[Openvas-commits] r3456 - in trunk/openvas-plugins: . scripts

scm-commit@wald.intevation.org scm-commit at wald.intevation.org
Fri May 22 10:20:19 CEST 2009


Author: chandra
Date: 2009-05-22 10:20:17 +0200 (Fri, 22 May 2009)
New Revision: 3456

Added:
   trunk/openvas-plugins/scripts/gb_mcafee_groupshield_detect.nasl
   trunk/openvas-plugins/scripts/gb_mcafee_groupshield_exchange_sec_bypass_vuln.nasl
   trunk/openvas-plugins/scripts/secpod_mini_stream_castripper_bof_vuln.nasl
Modified:
   trunk/openvas-plugins/ChangeLog
   trunk/openvas-plugins/scripts/gb_electrasoft_32bit_ftp_bof_vuln.nasl
   trunk/openvas-plugins/scripts/secpod_mini_stream_prdts_detect.nasl
Log:
checkedin 3 New scripts, Added CVE to 32bit ftp and Cast Ripper check added.

Modified: trunk/openvas-plugins/ChangeLog
===================================================================
--- trunk/openvas-plugins/ChangeLog	2009-05-22 06:49:17 UTC (rev 3455)
+++ trunk/openvas-plugins/ChangeLog	2009-05-22 08:20:17 UTC (rev 3456)
@@ -1,4 +1,14 @@
 2009-05-22 Chandan S <schandan at secpod.com>
+	* scripts/gb_mcafee_groupshield_exchange_sec_bypass_vuln.nasl,
+	scripts/secpod_mini_stream_castripper_bof_vuln.nasl,
+	scripts/gb_mcafee_groupshield_detect.nasl:
+	Committed 3 New scripts.
+
+	* scripts/gb_electrasoft_32bit_ftp_bof_vuln.nasl,
+	scripts/secpod_mini_stream_prdts_detect.nasl:
+	Added New CVE to 32bit ftp and Cast Ripper check.
+
+2009-05-22 Chandan S <schandan at secpod.com>
 	* scripts/gb_koschtit_image_gallery_dir_trav_vuln.nasl,
 	scripts/secpod_java_jre_actvx_ctrl_mult_bof_vuln.nasl,
 	scripts/secpod_mini_stream_rm_downloader_bof_vuln.nasl,

Modified: trunk/openvas-plugins/scripts/gb_electrasoft_32bit_ftp_bof_vuln.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_electrasoft_32bit_ftp_bof_vuln.nasl	2009-05-22 06:49:17 UTC (rev 3455)
+++ trunk/openvas-plugins/scripts/gb_electrasoft_32bit_ftp_bof_vuln.nasl	2009-05-22 08:20:17 UTC (rev 3456)
@@ -27,8 +27,8 @@
 if(description)
 {
   script_id(800569);
-  script_version("$Revision: 1.0 $");
-  script_cve_id("CVE-2009-1592", "CVE-2009-1611");
+  script_version("$Revision: 1.1 $");
+  script_cve_id("CVE-2009-1592", "CVE-2009-1611", "CVE-2009-1675");
   script_bugtraq_id(34822, 34838);
   script_name(english:"ElectraSoft 32bit FTP Buffer Overflow Vulnerability");
   desc["english"] = "
@@ -40,28 +40,30 @@
   A boundary error occurs while processing,
   - response received from an FTP server with overly long banners.
   - a overly long 257 reply to a CWD command.
+  - a overly long 227 reply to a PASV command.
 
   Impact: Successful exploitation will let the attacker execute arbitrary
   codes within the context of the application by connecting to malicious
-  FTP servers.
+  FTP servers or can cause the application to crash.
 
   Affected Software/OS:
-  ElectraSoft 32bit FTP 09.04.24 and prior on all Windows platforms.
+  ElectraSoft 32bit FTP 09.04.24 and prior on Windows
 
-  Fix: No solution or patch is available as on 13th May, 2009.Information
-  regarding this issue will be updated once the solution details are available.
-  For updates refer, http://www.electrasoft.com/32ftp.htm
+  Fix: Upgrade to 32bit FTP version 09.05.01
+  http://www.electrasoft.com/32ftp.htm
 
   References:
+  http://secunia.com/advisories/34993
   http://www.milw0rm.com/exploits/8614
   http://www.milw0rm.com/exploits/8613
-  http://secunia.com/advisories/34993/
-  http://en.securitylab.ru/nvd/379298.php
+  http://www.milw0rm.com/exploits/8623
+  http://www.electrasoft.com/readmef.txt
+  http://xforce.iss.net/xforce/xfdb/50337
 
   CVSS Score:
-    CVSS Base Score     : 7.5 (AV:N/AC:L/Au:NR/C:P/I:P/A:P)
-    CVSS Temporal Score : 6.7
-  Risk factor: High ";
+    CVSS Base Score     : 9.3 (AV:N/AC:M/Au:NR/C:C/I:C/A:C)
+    CVSS Temporal Score : 7.3
+  Risk factor: High";
 
   script_description(english:desc["english"]);
   script_summary(english:"Check for the version of ElectraSoft 32bit FTP");
@@ -76,11 +78,11 @@
 
 include("version_func.inc");
 
-ftpVer = get_kb_item("ElectraSoft/FTP/Ver");
-if(!ftpVer){
+bitftpVer = get_kb_item("ElectraSoft/FTP/Ver");
+if(!bitftpVer){
   exit(0);
 }
 
-if(version_is_less_equal(version:ftpVer, test_version:"09.04.24")){
+if(version_is_less_equal(version:bitftpVer, test_version:"09.04.24")){
   security_hole(0);
 }

Added: trunk/openvas-plugins/scripts/gb_mcafee_groupshield_detect.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_mcafee_groupshield_detect.nasl	2009-05-22 06:49:17 UTC (rev 3455)
+++ trunk/openvas-plugins/scripts/gb_mcafee_groupshield_detect.nasl	2009-05-22 08:20:17 UTC (rev 3456)
@@ -0,0 +1,70 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: gb_mcafee_groupshield_detect.nasl 2158 2009-05-13 10:07:05Z may $
+#
+# McAfee GroupShield Version Detection
+#
+# Authors:
+# Antu Sanadi <santu at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2009 Intevation GmbH, http://www.intevation.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+  script_id(800618);
+  script_version("$Revision: 1.0 $");
+  script_name(english:"McAfee GroupShield Version Detection");
+  desc["english"] = "
+
+  Overview: This script detects the installed version of McAfee GroupShield
+  for Exchange and sets the result in KB.
+
+  Risk factor: Informational";
+
+  script_description(english:desc["english"]);
+  script_summary(english:"Sets KB for the version of McAfee GroupShield");
+  script_category(ACT_GATHER_INFO);
+  script_copyright(english:"Copyright (C) 2009 Intevation GmbH");
+  script_family(english:"Service detection");
+  script_dependencies("secpod_reg_enum.nasl");
+  script_require_keys("SMB/WindowsVersion");
+  exit(0);
+}
+
+
+include("smb_nt.inc");
+include("secpod_smb_func.inc");
+
+if(!get_kb_item("SMB/WindowsVersion")){
+  exit(0);
+}
+
+groupshieldKey = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\";
+foreach item(registry_enum_keys(key:groupshieldKey))
+{
+  groupName = registry_get_sz(key:groupshieldKey + item, item:"DisplayName");
+  if("McAfee GroupShield" >< groupName && "Exchange" >< groupName)
+  {
+    groupshieldVer = registry_get_sz(key:groupshieldKey + item,
+                                    item:"DisplayVersion");
+    if(groupshieldVer != NULL){
+      set_kb_item(name:"McAfee/GroupShield/Exchange/Ver", value:groupshieldVer);
+    }
+    exit(0);
+  }
+}

Added: trunk/openvas-plugins/scripts/gb_mcafee_groupshield_exchange_sec_bypass_vuln.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_mcafee_groupshield_exchange_sec_bypass_vuln.nasl	2009-05-22 06:49:17 UTC (rev 3455)
+++ trunk/openvas-plugins/scripts/gb_mcafee_groupshield_exchange_sec_bypass_vuln.nasl	2009-05-22 08:20:17 UTC (rev 3456)
@@ -0,0 +1,87 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: gb_mcafee_groupshield_exchange_sec_bypass_vuln.nasl 2158 2009-05-14 20:07:05Z may $
+#
+# McAfee GroupShield for Exchange X-Header Security Bypass Vulnerability
+#
+# Authors:
+# Antu Sanadi <santu at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2009 Intevation GmbH, http://www.intevation.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+##############################################################################
+
+if(description)
+{
+  script_id(800619);
+  script_version("$Revision: 1.0 $");
+  script_cve_id("CVE-2009-1491");
+  script_bugtraq_id(34949);
+  script_name(english:"McAfee GroupShield for Exchange X-Header Security Bypass Vulnerability");
+  desc["english"] = "
+
+  Overview: This host is installed McAfee GroupShield for Microsoft Exchange and
+  is prone to X-Header Security Bypass Vulnerability.
+
+  Vulnerability Insight:
+  This flaw is caused due to failure in scanning X-Headers while sending mail
+  messages.
+
+  Impact:
+  Successful exploits will let the attacker craft malicious contents inside the
+  X-Header and can bypass antivirus detection and launch further attacks into
+  the affected system.
+
+  Impact Level: System
+
+  Affected Software/OS:
+  McAfee GroupShield for Exchange version 6.0.616.102 and prior.
+
+  Fix: No solution or patch is available as on 22nd May, 2009. Information
+  regarding this issue will be updated once the solution details are available.
+  For updates refer,
+  http://www.mcafee.com/us/enterprise/products/anti_virus/email_servers/groupshield_microsoft_exchange.html
+
+  References:
+  http://xforce.iss.net/xforce/xfdb/50354
+  http://www.nmrc.org/~thegnome/blog/apr09
+
+  CVSS Score:
+   CVSS Base Score     : 9.3 (AV:N/AC:M/Au:NR/C:C/I:C/A:C)
+   CVSS Temporal Score : 8.4
+  Risk factor: Critical";
+
+  script_description(english:desc["english"]);
+  script_summary(english:"Check for the version of McAfee GroupShield Exchange");
+  script_category(ACT_GATHER_INFO);
+  script_copyright(english:"Copyright (C) 2009 Intevation GmbH");
+  script_family(english:"SMTP problems");
+  script_dependencies("gb_mcafee_groupshield_detect.nasl");
+  script_require_keys("McAfee/GroupShield/Exchange/Ver");
+  exit(0);
+}
+
+
+include("version_func.inc");
+
+groupVer = get_kb_item("McAfee/GroupShield/Exchange/Ver");
+if(groupVer != NULL)
+{
+  # Grep for McAfee Groupshield for Exchange version 6.0.616.102
+  if(version_is_less_equal(version:groupVer, test_version:"6.0.616.102")){
+    security_hole(0);
+  }
+}

Added: trunk/openvas-plugins/scripts/secpod_mini_stream_castripper_bof_vuln.nasl
===================================================================
--- trunk/openvas-plugins/scripts/secpod_mini_stream_castripper_bof_vuln.nasl	2009-05-22 06:49:17 UTC (rev 3455)
+++ trunk/openvas-plugins/scripts/secpod_mini_stream_castripper_bof_vuln.nasl	2009-05-22 08:20:17 UTC (rev 3456)
@@ -0,0 +1,88 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: secpod_mini_stream_castripper_bof_vuln.nasl 2383 2009-05-18 15:15:24Z may $
+#
+# Mini-stream CastRipper Stack Overflow Vulnerability
+#
+# Authors:
+# Antu Sanadi <santu at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2009 SecPod, http://www.secpod.com
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+  script_id(900651);
+  script_version("Revision: 1.0");
+  script_cve_id("CVE-2009-1667");
+  script_name(english:"Mini-stream CastRipper Stack Overflow Vulnerability");
+  desc["english"] = "
+
+  Overview:
+  This host is installed with Mini-Stream CastRipper and is prone to Stack
+  Overflow Vulnerability.
+
+  Vulnerability Insight:
+  This flaw is due to a boundary error check when processing user supplied
+  input data through '.M3U' files with overly long URI.
+
+  Impact:
+  Successful exploitation will let the attacker execute arbitrary codes into
+  the contenxt of the application and can crash the application.
+
+  Impact Level: Application.
+
+  Affected Software/OS:
+  CastRipper version 2.50.70 (2.9.6.0) and prior.
+  CastRipper version 2.10.00
+
+  Fix: No solution or patch is available as on 22nd May, 2009. Information
+  regarding this issue will be updated once the solution details are available
+  For updates refer, http://mini-stream.net/castripper
+
+  References:
+  http://secunia.com/advisories/35069
+  http://www.milw0rm.com/exploits/8660
+  http://www.milw0rm.com/exploits/8661
+  http://www.milw0rm.com/exploits/8662
+
+  CVSS Score:
+    CVSS Base Score      : 9.3 (AV:N/AC:M/Au:NR/C:C/I:C/A:C)
+    CVSS Temporal Score  : 8.4
+  Risk factor: Critical";
+
+  script_description(english:desc["english"]);
+  script_summary(english:"Checks for the version of Mini Stream CastRipper");
+  script_category(ACT_GATHER_INFO);
+  script_copyright(english:"Copyright (C) 2009 SecPod");
+  script_family(english:"Buffer overflow");
+  script_dependencies("secpod_mini_stream_prdts_detect.nasl");
+  exit(0);
+}
+
+
+include("version_func.inc");
+
+castripperVer = get_kb_item("MiniStream/CastRipper/Ver");
+if(castripperVer)
+{
+   # Ministream CastRipper 2.50.70 points to version 2.9.6.0 & version 2.10.00
+   if(version_is_less_equal(version:castripperVer, test_version:"2.9.6.0") ||
+      version_is_equal(version:castripperVer, test_version:"2.10.00")){
+    security_hole(0);
+  }
+}

Modified: trunk/openvas-plugins/scripts/secpod_mini_stream_prdts_detect.nasl
===================================================================
--- trunk/openvas-plugins/scripts/secpod_mini_stream_prdts_detect.nasl	2009-05-22 06:49:17 UTC (rev 3455)
+++ trunk/openvas-plugins/scripts/secpod_mini_stream_prdts_detect.nasl	2009-05-22 08:20:17 UTC (rev 3456)
@@ -59,8 +59,9 @@
 ssRecName = registry_get_sz(key:key+item1, item:"DisplayName");
 ssRVer = eregmatch(pattern:"([0-9.]+)", string:ssRecName);
 
-if(ssRVer[1]!=NULL){
-# set the version of Mini-stream Shadow Stream Recorder
+if(ssRVer[1]!=NULL)
+{
+  # set the version of Mini-stream Shadow Stream Recorder
   set_kb_item(name:"MiniStream/SSRecorder/Ver", value:ssRVer[1]);
 }
 
@@ -68,8 +69,9 @@
 rmTmp = registry_get_sz(key:key+item2, item:"DisplayName");
 rmTmpVer = eregmatch(pattern:"([0-9]\.[0-9]\.[0-9.]+)", string:rmTmp);
 
-if(rmTmpVer[1]!=NULL){
-#set the version of Mini-stream RM-MP3 Converter
+if(rmTmpVer[1]!=NULL)
+{
+  #set the version of Mini-stream RM-MP3 Converter
   set_kb_item(name:"MiniStream/RmToMp3/Conv/Ver", value:rmTmpVer[1]);
 }
 
@@ -77,8 +79,9 @@
 wmDown = registry_get_sz(key:key+item3, item:"DisplayName");
 wmDownVer = eregmatch(pattern:"([0-9.]+)", string:wmDown);
 
-if(wmDownVer[1]!=NULL){
-#set the version of Mini-stream WM Downloader
+if(wmDownVer[1]!=NULL)
+{
+  #set the version of Mini-stream WM Downloader
   set_kb_item(name:"MiniStream/WMDown/Ver", value:wmDownVer[1]);
 }
 
@@ -86,8 +89,9 @@
 rmDown = registry_get_sz(key:key+item4, item:"DisplayName");
 rmDownVer = eregmatch(pattern:"([0-9.]+)", string:rmDown);
 
-if(rmDownVer[1]!=NULL){
-#set the version of Mini-stream RM Downloader
+if(rmDownVer[1]!=NULL)
+{
+  #set the version of Mini-stream RM Downloader
   set_kb_item(name:"MiniStream/RMDown/Ver", value:rmDownVer[1]);
 }
 
@@ -95,8 +99,9 @@
 asx2mpName= registry_get_sz(key:key+item5, item:"DisplayName");
 asx2mpVer = eregmatch(pattern:"([0-9]\.[0-9]\.[0-9.]+)", string:asx2mpName);
 
-if(asx2mpVer[1]!=NULL){
-#set the version of Mini-stream ASX to MP3 Converter
+if(asx2mpVer[1]!=NULL)
+{
+  #set the version of Mini-stream ASX to MP3 Converter
   set_kb_item(name:"MiniStream/AsxToMp3/Conv/Ver", value:asx2mpVer[1]);
 }
 
@@ -104,7 +109,20 @@
 msRipper = registry_get_sz(key:key+item6, item:"DisplayName");
 msRipperVer = eregmatch(pattern:"([0-9.]+)", string:msRipper);
 
-if(msRipperVer[1]!=NULL){
-#set the version of Mini-stream Ripper
+if(msRipperVer[1]!=NULL)
+{
+  #set the version of Mini-stream Ripper
   set_kb_item(name:"MiniStream/Ripper/Ver", value:msRipperVer[1]);
 }
+
+
+item7 = "CastRipper_is1\";
+nameRipper = registry_get_sz(key:key+item7, item:"Publisher");
+if("Mini-stream" >< nameRipper)
+{
+  castripperVer = registry_get_sz(key:key+item7, item:"DisplayName");
+  castripperVer = eregmatch(pattern:"([0-9.]+)", string:castripperVer);
+  if(castripperVer[1] != NULL){
+       set_kb_item(name:"MiniStream/CastRipper/Ver", value:castripperVer[1]);
+  }
+} 



More information about the Openvas-commits mailing list