG2 Decoder which allows the attacker create a
+ malicious crafted PDF File and causes code execution.
+ - Flaws in Xpdf JBIG2 Decoder which causes buffer overflow, freeing of
+ arbitrary memory causing Xpdf application to crash.
+
+ Impact:
+ Successful exploitation will let the attacker craft a malicious PDF File and
+ execute arbitrary codes into the context of the affected application to cause
+ denial of service attacks, buffer overflow attacks, remote code executions etc.
+
+ Affected Software/OS:
+ Xpdf version 3.02 and prior on Linux.
+
+ Fix:
+ Apply Xpdf v3.02 pl3 patch.
+ ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.02pl3.patch
+
+ References:
+ http://secunia.com/advisories/34755
+ https://bugzilla.redhat.com/show_bug.cgi?id=495896
+ http://www.redhat.com/support/errata/RHSA-2009-0430.html
+
+ CVSS Score:
+ CVSS Base Score : 10.0 (AV:N/AC:L/Au:NR/C:C/I:C/A:C)
+ CVSS Temporal Score : 7.4
+ Risk factor: High";
+
+ script_description(english:desc["english"]);
+ script_summary(english:"Check for the version of Xpdf");
+ script_category(ACT_GATHER_INFO);
+ script_copyright(english:"Copyright (C) 2009 SecPod");
+ script_family(english:"Buffer overflow");
+ script_dependencies("secpod_xpdf_detect.nasl");
+ script_require_keys("Xpdf/Linux/Ver");
+ exit(0);
+}
+
+
+include("version_func.inc");
+
+xpdfVer = get_kb_item("Xpdf/Linux/Ver");
+if(xpdfVer == NULL){
+ exit(0);
+}
+
+# Grep for Xpdf version 3.02 and prior
+if(version_is_less_equal(version:xpdfVer, test_version:"3.02")){
+ security_hole(0);
+}
Property changes on: trunk/openvas-plugins/scripts/secpod_xpdf_mult_vuln.nasl
___________________________________________________________________
Name: svn:executable
+ *
More information about the Openvas-commits
mailing list