phpinfo()

Please note: OpenVAS 2 series was released recently and may not yet be @@ -335,7 +342,7 @@ http://www.freshports.org.

Latest source code release

Latest source code release (Version 2.0.x)

The download link for the latest source code release can @@ -370,7 +377,7 @@ Repeat for each module and read the corresponding INSTALL or README files.

Most current state of development (directly from the source code management system)

Most current state of development (directly from the source code management system) (Version 2.0.x)


+$ svn checkout https://svn.wald.intevation.org/svn/openvas/branches/openvas-libraries-2-0

+$ svn checkout https://svn.wald.intevation.org/svn/openvas/branches/openvas-libnasl-2-0

+$ svn checkout https://svn.wald.intevation.org/svn/openvas/branches/openvas-server-2-0

+$ svn checkout https://svn.wald.intevation.org/svn/openvas/trunk/openvas-plugins

+

+Now read the file INSTALL_README +inside the directory "openvas-libraries" for the next steps. +

+Do the same openvas-server module and read the corresponding INSTALL or README files. +

+Note for the SVN build: Although the OpenVAS team is committed to maintaining high code quality, please +be aware that you are using a development state that may be incomplete and +unstable and should not be used in production environments. +

Most current state of development (directly from the source code management system) (Version 3.0.x)


 $ svn checkout https://svn.wald.intevation.org/svn/openvas/trunk/openvas-libraries

-$ svn checkout https://svn.wald.intevation.org/svn/openvas/trunk/openvas-server

+$ svn checkout https://svn.wald.intevation.org/svn/openvas/trunk/openvas-scanner

-Now read the file INSTALL_README +


+$ svn checkout https://svn.wald.intevation.org/svn/openvas/trunk/openvas-manager

+$ svn checkout https://svn.wald.intevation.org/svn/openvas/trunk/openvas-administrator

+

From scm-commit at wald.intevation.org Mon Oct 5 19:43:10 2009 From: scm-commit at wald.intevation.org (scm-commit@wald.intevation.org) Date: Mon, 5 Oct 2009 19:43:10 +0200 (CEST) Subject: [Openvas-commits] r5376 - in trunk/openvas-plugins: . scripts Message-ID: <20091005174310.A0FE2852FD79@pyrosoma.intevation.org> Author: mime Date: 2009-10-05 19:43:01 +0200 (Mon, 05 Oct 2009) New Revision: 5376 Added: trunk/openvas-plugins/scripts/apcnisd_detect.nasl trunk/openvas-plugins/scripts/cvs_pserver_heap_overflow.nasl trunk/openvas-plugins/scripts/cvspserver_version.nasl trunk/openvas-plugins/scripts/ms_telnet_overflow.nasl trunk/openvas-plugins/scripts/sympa_detect.nasl Modified: trunk/openvas-plugins/ChangeLog trunk/openvas-plugins/scripts/cvs_file_existence_info_weak.nasl trunk/openvas-plugins/scripts/cvs_malformed_entry_lines_flaw.nasl trunk/openvas-plugins/scripts/http_header_name_format_string.nasl trunk/openvas-plugins/scripts/monkeyweb_post_DoS.nasl trunk/openvas-plugins/scripts/mssql_brute_force.nasl trunk/openvas-plugins/scripts/secpod_ibm_db2_detect_win_900218.nasl trunk/openvas-plugins/scripts/secpod_prochatrooms_dir_trav_n_xss_vuln.nasl trunk/openvas-plugins/scripts/sybase_blank_password.nasl trunk/openvas-plugins/scripts/webmirror.nasl Log: Added new plugins Modified: trunk/openvas-plugins/ChangeLog =================================================================== --- trunk/openvas-plugins/ChangeLog 2009-10-05 13:53:32 UTC (rev 5375) +++ trunk/openvas-plugins/ChangeLog 2009-10-05 17:43:01 UTC (rev 5376) @@ -1,3 +1,32 @@ +2009-10-05 Michael Meyer + + * scripts/cvspserver_version.nasl, + scripts/apcnisd_detect.nasl, + scripts/cvs_pserver_heap_overflow.nasl: + Added new plugins. + + * scripts/secpod_ibm_db2_detect_win_900218.nasl, + scripts/monkeyweb_post_DoS.nasl, + scripts/http_header_name_format_string.nasl, + scripts/secpod_prochatrooms_dir_trav_n_xss_vuln.nasl: + Bugfixes. + + * scripts/cvs_malformed_entry_lines_flaw.nasl, + scripts/cvs_file_existence_info_weak.nasl: + Added cvspserver_version.nasl as dependency. + + * scripts/webmirror.nasl: + Removed debug stuff. + + * scripts/sybase_blank_password.nasl, + scripts/mssql_brute_force.nasl: + Removed dependency "sybase_detect.nasl". Both scripts can do + their job without these dependency. + + * scripts/sympa_detect.nasl, + scripts/ms_telnet_overflow.nasl: + Added plugins developed by LSS Security Team. + 2009-10-05 Chandrashekhar B * scripts/gb_opera_cmd_exec_n_xss_vuln_lin.nasl, Added: trunk/openvas-plugins/scripts/apcnisd_detect.nasl =================================================================== --- trunk/openvas-plugins/scripts/apcnisd_detect.nasl 2009-10-05 13:53:32 UTC (rev 5375) +++ trunk/openvas-plugins/scripts/apcnisd_detect.nasl 2009-10-05 17:43:01 UTC (rev 5376) @@ -0,0 +1,78 @@ +############################################################################### +# OpenVAS Vulnerability Test +# $Id$ +# +# apcupsd and apcnisd Detection Detection +# +# Authors: +# Michael Meyer +# +# Copyright: +# Copyright (c) 2009 Greenbone Networks GmbH +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 +# (or any later version), as published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +############################################################################### + +if (description) +{ + script_id(100292); + script_version ("1.0-$Revision$"); + + desc = "Overview: + This host is running apcupsd or apcnisd . apcupsd and apcnisd + can be used for power mangement and controlling of APC's UPS + models. + + See also: + http://www.apcupsd.com/ + + Risk factor : None"; + + script_name("apcupsd and apcnisd Detection Detection"); + script_description(desc); + script_summary("Checks for the presence of apcupsd or apcnisd"); + script_category(ACT_GATHER_INFO); + script_family("Service detection"); + script_copyright("This script is Copyright (C) 2009 Greenbone Networks GmbH"); + script_dependencies("find_service.nes"); + script_require_ports("Services/unknown", 3551, 7000); + exit(0); +} + +include("misc_func.inc"); +include("global_settings.inc"); + +ports = make_list(7000, 3551); + +foreach port (ports) { + + if(!get_port_state(port))continue; + soc = open_sock_tcp(port); + if(!soc)continue; + req = raw_string(0x00, 0x06); + req += string("status"); + + send(socket:soc, data:req); + buf = recv(socket:soc, length:4096); + + if("APC" >< buf && "STATUS" >< buf) { + register_service(port:port, proto:"apcnisd"); + if(report_verbosity > 0) { + security_note(port:port); + exit(0); + } + } +} + +exit(0); Property changes on: trunk/openvas-plugins/scripts/apcnisd_detect.nasl ___________________________________________________________________ Name: svn:keywords + Id Revision Modified: trunk/openvas-plugins/scripts/cvs_file_existence_info_weak.nasl =================================================================== --- trunk/openvas-plugins/scripts/cvs_file_existence_info_weak.nasl 2009-10-05 13:53:32 UTC (rev 5375) +++ trunk/openvas-plugins/scripts/cvs_file_existence_info_weak.nasl 2009-10-05 17:43:01 UTC (rev 5376) @@ -43,8 +43,8 @@ script_copyright("This script is Copyright (C) 2004 David Maciejak"); family = "General"; script_family(family); - script_require_ports("Services/cvspserver", port); - script_dependencies("find_service.nes", "cvs_pserver_heap_overflow.nasl"); + script_require_ports("Services/cvspserver", 2401); + script_dependencies("find_service.nes", "cvspserver_version.nasl"); exit(0); } Modified: trunk/openvas-plugins/scripts/cvs_malformed_entry_lines_flaw.nasl =================================================================== --- trunk/openvas-plugins/scripts/cvs_malformed_entry_lines_flaw.nasl 2009-10-05 13:53:32 UTC (rev 5375) +++ trunk/openvas-plugins/scripts/cvs_malformed_entry_lines_flaw.nasl 2009-10-05 17:43:01 UTC (rev 5376) @@ -51,8 +51,8 @@ script_copyright("This script is Copyright (C) 2004 David Maciejak"); family = "General"; script_family(family); - script_require_ports("Services/cvspserver", port); - script_dependencies("find_service.nes", "cvs_pserver_heap_overflow.nasl"); + script_require_ports("Services/cvspserver", 2401); + script_dependencies("find_service.nes", "cvspserver_version.nasl"); exit(0); } Added: trunk/openvas-plugins/scripts/cvs_pserver_heap_overflow.nasl =================================================================== --- trunk/openvas-plugins/scripts/cvs_pserver_heap_overflow.nasl 2009-10-05 13:53:32 UTC (rev 5375) +++ trunk/openvas-plugins/scripts/cvs_pserver_heap_overflow.nasl 2009-10-05 17:43:01 UTC (rev 5376) @@ -0,0 +1,94 @@ +############################################################################### +# OpenVAS Vulnerability Test +# $Id$ +# +# CVS Malformed Entry Modified and Unchanged Flag Insertion Heap Overflow Vulnerability +# +# Authors: +# Michael Meyer +# +# Copyright: +# Copyright (c) 2009 Greenbone Networks GmbH +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 +# (or any later version), as published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +############################################################################### + +if (description) +{ + script_id(100289); + script_bugtraq_id(10384); + script_cve_id("CVE-2004-0396"); + script_version ("1.0-$Revision$"); + + script_name("CVS Malformed Entry Modified and Unchanged Flag Insertion Heap Overflow Vulnerability"); + +desc = "Overview: +CVS is prone to a remote heap overflow vulnerability. This issue +presents itself during the handling of user-supplied input for entry +lines with 'modified' and 'unchanged' flags. This vulnerability can +allow an attacker to overflow a vulnerable buffer on the heap, +possibly leading to arbitrary code execution. + +CVS versions 1.11.15 and prior and CVS feature versions 1.12.7 and +prior are prone to this issue. + +**UPDATE: Symantec has confirmed that this vulnerability is being +actively exploited in the wild. Administrators are urged to +upgrade and block external access to potentially vulnerable +servers, if possible. + +Solution: +CVS versions 1.11.16 and 1.12.8 have been released to address +this issue. + +References: +http://www.securityfocus.com/bid/10384 +http://security.e-matters.de/advisories/072004.html?SID=384b888de96e3bce19306db8577fca26 +http://support.coresecurity.com/impact/exploits/62024ecea12fe1bbd01479065b3a1797.html +http://ccvs.cvshome.org/ +http://marc.theaimsgroup.com/?l=openbsd-security-announce&m=108508894405639&w=2 +http://rhn.redhat.com/errata/RHSA-2004-190.html +http://www.us-cert.gov/cas/techalerts/TA04-147A.html + +Risk factor : Medium"; + + script_description(desc); + script_summary("Determine if CVS is prone to a remote heap overflow vulnerability"); + script_category(ACT_GATHER_INFO); + script_family("General"); + script_copyright("This script is Copyright (C) 2009 Greenbone Networks GmbH"); + script_dependencies("cvspserver_version.nasl"); + script_require_ports("Services/cvspserver", 2401); + exit(0); +} + +include("version_func.inc"); + +port = get_kb_item("Services/cvspserver"); +if(!port)port = 2401; + +if(!get_port_state(port))exit(0); + +if(!version = get_kb_item(string("cvs/", port, "/version")))exit(0); +if(!isnull(version)) { + + if(version_is_less(version: version, test_version: "1.11.15") || + version_in_range(version: version, test_version: "1.12", test_version2: "1.12.7")) { + security_warning(port:port); + exit(0); + } + +} + +exit(0); Property changes on: trunk/openvas-plugins/scripts/cvs_pserver_heap_overflow.nasl ___________________________________________________________________ Name: svn:keywords + Id Revision Added: trunk/openvas-plugins/scripts/cvspserver_version.nasl =================================================================== --- trunk/openvas-plugins/scripts/cvspserver_version.nasl 2009-10-05 13:53:32 UTC (rev 5375) +++ trunk/openvas-plugins/scripts/cvspserver_version.nasl 2009-10-05 17:43:01 UTC (rev 5376) @@ -0,0 +1,97 @@ +############################################################################### +# OpenVAS Vulnerability Test +# $Id$ +# +# CVS pserver version Detection +# +# Authors: +# Michael Meyer +# +# Copyright: +# Copyright (c) 2009 Greenbone Networks GmbH +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 +# (or any later version), as published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +############################################################################### + +if (description) +{ + script_id(100288); + script_version ("1.0-$Revision$"); + + script_name("CVS pserver version"); + + desc = "Overview : This script retrieves the version of CVS pserver + and saves the result in KB. + + Risk factor : Informational"; + + script_description(desc); + script_summary("Set Version of CVS pserver in KB"); + script_category(ACT_GATHER_INFO); + script_family("Service detection"); + script_copyright("This script is Copyright (C) 2009 Greenbone Networks GmbH"); + script_dependencies("find_service.nes"); + script_require_ports("Services/cvspserver", 2401); + exit(0); +} + +port = get_kb_item("Services/cvspserver"); +if(!port)port = 2401; +if(!get_port_state(port))exit(0); + +logins = make_list("anonymous", "anoncvs"); +passwords = make_list("","anoncvs", "anon"); +dirs = make_list("/var/lib/cvsd/","/cvs", "/cvsroot", "/home/ncvs", "/usr/local/cvs"); + +foreach dir (dirs) { + foreach login (logins) { + foreach password (passwords) { + + soc = open_sock_tcp(port); + if(!soc)exit(0); + + req = string("BEGIN AUTH REQUEST\n", dir, "\n", login,"\n", "A", pass,"\n", "END AUTH REQUEST\n"); + send(socket:soc, data:req); + buf = recv_line(socket:soc, length:4096); + + if("I LOVE YOU" >< buf) { + + set_kb_item(name:string("cvs/", port, "/login"), value:login); + set_kb_item(name:string("cvs/", port, "/pass"), value:password); + set_kb_item(name:string("cvs/", port, "/dir"), value:dir); + + send(socket:soc, data:string("Root ", dir, "\nversion\n")); + buf = recv_line(socket:soc, length:4096); + + if(egrep(string: buf, pattern: "CVS", icase:TRUE)) { + + version = eregmatch(string:buf, pattern:"([0-9.]+)"); + + if(!isnull(version[1])) { + set_kb_item(name:string("cvs/", port, "/version"), value:version[1]); + exit(0); + } else { + exit(0);; + } + } else { + exit(0); + } + } else { + continue; + } + } + } +} + +exit(0); Property changes on: trunk/openvas-plugins/scripts/cvspserver_version.nasl ___________________________________________________________________ Name: svn:keywords + Id Revision Modified: trunk/openvas-plugins/scripts/http_header_name_format_string.nasl =================================================================== --- trunk/openvas-plugins/scripts/http_header_name_format_string.nasl 2009-10-05 13:53:32 UTC (rev 5375) +++ trunk/openvas-plugins/scripts/http_header_name_format_string.nasl 2009-10-05 17:43:01 UTC (rev 5376) @@ -51,8 +51,7 @@ if (! get_port_state(port)) exit(0); if (http_is_dead(port: port)) exit(0); -req = http_get(item: strcat("/openvas", rand_str(), ".html"), - "Host: ", get_host_name(), port: port); +req = http_get(item: strcat("/openvas", rand_str(), ".html"), port: port); soc = http_open_socket(port); if (! soc) exit(0); Modified: trunk/openvas-plugins/scripts/monkeyweb_post_DoS.nasl =================================================================== --- trunk/openvas-plugins/scripts/monkeyweb_post_DoS.nasl 2009-10-05 13:53:32 UTC (rev 5375) +++ trunk/openvas-plugins/scripts/monkeyweb_post_DoS.nasl 2009-10-05 17:43:01 UTC (rev 5376) @@ -59,8 +59,7 @@ soc = http_open_socket(port); if (! soc) exit(0); -r = http_post(item: "/", "Host: ", get_host_name(), - port: port, data: ""); +r = http_post(item: "/", port: port, data: ""); r2 = ereg_replace(string: r, pattern: 'Content-Length:([ 0-9]+)', replace: 'Content-Length:'); if (r2 == r) # Did not match? Added: trunk/openvas-plugins/scripts/ms_telnet_overflow.nasl =================================================================== --- trunk/openvas-plugins/scripts/ms_telnet_overflow.nasl 2009-10-05 13:53:32 UTC (rev 5375) +++ trunk/openvas-plugins/scripts/ms_telnet_overflow.nasl 2009-10-05 17:43:01 UTC (rev 5376) @@ -0,0 +1,90 @@ +################################################################### +# OpenVAS Network Vulnerability Test +# $ID$ +# +# MS Telnet Overflow +# +# LSS-NVT-2009-008 +# +# Developed by LSS Security Team +# +# Copyright (C) 2009 LSS +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program. If not, see +# . +################################################################### + +if(description) +{ + script_id(102008); + script_version("1.0-$Revision$"); + script_bugtraq_id(4061); + script_cve_id("CVE-2002-0020"); + + name = "MS Telnet Overflow"; + script_name(name); + + desc = " +It is possible to crash remote telnet server via malformed protocol options. +This flaw may allow attackers to execute arbitrary code on the system. + +Solution: http://www.microsoft.com/technet/security/bulletin/ms02-004.mspx + +Risk factor :High +"; + + script_description(desc); + + summary = "Attempts to overflow the Telnet server buffer"; + script_summary(summary); + + script_category(ACT_DESTRUCTIVE_ATTACK); + + script_copyright("Copyright (C) 2009 LSS"); + family = "Buffer overflow"; + script_family(family); + script_require_ports("Services/telnet", 23); + exit(0); +} + +##ATTACK## +##Vulnerability tested on AYT commands## +function telnet_attack(port){ + iac_ayt = raw_string(0xff, 0xf6); + bomb_size = 100000; + sock = open_sock_tcp(port); + if(sock){ + bomb = crap(data:iac_ayt, length:2*bomb_size); + send(socket:sock, data:bomb); + close(sock); + return(1); + }else{ + log_message(data:'Can\'t connect to port ' + port); + return(0); + } +} + +##MAIN## +port = get_kb_item("Services/telnet"); +if(!port) port = 23; + +if(telnet_attack(port:port)){ + sock = open_sock_tcp(port); + if(!sock){ + security_hole(port); + }else{ + close(sock); + } +}else exit(-1); + Property changes on: trunk/openvas-plugins/scripts/ms_telnet_overflow.nasl ___________________________________________________________________ Name: svn:keywords + Id Revision Modified: trunk/openvas-plugins/scripts/mssql_brute_force.nasl =================================================================== --- trunk/openvas-plugins/scripts/mssql_brute_force.nasl 2009-10-05 13:53:32 UTC (rev 5375) +++ trunk/openvas-plugins/scripts/mssql_brute_force.nasl 2009-10-05 17:43:01 UTC (rev 5376) @@ -48,7 +48,7 @@ family = "Windows"; script_family(family); script_require_ports("Services/mssql", 1433); - script_dependencie("mssqlserver_detect.nasl", "sybase_detect.nasl"); + script_dependencie("mssqlserver_detect.nasl"); exit(0); } @@ -190,7 +190,7 @@ report = ""; port = get_kb_item("Services/mssql"); -if(!port) port = get_kb_item("Services/sybase"); +#if(!port) port = get_kb_item("Services/sybase"); if(!port) port = 1433; Modified: trunk/openvas-plugins/scripts/secpod_ibm_db2_detect_win_900218.nasl =================================================================== --- trunk/openvas-plugins/scripts/secpod_ibm_db2_detect_win_900218.nasl 2009-10-05 13:53:32 UTC (rev 5375) +++ trunk/openvas-plugins/scripts/secpod_ibm_db2_detect_win_900218.nasl 2009-10-05 17:43:01 UTC (rev 5376) @@ -51,6 +51,10 @@ include("smb_nt.inc"); include("secpod_smb_func.inc"); +if(!get_kb_item("SMB/WindowsVersion")){ + exit(0); +} + key = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\"; foreach item (registry_enum_keys(key:key)) { Modified: trunk/openvas-plugins/scripts/secpod_prochatrooms_dir_trav_n_xss_vuln.nasl =================================================================== --- trunk/openvas-plugins/scripts/secpod_prochatrooms_dir_trav_n_xss_vuln.nasl 2009-10-05 13:53:32 UTC (rev 5375) +++ trunk/openvas-plugins/scripts/secpod_prochatrooms_dir_trav_n_xss_vuln.nasl 2009-10-05 17:43:01 UTC (rev 5376) @@ -79,6 +79,7 @@ include("version_func.inc"); +include("http_func.inc"); include("http_keepalive.inc"); pcrPort = get_kb_item("Services/www"); Modified: trunk/openvas-plugins/scripts/sybase_blank_password.nasl =================================================================== --- trunk/openvas-plugins/scripts/sybase_blank_password.nasl 2009-10-05 13:53:32 UTC (rev 5375) +++ trunk/openvas-plugins/scripts/sybase_blank_password.nasl 2009-10-05 17:43:01 UTC (rev 5376) @@ -45,7 +45,7 @@ family = "Databases"; script_family(family); script_require_ports("Services/sybase", 5000); - script_dependencies("sybase_detect.nasl"); + script_dependencies("find_service.nes"); exit(0); } @@ -152,8 +152,9 @@ } -port = get_kb_item("Services/sybase"); -if(!port)port = 5000; +#port = get_kb_item("Services/sybase"); +#if(!port)port = 5000; +port = 5000; found = 0; Added: trunk/openvas-plugins/scripts/sympa_detect.nasl =================================================================== --- trunk/openvas-plugins/scripts/sympa_detect.nasl 2009-10-05 13:53:32 UTC (rev 5375) +++ trunk/openvas-plugins/scripts/sympa_detect.nasl 2009-10-05 17:43:01 UTC (rev 5376) @@ -0,0 +1,128 @@ +################################################################### +# OpenVAS Network Vulnerability Test +# +# Sympa Detection +# +# LSS-NVT-2009-013 +# +# Developed by LSS Security Team +# +# Copyright (C) 2009 LSS +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program. If not, see +# . +################################################################### + +if(description) +{ + script_id(102013); + script_version("1.1-$Revision$"); + + script_name("Sympa Detection"); + + desc = " +The remote host is running Sympa, an open source (GNU GPL) mailing list management (MLM) software +suite written in Perl. + +See also : + +http://www.sympa.org/ + +Risk factor : None +"; + + script_description(desc); + + script_summary("Detects Sympa"); + + script_category(ACT_GATHER_INFO); + + script_copyright("Copyright (C) 2009 LSS"); + script_family("Service detection"); + script_exclude_keys("Settings/disable_cgi_scanning"); + script_require_ports("Services/www", 80, 443); + + exit(0); +} + +include("global_settings.inc"); +include("http_func.inc"); +include("openvas-https.inc"); + + +# Function that checks each dir for Sympa installation +# Optionally can use https + +function CheckSympa(use_https) { + dirs = make_list("/sympa", cgi_dirs()); + + # Go through dirs + foreach dir (dirs) + { + url = string(dir, "/"); + req = http_get(item:url, port:port); + if(use_https==1) + req = https_req_get(request: req, port:port); + else + req = http_send_recv(data: req, port:port); + + if(isnull(req)) return; + + # Check if it is Sympa + pat='Powered by ([^>]*>)?Sympa ?v?([0-9.]+)'; + match=egrep(pattern:pat,string:req, icase:1); + + if(match || egrep(pattern:" Author: mattm Date: 2009-10-05 23:54:23 +0200 (Mon, 05 Oct 2009) New Revision: 5377 Modified: trunk/openvas-manager/ChangeLog trunk/openvas-manager/src/manage.h trunk/openvas-manager/src/omp.c trunk/openvas-manager/src/ompd.c trunk/openvas-manager/src/otp.c trunk/openvas-manager/src/otp.h trunk/openvas-manager/src/tasks_sql.h Log: Move caching of NVT preferences to the database. * src/otp.h (scanner_init_state_t): Add SCANNER_INIT_DONE_CACHE_MODE. * src/ompd.c (init_ompd): In SCANNER_INIT_GOT_PLUGINS set scanner init to special cache done state when in cache mode. Add SCANNER_INIT_DONE_CACHE_MODE to error check. (serve_omp): Add SCANNER_INIT_DONE_CACHE_MODE to select setup. * src/otp.c (current_scanner_preferences, make_scanner_preferences) (add_scanner_preference): Remove. (init_otp_data): Remove scanner.preferences init. (parse_scanner_preference_value): Call manage_nvt_preference_add instead of add_scanner_preference. (process_otp_scanner_input): Add SCANNER_INIT_DONE_CACHE_MODE alongside SCANNER_INIT_DONE. In NVT cache mode, instead of exiting when the NVTs are cached, continue to read the preferences and exit after that. * src/tasks_sql.h (init_manage_process): Also clear NVT prefs. (init_manage): Add outline for database initialisation check. Add table nvt_preferences. (manage_nvt_preference_add, manage_nvt_preferences_enable) (init_nvt_preference_iterator, nvt_preference_iterator_name) (nvt_preference_iterator_value): New functions. * src/manage.h: Add headers. (scanner_t): Remove preferences slot. * src/omp.c (send_preference): Remove. (omp_xml_handle_end_element): In CLIENT_GET_PREFERENCES use new preferences iterator to send preferences. Modified: trunk/openvas-manager/ChangeLog =================================================================== --- trunk/openvas-manager/ChangeLog 2009-10-05 17:43:01 UTC (rev 5376) +++ trunk/openvas-manager/ChangeLog 2009-10-05 21:54:23 UTC (rev 5377) @@ -1,5 +1,39 @@ 2009-10-05 Matthew Mundell + Move caching of NVT preferences to the database. + + * src/otp.h (scanner_init_state_t): Add SCANNER_INIT_DONE_CACHE_MODE. + + * src/ompd.c (init_ompd): In SCANNER_INIT_GOT_PLUGINS set scanner init to + special cache done state when in cache mode. Add + SCANNER_INIT_DONE_CACHE_MODE to error check. + (serve_omp): Add SCANNER_INIT_DONE_CACHE_MODE to select setup. + + * src/otp.c (current_scanner_preferences, make_scanner_preferences) + (add_scanner_preference): Remove. + (init_otp_data): Remove scanner.preferences init. + (parse_scanner_preference_value): Call manage_nvt_preference_add instead + of add_scanner_preference. + (process_otp_scanner_input): Add SCANNER_INIT_DONE_CACHE_MODE alongside + SCANNER_INIT_DONE. In NVT cache mode, instead of exiting when the + NVTs are cached, continue to read the preferences and exit after that. + + * src/tasks_sql.h (init_manage_process): Also clear NVT prefs. + (init_manage): Add outline for database initialisation check. Add table + nvt_preferences. + (manage_nvt_preference_add, manage_nvt_preferences_enable) + (init_nvt_preference_iterator, nvt_preference_iterator_name) + (nvt_preference_iterator_value): New functions. + + * src/manage.h: Add headers. + (scanner_t): Remove preferences slot. + + * src/omp.c (send_preference): Remove. + (omp_xml_handle_end_element): In CLIENT_GET_PREFERENCES use new + preferences iterator to send preferences. + +2009-10-05 Matthew Mundell + * src/ompd.c (recreate_session): Add openvas_server_free to fnctl fail. (serve_omp): Put the credential args the right way round. Modified: trunk/openvas-manager/src/manage.h =================================================================== --- trunk/openvas-manager/src/manage.h 2009-10-05 17:43:01 UTC (rev 5376) +++ trunk/openvas-manager/src/manage.h 2009-10-05 21:54:23 UTC (rev 5377) @@ -41,7 +41,6 @@ certificates_t* certificates; ///< List of certificates. char* plugins_md5; ///< MD5 sum over all tests. GHashTable* plugins_dependencies; ///< Dependencies between plugins. - GHashTable* preferences; ///< Scanner preference. GPtrArray* rules; ///< Scanner rules. int rules_size; ///< Number of rules. } scanner_t; @@ -635,8 +634,26 @@ nvt_selector_nvt_count (const char*, const char*); -/* Lsc_Credentials. */ +/* NVT preferences. */ +void +manage_nvt_preference_add (char*, char*); + +void +manage_nvt_preferences_enable (); + +void +init_nvt_preference_iterator (iterator_t*); + +const char* +nvt_preference_iterator_name (iterator_t*); + +const char* +nvt_preference_iterator_value (iterator_t*); + + +/* LSC credentials. */ + int create_lsc_credential (const char*, const char*); Modified: trunk/openvas-manager/src/omp.c =================================================================== --- trunk/openvas-manager/src/omp.c 2009-10-05 17:43:01 UTC (rev 5376) +++ trunk/openvas-manager/src/omp.c 2009-10-05 21:54:23 UTC (rev 5377) @@ -1690,38 +1690,6 @@ } /** - * @brief Send XML for a preference. - * - * @param[in] key The preferences hashtable key. - * @param[in] value The preferences hashtable value. - * @param[in] dummy Dummy variable for g_hash_table_find. - * - * @return TRUE if out of space in to_client buffer, else FALSE. - */ -static gboolean -send_preference (gpointer key, gpointer value, /*@unused@*/ gpointer dummy) -{ - /* \todo Do these reallocations affect performance? */ - gchar* key_text = g_markup_escape_text ((char*) key, - strlen ((char*) key)); - gchar* value_text = g_markup_escape_text ((char*) value, - strlen ((char*) value)); - gchar* msg = g_strdup_printf ("" - "%s%s" - "", - key_text, value_text); - g_free (key_text); - g_free (value_text); - if (send_to_client (msg)) - { - g_free (msg); - return TRUE; - } - g_free (msg); - return FALSE; -} - -/** * @brief Send XML for a rule. * * @param[in] rule The rule. @@ -2550,22 +2518,26 @@ break; case CLIENT_GET_PREFERENCES: - if (scanner.preferences) - { - SEND_TO_CLIENT_OR_FAIL (""); - if (g_hash_table_find (scanner.preferences, send_preference, NULL)) - { - error_send_to_client (error); - return; - } - SEND_TO_CLIENT_OR_FAIL (""); - } - else - SEND_TO_CLIENT_OR_FAIL (XML_SERVICE_DOWN ("get_preferences")); - set_client_state (CLIENT_AUTHENTIC); - break; + { + iterator_t prefs; + SEND_TO_CLIENT_OR_FAIL (""); + init_nvt_preference_iterator (&prefs); + while (next (&prefs)) + { + SENDF_TO_CLIENT_OR_FAIL ("" + "%s" + "%s" + "", + nvt_preference_iterator_name (&prefs), + nvt_preference_iterator_value (&prefs)); + } + cleanup_iterator (&prefs); + SEND_TO_CLIENT_OR_FAIL (""); + set_client_state (CLIENT_AUTHENTIC); + break; + } case CLIENT_GET_CERTIFICATES: if (scanner.certificates) @@ -5203,7 +5175,8 @@ * * @param[in] log_config Logging configuration list. * - * @return 0 success, -1 error, -2 database is wrong version. + * @return 0 success, -1 error, -2 database is wrong version, -3 database + * needs to be initialized from server. */ int init_omp (GSList *log_config) Modified: trunk/openvas-manager/src/ompd.c =================================================================== --- trunk/openvas-manager/src/ompd.c 2009-10-05 17:43:01 UTC (rev 5376) +++ trunk/openvas-manager/src/ompd.c 2009-10-05 21:54:23 UTC (rev 5377) @@ -95,7 +95,8 @@ * * @param[in] log_config Log configuration * - * @return 0 success, -1 error, -2 database is wrong version. + * @return 0 success, -1 error, -2 database is wrong version, -3 database + * needs to be initialized from server. */ int init_ompd (GSList *log_config) @@ -385,7 +386,12 @@ (scanner_session, ack + scanner_init_offset); if (scanner_init_offset == 0) - set_scanner_init_state (SCANNER_INIT_DONE); + { + if (ompd_nvt_cache_mode) + set_scanner_init_state (SCANNER_INIT_DONE_CACHE_MODE); + else + set_scanner_init_state (SCANNER_INIT_DONE); + } else if (scanner_init_offset == -1) { scanner_init_offset = 0; @@ -396,6 +402,7 @@ } /*@fallthrough@*/ case SCANNER_INIT_DONE: + case SCANNER_INIT_DONE_CACHE_MODE: while (1) switch (write_to_server_buffer (scanner_session)) { @@ -675,6 +682,7 @@ } if ((scanner_init_state == SCANNER_INIT_DONE + || scanner_init_state == SCANNER_INIT_DONE_CACHE_MODE || scanner_init_state == SCANNER_INIT_GOT_VERSION || scanner_init_state == SCANNER_INIT_SENT_COMPLETE_LIST || scanner_init_state == SCANNER_INIT_SENT_PASSWORD @@ -687,7 +695,8 @@ } if (((scanner_init_state == SCANNER_INIT_TOP - || scanner_init_state == SCANNER_INIT_DONE) + || scanner_init_state == SCANNER_INIT_DONE + || scanner_init_state == SCANNER_INIT_DONE_CACHE_MODE) && to_server_buffer_space () > 0) || scanner_init_state == SCANNER_INIT_CONNECT_INTR || scanner_init_state == SCANNER_INIT_CONNECTED Modified: trunk/openvas-manager/src/otp.c =================================================================== --- trunk/openvas-manager/src/otp.c 2009-10-05 17:43:01 UTC (rev 5376) +++ trunk/openvas-manager/src/otp.c 2009-10-05 21:54:23 UTC (rev 5377) @@ -417,40 +417,6 @@ /*@null@*/ /*@only@*/ static char* current_scanner_preference = NULL; -/** - * @brief The current scanner preferences, during reading of scanner preferences. - */ -static GHashTable* current_scanner_preferences = NULL; - -/** - * @brief Create the scanner preferences. - */ -static GHashTable* -make_scanner_preferences () -{ - return g_hash_table_new_full (g_str_hash, - g_str_equal, - g_free, - g_free); -} - -/** - * @brief Add a preference to the scanner preferences. - * - * Both parameters are used directly, and are freed when the - * preferences are freed. - * - * @param[in] preference The preference. - * @param[in] value The value of the preference. - */ -static void -add_scanner_preference (GHashTable* preferences, - /*@keep@*/ char* preference, - /*@keep@*/ char* value) -{ - g_hash_table_insert (preferences, preference, value); -} - /* Scanner plugins. */ @@ -616,7 +582,6 @@ init_otp_data () { scanner.certificates = NULL; - scanner.preferences = NULL; scanner.rules = NULL; scanner.plugins_md5 = NULL; } @@ -1016,9 +981,7 @@ { match[0] = '\0'; value = g_strdup (*messages); - add_scanner_preference (current_scanner_preferences, - current_scanner_preference, - value); + manage_nvt_preference_add (current_scanner_preference, value); set_scanner_state (SCANNER_PREFERENCE_NAME); from_scanner_start += match + 1 - *messages; *messages = match + 1; @@ -1251,7 +1214,7 @@ * * This includes updating the scanner state with \ref set_scanner_state * and \ref set_scanner_init_state, and updating scanner records with functions - * like \ref add_scanner_preference and \ref append_task_open_port. + * like \ref manage_nvt_preference_add and \ref append_task_open_port. * * \endif * @@ -1373,6 +1336,7 @@ case SCANNER_INIT_SENT_COMPLETE_LIST: case SCANNER_INIT_SENT_PASSWORD: case SCANNER_INIT_DONE: + case SCANNER_INIT_DONE_CACHE_MODE: case SCANNER_INIT_TOP: if (scanner_state == SCANNER_TOP) switch (parse_scanner_bad_login (&messages)) @@ -1968,13 +1932,7 @@ if (scanner_init_state == SCANNER_INIT_SENT_COMPLETE_LIST) { set_scanner_init_state (SCANNER_INIT_GOT_PLUGINS); - /* Initialisation only sends COMPLETE_LIST when - * caching plugins, so return 1 (as though the - * scanner sent BYE). */ - // FIX should perhaps exit more formally with - // scanner set_nvts_md5sum (scanner.plugins_md5); - return 1; } break; case -1: return -1; @@ -2142,10 +2100,15 @@ if (sync_buffer ()) return -1; return 0; } - if (scanner.preferences) - g_hash_table_destroy (scanner.preferences); - scanner.preferences = current_scanner_preferences; - current_scanner_preferences = NULL; + if (scanner_init_state == SCANNER_INIT_DONE_CACHE_MODE) + { + set_scanner_init_state (SCANNER_INIT_DONE); + manage_nvt_preferences_enable (); + /* Return 1, as though the scanner sent BYE. */ + // FIX should perhaps exit more formally with scanner + scanner_active = 0; + return 1; + } break; } { @@ -2216,7 +2179,6 @@ else if (strcasecmp ("PREFERENCES", field) == 0) { assert (current_scanner_preference == NULL); - current_scanner_preferences = make_scanner_preferences (); set_scanner_state (SCANNER_PREFERENCE_NAME); } else if (strcasecmp ("RULES", field) == 0) Modified: trunk/openvas-manager/src/otp.h =================================================================== --- trunk/openvas-manager/src/otp.h 2009-10-05 17:43:01 UTC (rev 5376) +++ trunk/openvas-manager/src/otp.h 2009-10-05 21:54:23 UTC (rev 5377) @@ -44,6 +44,7 @@ SCANNER_INIT_CONNECT_INTR, /* `connect' to scanner was interrupted. */ SCANNER_INIT_CONNECTED, SCANNER_INIT_DONE, + SCANNER_INIT_DONE_CACHE_MODE, /* Done state when in NVT caching mode. */ SCANNER_INIT_GOT_MD5SUM, SCANNER_INIT_GOT_PASSWORD, SCANNER_INIT_GOT_PLUGINS, Modified: trunk/openvas-manager/src/tasks_sql.h =================================================================== --- trunk/openvas-manager/src/tasks_sql.h 2009-10-05 17:43:01 UTC (rev 5376) +++ trunk/openvas-manager/src/tasks_sql.h 2009-10-05 21:54:23 UTC (rev 5377) @@ -715,6 +715,7 @@ { sql ("BEGIN EXCLUSIVE;"); sql ("DELETE FROM nvts;"); + sql ("DELETE FROM nvt_preferences;"); sql ("DELETE FROM meta WHERE name = 'nvts_checksum';"); sql ("COMMIT;"); } @@ -746,6 +747,7 @@ { sql ("BEGIN EXCLUSIVE;"); sql ("DELETE FROM nvts;"); + sql ("DELETE FROM nvt_preferences;"); sql ("DELETE FROM meta WHERE name = 'nvts_checksum';"); sql ("COMMIT;"); } @@ -887,7 +889,8 @@ * Beware that calling this function while tasks are running may lead to * problems. * - * @return 0 success, -1 error, -2 database is wrong version. + * @return 0 success, -1 error, -2 database is wrong version, -3 database needs + * to be initialised from server. */ int init_manage (GSList *log_config) @@ -912,6 +915,22 @@ && strcmp (database_version, G_STRINGIFY (DATABASE_VERSION))) return -2; +#if 0 + /** @todo Skip this when in NVT caching mode. */ + + /* Check that the database was initialised from the scanner. */ + + { + long long int count; + if (sql_int64 (&count, 0, 0, + "SELECT count(*) FROM meta" + " WHERE name = 'nvt_md5sum'" + " OR name = 'nvt_preferences_enabled';") + || count < 2) + return -3; + } +#endif + /* Ensure the tables exist. */ sql ("CREATE TABLE IF NOT EXISTS meta (name UNIQUE, value);"); @@ -927,6 +946,7 @@ sql ("CREATE TABLE IF NOT EXISTS report_hosts (report INTEGER, host, start_time, end_time, attack_state, current_port, max_port);"); sql ("CREATE TABLE IF NOT EXISTS report_results (report INTEGER, result INTEGER);"); sql ("CREATE TABLE IF NOT EXISTS nvts (oid, version, name, summary, description, copyright, cve, bid, xref, tag, sign_key_ids, category, family);"); + sql ("CREATE TABLE IF NOT EXISTS nvt_preferences (name, value);"); sql ("CREATE TABLE IF NOT EXISTS lsc_credentials (name, comment, rpm, deb, dog);"); /* Ensure the version is set. */ @@ -4432,6 +4452,54 @@ } +/* NVT preferences. */ + +/** + * @brief Add an NVT preference. + * + * @param[in] name The name of the preference. + * @param[in] value The value of the preference. + */ +void +manage_nvt_preference_add (char* name, char* value) +{ + gchar* quoted_name = sql_quote (name); + gchar* quoted_value = sql_quote (value); + sql ("INSERT into nvt_preferences (name, value)" + " VALUES ('%s', '%s');", + quoted_name, quoted_value); + g_free (quoted_name); + g_free (quoted_value); +} + +/** + * @brief Add an NVT preference. + * + * @param[in] name The name of the preference. + * @param[in] value The value of the preference. + */ +void +manage_nvt_preferences_enable () +{ + sql ("INSERT OR REPLACE INTO meta (name, value)" + " VALUES ('nvt_preferences_enabled', 1);"); +} + +/** + * @brief Initialise an NVT preference iterator. + * + * @param[in] iterator Iterator. + */ +void +init_nvt_preference_iterator (iterator_t* iterator) +{ + init_table_iterator (iterator, "nvt_preferences"); +} + +DEF_ACCESS (nvt_preference_iterator_name, 0); +DEF_ACCESS (nvt_preference_iterator_value, 1); + + /* LSC Credentials. */ /** From scm-commit at wald.intevation.org Tue Oct 6 02:49:43 2009 From: scm-commit at wald.intevation.org (scm-commit@wald.intevation.org) Date: Tue, 6 Oct 2009 02:49:43 +0200 (CEST) Subject: [Openvas-commits] r5378 - in trunk/openvas-plugins: . scripts Message-ID: <20091006004943.4537D852B6F9@pyrosoma.intevation.org> Author: reinke Date: 2009-10-06 02:49:40 +0200 (Tue, 06 Oct 2009) New Revision: 5378 Added: trunk/openvas-plugins/scripts/RHSA_2009_1455.nasl trunk/openvas-plugins/scripts/RHSA_2009_1465.nasl trunk/openvas-plugins/scripts/RHSA_2009_1470.nasl trunk/openvas-plugins/scripts/RHSA_2009_1471.nasl trunk/openvas-plugins/scripts/RHSA_2009_1472.nasl trunk/openvas-plugins/scripts/deb_1896_1.nasl trunk/openvas-plugins/scripts/deb_1897_1.nasl trunk/openvas-plugins/scripts/deb_1898_1.nasl trunk/openvas-plugins/scripts/deb_1899_1.nasl trunk/openvas-plugins/scripts/deb_1900_1.nasl trunk/openvas-plugins/scripts/deb_1901_1.nasl trunk/openvas-plugins/scripts/fcore_2009_10165.nasl trunk/openvas-plugins/scripts/fcore_2009_10172.nasl trunk/openvas-plugins/scripts/fcore_2009_10180.nasl trunk/openvas-plugins/scripts/freebsd_mybb.nasl trunk/openvas-plugins/scripts/freebsdsa_devfs1.nasl trunk/openvas-plugins/scripts/freebsdsa_pipe1.nasl trunk/openvas-plugins/scripts/mdksa_2009_249.nasl trunk/openvas-plugins/scripts/mdksa_2009_253.nasl trunk/openvas-plugins/scripts/mdksa_2009_254.nasl trunk/openvas-plugins/scripts/mdksa_2009_255.nasl trunk/openvas-plugins/scripts/ubuntu_838_1.nasl trunk/openvas-plugins/scripts/ubuntu_839_1.nasl Modified: trunk/openvas-plugins/ChangeLog Log: New scripts added Modified: trunk/openvas-plugins/ChangeLog =================================================================== --- trunk/openvas-plugins/ChangeLog 2009-10-05 21:54:23 UTC (rev 5377) +++ trunk/openvas-plugins/ChangeLog 2009-10-06 00:49:40 UTC (rev 5378) @@ -1,3 +1,31 @@ +2009-10-05 Thomas Reinke + + *scripts/deb_1896_1.nasl, + scripts/deb_1897_1.nasl, + scripts/deb_1898_1.nasl, + scripts/deb_1899_1.nasl, + scripts/deb_1900_1.nasl, + scripts/deb_1901_1.nasl, + scripts/freebsd_mybb.nasl, + scripts/freebsdsa_devfs1.nasl, + scripts/freebsdsa_pipe1.nasl, + scripts/ubuntu_838_1.nasl, + scripts/ubuntu_839_1.nasl, + scripts/mdksa_2009_249.nasl, + scripts/mdksa_2009_253.nasl, + scripts/mdksa_2009_254.nasl, + scripts/mdksa_2009_255.nasl, + scripts/RHSA_2009_1455.nasl, + scripts/RHSA_2009_1465.nasl, + scripts/RHSA_2009_1470.nasl, + scripts/RHSA_2009_1471.nasl, + scripts/RHSA_2009_1472.nasl, + scripts/fcore_2009_10165.nasl, + scripts/fcore_2009_10172.nasl, + scripts/fcore_2009_10180.nasl: + New plugins. + + 2009-10-05 Michael Meyer * scripts/cvspserver_version.nasl, Added: trunk/openvas-plugins/scripts/RHSA_2009_1455.nasl =================================================================== --- trunk/openvas-plugins/scripts/RHSA_2009_1455.nasl 2009-10-05 21:54:23 UTC (rev 5377) +++ trunk/openvas-plugins/scripts/RHSA_2009_1455.nasl 2009-10-06 00:49:40 UTC (rev 5378) @@ -0,0 +1,142 @@ +# OpenVAS Vulnerability Test +# $Id$ +# Description: Auto-generated from advisory RHSA-2009:1455 () +# +# Authors: +# Thomas Reinke +# +# Copyright: +# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com +# Text descriptions are largely excerpted from the referenced +# advisory, and are Copyright (c) the respective author(s) +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2, +# or at your option, GNU General Public License version 3, +# as published by the Free Software Foundation +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# + +if(description) +{ + script_id(64991); + script_cve_id("CVE-2009-2849"); + script_version ("$"); + script_name("RedHat Security Advisory RHSA-2009:1455"); + + desc = " +The remote host is missing updates to the kernel announced in +advisory RHSA-2009:1455. + +Security fix: + +* a NULL pointer dereference flaw was found in the Multiple Devices (md) +driver in the Linux kernel. If the suspend_lo or suspend_hi file on the +sysfs file system (/sys/) is modified when the disk array is inactive, it +could lead to a local denial of service or privilege escalation. Note: By +default, only the root user can write to the files mentioned above. +(CVE-2009-2849, Moderate) + +For details on other bug fixes applied to this update, please visit +the referenced security advisories. + +Users should upgrade to these updated packages, which contain backported +patches to correct these issues. The system must be rebooted for this +update to take effect. + +Solution: +Please note that this update is available via +Red Hat Network. To use Red Hat Network, launch the Red +Hat Update Agent with the following command: up2date + +http://rhn.redhat.com/errata/RHSA-2009-1455.html +http://www.redhat.com/security/updates/classification/#moderate + +Risk factor : Medium"; + + script_description(desc); + + script_summary("Redhat Security Advisory RHSA-2009:1455"); + + script_category(ACT_GATHER_INFO); + + script_copyright("Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com"); + script_family("Red Hat Local Security Checks"); + script_dependencies("gather-package-list.nasl"); + script_require_keys("ssh/login/rpms"); + exit(0); +} + +# +# The script code starts here +# + +include("revisions-lib.inc"); +include("pkg-lib-rpm.inc"); +vuln = 0; +if(isrpmvuln(pkg:"kernel", rpm:"kernel~2.6.18~164.2.1.el5", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-PAE", rpm:"kernel-PAE~2.6.18~164.2.1.el5", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-PAE-debuginfo", rpm:"kernel-PAE-debuginfo~2.6.18~164.2.1.el5", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-PAE-devel", rpm:"kernel-PAE-devel~2.6.18~164.2.1.el5", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-debug", rpm:"kernel-debug~2.6.18~164.2.1.el5", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-debug-debuginfo", rpm:"kernel-debug-debuginfo~2.6.18~164.2.1.el5", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-debug-devel", rpm:"kernel-debug-devel~2.6.18~164.2.1.el5", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-debuginfo", rpm:"kernel-debuginfo~2.6.18~164.2.1.el5", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-debuginfo-common", rpm:"kernel-debuginfo-common~2.6.18~164.2.1.el5", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-devel", rpm:"kernel-devel~2.6.18~164.2.1.el5", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-headers", rpm:"kernel-headers~2.6.18~164.2.1.el5", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-xen", rpm:"kernel-xen~2.6.18~164.2.1.el5", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-xen-debuginfo", rpm:"kernel-xen-debuginfo~2.6.18~164.2.1.el5", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-xen-devel", rpm:"kernel-xen-devel~2.6.18~164.2.1.el5", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-doc", rpm:"kernel-doc~2.6.18~164.2.1.el5", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-kdump", rpm:"kernel-kdump~2.6.18~164.2.1.el5", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-kdump-debuginfo", rpm:"kernel-kdump-debuginfo~2.6.18~164.2.1.el5", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-kdump-devel", rpm:"kernel-kdump-devel~2.6.18~164.2.1.el5", rls:"RHENT_5")) { + vuln = 1; +} + +if(vuln) { + security_hole(0); +} Added: trunk/openvas-plugins/scripts/RHSA_2009_1465.nasl =================================================================== --- trunk/openvas-plugins/scripts/RHSA_2009_1465.nasl 2009-10-05 21:54:23 UTC (rev 5377) +++ trunk/openvas-plugins/scripts/RHSA_2009_1465.nasl 2009-10-06 00:49:40 UTC (rev 5378) @@ -0,0 +1,100 @@ +# OpenVAS Vulnerability Test +# $Id$ +# Description: Auto-generated from advisory RHSA-2009:1465 () +# +# Authors: +# Thomas Reinke +# +# Copyright: +# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com +# Text descriptions are largely excerpted from the referenced +# advisory, and are Copyright (c) the respective author(s) +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2, +# or at your option, GNU General Public License version 3, +# as published by the Free Software Foundation +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# + +if(description) +{ + script_id(64990); + script_cve_id("CVE-2009-3290"); + script_version ("$"); + script_name("RedHat Security Advisory RHSA-2009:1465"); + + desc = " +The remote host is missing updates announced in +advisory RHSA-2009:1465. + +KVM (Kernel-based Virtual Machine) is a full virtualization solution for +Linux on AMD64 and Intel 64 systems. KVM is a Linux kernel module built for +the standard Red Hat Enterprise Linux kernel. + +The kvm_emulate_hypercall() implementation was missing a check for the +Current Privilege Level (CPL). A local, unprivileged user in a virtual +machine could use this flaw to cause a local denial of service or escalate +their privileges within that virtual machine. (CVE-2009-3290) + +All KVM users should upgrade to these updated packages, which contain +backported patches to resolve these issues. Note: The procedure in the +Solution section must be performed before this update takes effect. + +Solution: +Please note that this update is available via +Red Hat Network. To use Red Hat Network, launch the Red +Hat Update Agent with the following command: up2date + +http://rhn.redhat.com/errata/RHSA-2009-1465.html +http://www.redhat.com/security/updates/classification/#important + +Risk factor : High"; + + script_description(desc); + + script_summary("Redhat Security Advisory RHSA-2009:1465"); + + script_category(ACT_GATHER_INFO); + + script_copyright("Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com"); + script_family("Red Hat Local Security Checks"); + script_dependencies("gather-package-list.nasl"); + script_require_keys("ssh/login/rpms"); + exit(0); +} + +# +# The script code starts here +# + +include("revisions-lib.inc"); +include("pkg-lib-rpm.inc"); +vuln = 0; +if(isrpmvuln(pkg:"kmod-kvm", rpm:"kmod-kvm~83~105.el5_4.7", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kvm", rpm:"kvm~83~105.el5_4.7", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kvm-debuginfo", rpm:"kvm-debuginfo~83~105.el5_4.7", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kvm-qemu-img", rpm:"kvm-qemu-img~83~105.el5_4.7", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kvm-tools", rpm:"kvm-tools~83~105.el5_4.7", rls:"RHENT_5")) { + vuln = 1; +} + +if(vuln) { + security_hole(0); +} Added: trunk/openvas-plugins/scripts/RHSA_2009_1470.nasl =================================================================== --- trunk/openvas-plugins/scripts/RHSA_2009_1470.nasl 2009-10-05 21:54:23 UTC (rev 5377) +++ trunk/openvas-plugins/scripts/RHSA_2009_1470.nasl 2009-10-06 00:49:40 UTC (rev 5378) @@ -0,0 +1,103 @@ +# OpenVAS Vulnerability Test +# $Id$ +# Description: Auto-generated from advisory RHSA-2009:1470 () +# +# Authors: +# Thomas Reinke +# +# Copyright: +# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com +# Text descriptions are largely excerpted from the referenced +# advisory, and are Copyright (c) the respective author(s) +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2, +# or at your option, GNU General Public License version 3, +# as published by the Free Software Foundation +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# + +if(description) +{ + script_id(64992); + script_cve_id("CVE-2009-2904"); + script_version ("$"); + script_name("RedHat Security Advisory RHSA-2009:1470"); + + desc = " +The remote host is missing updates announced in +advisory RHSA-2009:1470. + +OpenSSH is OpenBSD's SSH (Secure Shell) protocol implementation. These +packages include the core files necessary for both the OpenSSH client and +server. + +A Red Hat specific patch used in the openssh packages as shipped in Red +Hat Enterprise Linux 5.4 (RHSA-2009:1287) loosened certain ownership +requirements for directories used as arguments for the ChrootDirectory +configuration options. A malicious user that also has or previously had +non-chroot shell access to a system could possibly use this flaw to +escalate their privileges and run commands as any system user. +(CVE-2009-2904) + +All OpenSSH users are advised to upgrade to these updated packages, which +contain a backported patch to resolve this issue. After installing this +update, the OpenSSH server daemon (sshd) will be restarted automatically. + +Solution: +Please note that this update is available via +Red Hat Network. To use Red Hat Network, launch the Red +Hat Update Agent with the following command: up2date + +http://rhn.redhat.com/errata/RHSA-2009-1470.html +http://www.redhat.com/security/updates/classification/#moderate + +Risk factor : Medium"; + + script_description(desc); + + script_summary("Redhat Security Advisory RHSA-2009:1470"); + + script_category(ACT_GATHER_INFO); + + script_copyright("Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com"); + script_family("Red Hat Local Security Checks"); + script_dependencies("gather-package-list.nasl"); + script_require_keys("ssh/login/rpms"); + exit(0); +} + +# +# The script code starts here +# + +include("revisions-lib.inc"); +include("pkg-lib-rpm.inc"); +vuln = 0; +if(isrpmvuln(pkg:"openssh", rpm:"openssh~4.3p2~36.el5_4.2", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"openssh-askpass", rpm:"openssh-askpass~4.3p2~36.el5_4.2", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"openssh-clients", rpm:"openssh-clients~4.3p2~36.el5_4.2", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"openssh-debuginfo", rpm:"openssh-debuginfo~4.3p2~36.el5_4.2", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"openssh-server", rpm:"openssh-server~4.3p2~36.el5_4.2", rls:"RHENT_5")) { + vuln = 1; +} + +if(vuln) { + security_hole(0); +} Added: trunk/openvas-plugins/scripts/RHSA_2009_1471.nasl =================================================================== --- trunk/openvas-plugins/scripts/RHSA_2009_1471.nasl 2009-10-05 21:54:23 UTC (rev 5377) +++ trunk/openvas-plugins/scripts/RHSA_2009_1471.nasl 2009-10-06 00:49:40 UTC (rev 5378) @@ -0,0 +1,103 @@ +# OpenVAS Vulnerability Test +# $Id$ +# Description: Auto-generated from advisory RHSA-2009:1471 () +# +# Authors: +# Thomas Reinke +# +# Copyright: +# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com +# Text descriptions are largely excerpted from the referenced +# advisory, and are Copyright (c) the respective author(s) +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2, +# or at your option, GNU General Public License version 3, +# as published by the Free Software Foundation +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# + +if(description) +{ + script_id(64993); + script_cve_id("CVE-2007-2027", "CVE-2008-7224"); + script_version ("$"); + script_name("RedHat Security Advisory RHSA-2009:1471"); + + desc = " +The remote host is missing updates announced in +advisory RHSA-2009:1471. + +ELinks is a text-based Web browser. ELinks does not display any images, but +it does support frames, tables, and most other HTML tags. + +An off-by-one buffer overflow flaw was discovered in the way ELinks handled +its internal cache of string representations for HTML special entities. A +remote attacker could use this flaw to create a specially-crafted HTML file +that would cause ELinks to crash or, possibly, execute arbitrary code when +rendered. (CVE-2008-7224) + +It was discovered that ELinks tried to load translation files using +relative paths. A local attacker able to trick a victim into running ELinks +in a folder containing specially-crafted translation files could use this +flaw to confuse the victim via incorrect translations, or cause ELinks to +crash and possibly execute arbitrary code via embedded formatting sequences +in translated messages. (CVE-2007-2027) + +All ELinks users are advised to upgrade to this updated package, which +contains backported patches to resolve these issues. + +Solution: +Please note that this update is available via +Red Hat Network. To use Red Hat Network, launch the Red +Hat Update Agent with the following command: up2date + +http://rhn.redhat.com/errata/RHSA-2009-1471.html +http://www.redhat.com/security/updates/classification/#important + +Risk factor : High"; + + script_description(desc); + + script_summary("Redhat Security Advisory RHSA-2009:1471"); + + script_category(ACT_GATHER_INFO); + + script_copyright("Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com"); + script_family("Red Hat Local Security Checks"); + script_dependencies("gather-package-list.nasl"); + script_require_keys("ssh/login/rpms"); + exit(0); +} + +# +# The script code starts here +# + +include("revisions-lib.inc"); +include("pkg-lib-rpm.inc"); +vuln = 0; +if(isrpmvuln(pkg:"elinks", rpm:"elinks~0.9.2~4.el4_8.1", rls:"RHENT_4")) { + vuln = 1; +} +if(isrpmvuln(pkg:"elinks-debuginfo", rpm:"elinks-debuginfo~0.9.2~4.el4_8.1", rls:"RHENT_4")) { + vuln = 1; +} +if(isrpmvuln(pkg:"elinks", rpm:"elinks~0.11.1~6.el5_4.1", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"elinks-debuginfo", rpm:"elinks-debuginfo~0.11.1~6.el5_4.1", rls:"RHENT_5")) { + vuln = 1; +} + +if(vuln) { + security_hole(0); +} Added: trunk/openvas-plugins/scripts/RHSA_2009_1472.nasl =================================================================== --- trunk/openvas-plugins/scripts/RHSA_2009_1472.nasl 2009-10-05 21:54:23 UTC (rev 5377) +++ trunk/openvas-plugins/scripts/RHSA_2009_1472.nasl 2009-10-06 00:49:40 UTC (rev 5378) @@ -0,0 +1,122 @@ +# OpenVAS Vulnerability Test +# $Id$ +# Description: Auto-generated from advisory RHSA-2009:1472 () +# +# Authors: +# Thomas Reinke +# +# Copyright: +# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com +# Text descriptions are largely excerpted from the referenced +# advisory, and are Copyright (c) the respective author(s) +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2, +# or at your option, GNU General Public License version 3, +# as published by the Free Software Foundation +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# + +if(description) +{ + script_id(64994); + script_cve_id("CVE-2009-3525"); + script_version ("$"); + script_name("RedHat Security Advisory RHSA-2009:1472"); + + desc = " +The remote host is missing updates announced in +advisory RHSA-2009:1472. + +Xen is an open source virtualization framework. Virtualization allows users +to run guest operating systems in virtual machines on top of a host +operating system. + +The pyGrub boot loader did not honor the password option in the grub.conf +file for para-virtualized guests. Users with access to a guest's console +could use this flaw to bypass intended access restrictions and boot the +guest with arbitrary kernel boot options, allowing them to get root +privileges in the guest's operating system. With this update, pyGrub +correctly honors the password option in grub.conf for para-virtualized +guests. (CVE-2009-3525) + +This update also fixes the following bugs: + +* rebooting para-virtualized guests sometimes caused those guests to crash +due to a race condition in the xend node control daemon. This update fixes +this race condition so that rebooting guests no longer potentially causes +them to crash and fail to reboot. (BZ#525141) + +* due to a race condition in the xend daemon, a guest could disappear from +the list of running guests following a reboot, even though the guest +rebooted successfully and was running. This update fixes this race +condition so that guests always reappear in the guest list following a +reboot. (BZ#525143) + +* attempting to use PCI pass-through to para-virtualized guests on certain +kernels failed with a Function not implemented error message. As a +result, users requiring PCI pass-through on para-virtualized guests were +not able to update the xen packages without also updating the kernel and +thus requiring a reboot. These updated packages enable PCI pass-through for +para-virtualized guests so that users do not need to upgrade the kernel in +order to take advantage of PCI pass-through functionality. (BZ#525149) + +All Xen users should upgrade to these updated packages, which contain +backported patches to correct these issues. After installing the updated +packages, the xend service must be restarted for this update to take +effect. + +Solution: +Please note that this update is available via +Red Hat Network. To use Red Hat Network, launch the Red +Hat Update Agent with the following command: up2date + +http://rhn.redhat.com/errata/RHSA-2009-1472.html +http://www.redhat.com/security/updates/classification/#moderate + +Risk factor : Medium"; + + script_description(desc); + + script_summary("Redhat Security Advisory RHSA-2009:1472"); + + script_category(ACT_GATHER_INFO); + + script_copyright("Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com"); + script_family("Red Hat Local Security Checks"); + script_dependencies("gather-package-list.nasl"); + script_require_keys("ssh/login/rpms"); + exit(0); +} + +# +# The script code starts here +# + +include("revisions-lib.inc"); +include("pkg-lib-rpm.inc"); +vuln = 0; +if(isrpmvuln(pkg:"xen-debuginfo", rpm:"xen-debuginfo~3.0.3~94.el5_4.1", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"xen-libs", rpm:"xen-libs~3.0.3~94.el5_4.1", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"xen", rpm:"xen~3.0.3~94.el5_4.1", rls:"RHENT_5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"xen-devel", rpm:"xen-devel~3.0.3~94.el5_4.1", rls:"RHENT_5")) { + vuln = 1; +} + +if(vuln) { + security_hole(0); +} Added: trunk/openvas-plugins/scripts/deb_1896_1.nasl =================================================================== --- trunk/openvas-plugins/scripts/deb_1896_1.nasl 2009-10-05 21:54:23 UTC (rev 5377) +++ trunk/openvas-plugins/scripts/deb_1896_1.nasl 2009-10-06 00:49:40 UTC (rev 5378) @@ -0,0 +1,136 @@ +# OpenVAS Vulnerability Test +# $Id$ +# Description: Auto-generated from advisory DSA 1896-1 (opensaml, shibboleth-sp) +# +# Authors: +# Thomas Reinke +# +# Copyright: +# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com +# Text descriptions are largely excerpted from the referenced +# advisory, and are Copyright (c) the respective author(s) +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2, +# or at your option, GNU General Public License version 3, +# as published by the Free Software Foundation +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# + +if(description) +{ + script_id(65003); + script_version ("$"); + script_name("Debian Security Advisory DSA 1896-1 (opensaml, shibboleth-sp)"); + + desc = " +The remote host is missing an update to opensaml, shibboleth-sp +announced via advisory DSA 1896-1. + +Several vulnerabilities have been discovered in the opensaml and +shibboleth-sp packages, as used by Shibboleth 1.x: + +Chris Ries discovered that decoding a crafted URL leads to a crash +(and potentially, arbitrary code execution). + +Ian Young discovered that embedded NUL characters in certificate names +were not correctly handled, exposing configurations using PKIX trust +validation to impersonation attacks. + +Incorrect processing of SAML metadata ignored key usage constraints. + +For the old stable distribution (etch), these problems have been fixed +in version 1.3f.dfsg1-2+etch1 of the shibboleth-sp packages, and +version 1.1a-2+etch1 of the opensaml packages. + +For the stable distribution (lenny), these problems have been fixed in +version 1.3.1.dfsg1-3+lenny1 of the shibboleth-sp packages, and +version 1.1.1-2+lenny1 of the opensaml packages. + +The unstable distribution (sid) does not contain Shibboleth 1.x +packages. + +This update requires restarting the affected services (mainly Apache) +to become effective. + +We recommend that you upgrade your Shibboleth 1.x packages. + +Solution: +https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201896-1 + +Risk factor : High"; + + script_description(desc); + + script_summary("Debian Security Advisory DSA 1896-1 (opensaml, shibboleth-sp)"); + + script_category(ACT_GATHER_INFO); + + script_copyright("Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com"); + script_family("Debian Local Security Checks"); + script_dependencies("gather-package-list.nasl"); + script_require_keys("ssh/login/packages"); + exit(0); +} + +# +# The script code starts here +# + +include("revisions-lib.inc"); +include("pkg-lib-deb.inc"); +vuln = 0; +if(isdpkgvuln(pkg:"opensaml-schemas", ver:"1.1a-2+etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libapache2-mod-shib", ver:"1.3f.dfsg1-2+etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libshib6", ver:"1.3f.dfsg1-2+etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libsaml-dev", ver:"1.1a-2+etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libshib-dev", ver:"1.3f.dfsg1-2+etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libsaml5", ver:"1.1a-2+etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libshib-target5", ver:"1.3f.dfsg1-2+etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"opensaml-schemas", ver:"1.1.1-2+lenny1", rls:"DEB5.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libshib-dev", ver:"1.3.1.dfsg1-3+lenny1", rls:"DEB5.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libsaml5", ver:"1.1.1-2+lenny1", rls:"DEB5.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libapache2-mod-shib", ver:"1.3.1.dfsg1-3+lenny1", rls:"DEB5.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libshib6", ver:"1.3.1.dfsg1-3+lenny1", rls:"DEB5.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libsaml-dev", ver:"1.1.1-2+lenny1", rls:"DEB5.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libshib-target5", ver:"1.3.1.dfsg1-3+lenny1", rls:"DEB5.0")) { + vuln = 1; +} + +if(vuln) { + security_hole(0); +} Added: trunk/openvas-plugins/scripts/deb_1897_1.nasl =================================================================== --- trunk/openvas-plugins/scripts/deb_1897_1.nasl 2009-10-05 21:54:23 UTC (rev 5377) +++ trunk/openvas-plugins/scripts/deb_1897_1.nasl 2009-10-06 00:49:40 UTC (rev 5378) @@ -0,0 +1,98 @@ +# OpenVAS Vulnerability Test +# $Id$ +# Description: Auto-generated from advisory DSA 1897-1 (horde3) +# +# Authors: +# Thomas Reinke +# +# Copyright: +# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com +# Text descriptions are largely excerpted from the referenced +# advisory, and are Copyright (c) the respective author(s) +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2, +# or at your option, GNU General Public License version 3, +# as published by the Free Software Foundation +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# + +if(description) +{ + script_id(65002); + script_cve_id("CVE-2009-3236"); + script_version ("$"); + script_name("Debian Security Advisory DSA 1897-1 (horde3)"); + + desc = " +The remote host is missing an update to horde3 +announced via advisory DSA 1897-1. + +Stefan Esser discovered that Horde, a web application framework providing +classes for dealing with preferences, compression, browser detection, +connection tracking, MIME, and more, is insufficiently validating and +escaping user provided input. The Horde_Form_Type_image form element +allows to reuse a temporary filename on reuploads which are stored in a +hidden HTML field and then trusted without prior validation. An attacker +can use this to overwrite arbitrary files on the system or to upload PHP +code and thus execute arbitrary code with the rights of the webserver. + + +For the oldstable distribution (etch), this problem has been fixed in +version 3.1.3-4etch6. + +For the stable distribution (lenny), this problem has been fixed in +version 3.2.2+debian0-2+lenny1. + +For the testing distribution (squeeze), this problem has been fixed in +version 3.3.5+debian0-1. + +For the unstable distribution (sid), this problem has been fixed in +version 3.3.5+debian0-1. + + +We recommend that you upgrade your horde3 packages. + +Solution: +https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201897-1 + +Risk factor : High"; + + script_description(desc); + + script_summary("Debian Security Advisory DSA 1897-1 (horde3)"); + + script_category(ACT_GATHER_INFO); + + script_copyright("Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com"); + script_family("Debian Local Security Checks"); + script_dependencies("gather-package-list.nasl"); + script_require_keys("ssh/login/packages"); + exit(0); +} + +# +# The script code starts here +# + +include("revisions-lib.inc"); +include("pkg-lib-deb.inc"); +vuln = 0; +if(isdpkgvuln(pkg:"horde3", ver:"3.1.3-4etch6", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"horde3", ver:"3.2.2+debian0-2+lenny1", rls:"DEB5.0")) { + vuln = 1; +} + +if(vuln) { + security_hole(0); +} Added: trunk/openvas-plugins/scripts/deb_1898_1.nasl =================================================================== --- trunk/openvas-plugins/scripts/deb_1898_1.nasl 2009-10-05 21:54:23 UTC (rev 5377) +++ trunk/openvas-plugins/scripts/deb_1898_1.nasl 2009-10-06 00:49:40 UTC (rev 5378) @@ -0,0 +1,100 @@ +# OpenVAS Vulnerability Test +# $Id$ +# Description: Auto-generated from advisory DSA 1898-1 (openswan) +# +# Authors: +# Thomas Reinke +# +# Copyright: +# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com +# Text descriptions are largely excerpted from the referenced +# advisory, and are Copyright (c) the respective author(s) +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2, +# or at your option, GNU General Public License version 3, +# as published by the Free Software Foundation +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# + +if(description) +{ + script_id(65004); + script_cve_id("CVE-2009-2185"); + script_version ("$"); + script_name("Debian Security Advisory DSA 1898-1 (openswan)"); + + desc = " +The remote host is missing an update to openswan +announced via advisory DSA 1898-1. + +It was discovered that the pluto daemon in the openswan, an +implementation of IPSEC and IKE, could crash when processing a crafted +X.509 certificate. + +For the old stable distribution (etch), this problem has been fixed in +version 2.4.6+dfsg.2-1.1+etch2. + +For the stable distribution (lenny), this problem has been fixed in +version 2.4.12+dfsg-1.3+lenny2. + +For the unstable distribution (sid), this problem has been fixed in +version 2.6.22+dfsg-1. + +We recommend that you upgrade your openswan package. + +Solution: +https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201898-1 + +Risk factor : High"; + + script_description(desc); + + script_summary("Debian Security Advisory DSA 1898-1 (openswan)"); + + script_category(ACT_GATHER_INFO); + + script_copyright("Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com"); + script_family("Debian Local Security Checks"); + script_dependencies("gather-package-list.nasl"); + script_require_keys("ssh/login/packages"); + exit(0); +} + +# +# The script code starts here +# + +include("revisions-lib.inc"); +include("pkg-lib-deb.inc"); +vuln = 0; +if(isdpkgvuln(pkg:"openswan-modules-source", ver:"2.4.6+dfsg.2-1.1+etch2", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"linux-patch-openswan", ver:"2.4.6+dfsg.2-1.1+etch2", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"openswan", ver:"2.4.6+dfsg.2-1.1+etch2", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"linux-patch-openswan", ver:"2.4.12+dfsg-1.3+lenny2", rls:"DEB5.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"openswan-modules-source", ver:"2.4.12+dfsg-1.3+lenny2", rls:"DEB5.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"openswan", ver:"2.4.12+dfsg-1.3+lenny2", rls:"DEB5.0")) { + vuln = 1; +} + +if(vuln) { + security_hole(0); +} Added: trunk/openvas-plugins/scripts/deb_1899_1.nasl =================================================================== --- trunk/openvas-plugins/scripts/deb_1899_1.nasl 2009-10-05 21:54:23 UTC (rev 5377) +++ trunk/openvas-plugins/scripts/deb_1899_1.nasl 2009-10-06 00:49:40 UTC (rev 5378) @@ -0,0 +1,102 @@ +# OpenVAS Vulnerability Test +# $Id$ +# Description: Auto-generated from advisory DSA 1899-1 (strongswan) +# +# Authors: +# Thomas Reinke +# +# Copyright: +# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com +# Text descriptions are largely excerpted from the referenced +# advisory, and are Copyright (c) the respective author(s) +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2, +# or at your option, GNU General Public License version 3, +# as published by the Free Software Foundation +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# + +if(description) +{ + script_id(65006); + script_cve_id("CVE-2009-1957", "CVE-2009-1958", "CVE-2009-2185", "CVE-2009-2661"); + script_version ("$"); + script_name("Debian Security Advisory DSA 1899-1 (strongswan)"); + + desc = " +The remote host is missing an update to strongswan +announced via advisory DSA 1899-1. + +Several remote vulnerabilities have been discovered in strongswan, an +implementation of the IPSEC and IKE protocols. The Common +Vulnerabilities and Exposures project identifies the following +problems: + +CVE-2009-1957 +CVE-2009-1958 + +The charon daemon can crash when processing certain crafted IKEv2 +packets. (The old stable distribution (etch) was not affected by +these two problems because it lacks IKEv2 support.) + +CVE-2009-2185 +CVE-2009-2661 + +The pluto daemon could crash when processing a crafted X.509 +certificate. + +For the old stable distribution (etch), these problems have been fixed +in version 2.8.0+dfsg-1+etch2. + +For the stable distribution (lenny), these problems have been fixed in +version 4.2.4-5+lenny3. + +For the unstable distribution (sid), these problems have been fixed in +version 4.3.2-1.1. + +We recommend that you upgrade your strongswan packages. + +Solution: +https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201899-1 + +Risk factor : High"; + + script_description(desc); + + script_summary("Debian Security Advisory DSA 1899-1 (strongswan)"); + + script_category(ACT_GATHER_INFO); + + script_copyright("Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com"); + script_family("Debian Local Security Checks"); + script_dependencies("gather-package-list.nasl"); + script_require_keys("ssh/login/packages"); + exit(0); +} + +# +# The script code starts here +# + +include("revisions-lib.inc"); +include("pkg-lib-deb.inc"); +vuln = 0; +if(isdpkgvuln(pkg:"strongswan", ver:"2.8.0+dfsg-1+etch2", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"strongswan", ver:"4.2.4-5+lenny3", rls:"DEB5.0")) { + vuln = 1; +} + +if(vuln) { + security_hole(0); +} Added: trunk/openvas-plugins/scripts/deb_1900_1.nasl =================================================================== --- trunk/openvas-plugins/scripts/deb_1900_1.nasl 2009-10-05 21:54:23 UTC (rev 5377) +++ trunk/openvas-plugins/scripts/deb_1900_1.nasl 2009-10-06 00:49:40 UTC (rev 5378) @@ -0,0 +1,226 @@ +# OpenVAS Vulnerability Test +# $Id$ +# Description: Auto-generated from advisory DSA 1900-1 (postgresql-7.4, postgresql-8.1, postgresql-8.3, postgresql-8.4) +# +# Authors: +# Thomas Reinke +# +# Copyright: +# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com +# Text descriptions are largely excerpted from the referenced +# advisory, and are Copyright (c) the respective author(s) +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2, +# or at your option, GNU General Public License version 3, +# as published by the Free Software Foundation +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# + +if(description) +{ + script_id(65005); + script_cve_id("CVE-2009-3229", "CVE-2009-3230", "CVE-2009-3231"); + script_version ("$"); + script_name("Debian Security Advisory DSA 1900-1 (postgresql-7.4, postgresql-8.1, postgresql-8.3, postgresql-8.4)"); + + desc = " +The remote host is missing an update to postgresql-7.4, postgresql-8.1, postgresql-8.3, postgresql-8.4 +announced via advisory DSA 1900-1. + +Several vulnerabilities have been discovered in PostgreSQL, an SQL +database system. The Common Vulnerabilities and Exposures project +identifies the following problems: + +CVE-2009-3229 + +Authenticated users can shut down the backend server by re-LOAD-ing +libraries in $libdir/plugins, if any libraries are present there. +(The old stable distribution (etch) is not affected by this issue.) + +CVE-2009-3230 + +Authenticated non-superusers can gain database superuser privileges if +they can create functions and tables due to incorrect execution of +functions in functional indexes. + +CVE-2009-3231 + +If PostgreSQL is configured with LDAP authentication, and the LDAP +configuration allows anonymous binds, it is possible for a user to +authenticate themselves with an empty password. (The old stable +distribution (etch) is not affected by this issue.) + +In addition, this update contains reliability improvements which do +not target security issues. + +For the old stable distribution (etch), these problems have been fixed +in version 7.4.26-0etch1 of the postgresql-7.4 source package, and +version 8.1.18-0etch1 of the postgresql-8.1 source package. + +For the stable distribution (lenny), these problems have been fixed in +version 8.3.8-0lenny1 of the postgresql-8.3 source package. + +For the unstable distribution (sid), these problems have been fixed in +version 8.3.8-1 of the postgresql-8.3 source package, and version +8.4.1-1 of the postgresql-8.4 source package. + +We recommend that you upgrade your PostgreSQL packages. + +Solution: +https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201900-1 + +Risk factor : High"; + + script_description(desc); + + script_summary("Debian Security Advisory DSA 1900-1 (postgresql-7.4, postgresql-8.1, postgresql-8.3, postgresql-8.4)"); + + script_category(ACT_GATHER_INFO); + + script_copyright("Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com"); + script_family("Debian Local Security Checks"); + script_dependencies("gather-package-list.nasl"); + script_require_keys("ssh/login/packages"); + exit(0); +} + +# +# The script code starts here +# + +include("revisions-lib.inc"); +include("pkg-lib-deb.inc"); +vuln = 0; +if(isdpkgvuln(pkg:"postgresql-server-dev-7.4", ver:"7.4.26-0etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-doc-8.1", ver:"8.1.18-0etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-doc-7.4", ver:"7.4.26-0etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-contrib-7.4", ver:"7.4.26-0etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-plperl-7.4", ver:"7.4.26-0etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libpq4", ver:"8.1.18-0etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-8.1", ver:"8.1.18-0etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libpq-dev", ver:"8.1.18-0etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-plpython-8.1", ver:"8.1.18-0etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libecpg5", ver:"8.1.18-0etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libecpg-compat2", ver:"8.1.18-0etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-plperl-8.1", ver:"8.1.18-0etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-contrib-8.1", ver:"8.1.18-0etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libecpg-dev", ver:"8.1.18-0etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-plpython-7.4", ver:"7.4.26-0etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libpgtypes2", ver:"8.1.18-0etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-pltcl-7.4", ver:"7.4.26-0etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-server-dev-8.1", ver:"8.1.18-0etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-client-7.4", ver:"7.4.26-0etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-7.4", ver:"7.4.26-0etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-pltcl-8.1", ver:"8.1.18-0etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-client-8.1", ver:"8.1.18-0etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-doc-8.3", ver:"8.3.8-0lenny1", rls:"DEB5.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-contrib", ver:"8.3.8-0lenny1", rls:"DEB5.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-client", ver:"8.3.8-0lenny1", rls:"DEB5.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-doc", ver:"8.3.8-0lenny1", rls:"DEB5.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql", ver:"8.3.8-0lenny1", rls:"DEB5.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-pltcl-8.3", ver:"8.3.8-0lenny1", rls:"DEB5.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libpq-dev", ver:"8.3.8-0lenny1", rls:"DEB5.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-contrib-8.3", ver:"8.3.8-0lenny1", rls:"DEB5.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libecpg-compat3", ver:"8.3.8-0lenny1", rls:"DEB5.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libpq5", ver:"8.3.8-0lenny1", rls:"DEB5.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libpgtypes3", ver:"8.3.8-0lenny1", rls:"DEB5.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libecpg6", ver:"8.3.8-0lenny1", rls:"DEB5.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-client-8.3", ver:"8.3.8-0lenny1", rls:"DEB5.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-server-dev-8.3", ver:"8.3.8-0lenny1", rls:"DEB5.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-plperl-8.3", ver:"8.3.8-0lenny1", rls:"DEB5.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libecpg-dev", ver:"8.3.8-0lenny1", rls:"DEB5.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-plpython-8.3", ver:"8.3.8-0lenny1", rls:"DEB5.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"postgresql-8.3", ver:"8.3.8-0lenny1", rls:"DEB5.0")) { + vuln = 1; +} + +if(vuln) { + security_hole(0); +} Added: trunk/openvas-plugins/scripts/deb_1901_1.nasl =================================================================== --- trunk/openvas-plugins/scripts/deb_1901_1.nasl 2009-10-05 21:54:23 UTC (rev 5377) +++ trunk/openvas-plugins/scripts/deb_1901_1.nasl 2009-10-06 00:49:40 UTC (rev 5378) @@ -0,0 +1,115 @@ +# OpenVAS Vulnerability Test +# $Id$ +# Description: Auto-generated from advisory DSA 1901-1 (mediawiki1.7) +# +# Authors: +# Thomas Reinke +# +# Copyright: +# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com +# Text descriptions are largely excerpted from the referenced +# advisory, and are Copyright (c) the respective author(s) +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2, +# or at your option, GNU General Public License version 3, +# as published by the Free Software Foundation +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# + +if(description) +{ + script_id(65007); + script_cve_id("CVE-2008-5249", "CVE-2008-5250", "CVE-2008-5252", "CVE-2009-0737"); + script_version ("$"); + script_name("Debian Security Advisory DSA 1901-1 (mediawiki1.7)"); + + desc = " +The remote host is missing an update to mediawiki1.7 +announced via advisory DSA 1901-1. + + +Several vulnerabilities have been discovered in mediawiki1.7, a website engine +for collaborative work. The Common Vulnerabilities and Exposures project +identifies the following problems: + +CVE-2008-5249 + +David Remahl discovered that mediawiki1.7 is prone to a cross-site scripting attack. + +CVE-2008-5250 + +David Remahl discovered that mediawiki1.7, when Internet Explorer is used and +uploads are enabled, or an SVG scripting browser is used and SVG uploads are +enabled, allows remote authenticated users to inject arbitrary web script or +HTML by editing a wiki page. + +CVE-2008-5252 + +David Remahl discovered that mediawiki1.7 is prone to a cross-site request +forgery vulnerability in the Special:Import feature. + +CVE-2009-0737 + +It was discovered that mediawiki1.7 is prone to a cross-site scripting attack in +the web-based installer. + + +For the oldstable distribution (etch), these problems have been fixed in version +1.7.1-9etch1 for mediawiki1.7, and mediawiki is not affected (it is a +metapackage for mediawiki1.7). + +The stable (lenny) distribution does not include mediawiki1.7, and these +problems have been fixed in version 1:1.12.0-2lenny3 for mediawiki which was +already included in the lenny release. + +The unstable (sid) and testing (squeeze) distributions do not +include mediawiki1.7, and these problems have been fixed in version 1:1.14.0-1 +for mediawiki. + + +We recommend that you upgrade your mediawiki1.7 packages. + +Solution: +https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201901-1 + +Risk factor : High"; + + script_description(desc); + + script_summary("Debian Security Advisory DSA 1901-1 (mediawiki1.7)"); + + script_category(ACT_GATHER_INFO); + + script_copyright("Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com"); + script_family("Debian Local Security Checks"); + script_dependencies("gather-package-list.nasl"); + script_require_keys("ssh/login/packages"); + exit(0); +} + +# +# The script code starts here +# + +include("revisions-lib.inc"); +include("pkg-lib-deb.inc"); +vuln = 0; +if(isdpkgvuln(pkg:"mediawiki1.7", ver:"1.7.1-9etch1", rls:"DEB4.0")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"mediawiki1.7-math", ver:"1.7.1-9etch1", rls:"DEB4.0")) { + vuln = 1; +} + +if(vuln) { + security_hole(0); +} Added: trunk/openvas-plugins/scripts/fcore_2009_10165.nasl =================================================================== --- trunk/openvas-plugins/scripts/fcore_2009_10165.nasl 2009-10-05 21:54:23 UTC (rev 5377) +++ trunk/openvas-plugins/scripts/fcore_2009_10165.nasl 2009-10-06 00:49:40 UTC (rev 5378) @@ -0,0 +1,181 @@ +# OpenVAS Vulnerability Test +# $Id$ +# Description: Auto-generated from advisory FEDORA-2009-10165 (kernel) +# +# Authors: +# Thomas Reinke +# +# Copyright: +# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com +# Text descriptions are largely excerpted from the referenced +# advisory, and are Copyright (c) the respective author(s) +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2, +# or at your option, GNU General Public License version 3, +# as published by the Free Software Foundation +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# + +if(description) +{ + script_id(64999); + script_cve_id("CVE-2009-2903", "CVE-2009-3290", "CVE-2009-2847", "CVE-2009-2692", "CVE-2009-2406", "CVE-2009-2407", "CVE-2009-1895", "CVE-2009-1897", "CVE-2009-0065", "CVE-2008-5079", "CVE-2009-3001", "CVE-2009-3002"); + script_version ("$"); + script_name("Fedora Core 10 FEDORA-2009-10165 (kernel)"); + + desc = " +The remote host is missing an update to kernel +announced via advisory FEDORA-2009-10165. + +Update Information: + +Update to kernel 2.6.27.35: +http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.31 +http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.32 +http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.33 +http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.34 +http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.35 + +ChangeLog: + +* Sat Sep 26 2009 Chuck Ebbert 2.6.27.35-170.2.94 +- Backport appletalk: Fix skb leak when ipddp interface is not loaded +(fixes CVE-2009-2903) +* Sat Sep 26 2009 Chuck Ebbert 2.6.27.35-170.2.93 +- Backport KVM: x86: Disallow hypercalls for guest callers in rings > 0 +(fixes CVE-2009-3290) +* Thu Sep 24 2009 Chuck Ebbert 2.6.27.35-170.2.92 +- Linux 2.6.27.35 +- Drop merged patches: +linux-2.6-nfsd-report-short-writes-fix.patch +linux-2.6-nfsd-report-short-writes.patch +* Tue Sep 15 2009 Chuck Ebbert 2.6.27.34-170.2.91 +- Linux 2.6.27.34 +- Drop merged patch: linux-2.6-slub-fix-destroy-by-rcu.patch +* Wed Sep 9 2009 Chuck Ebbert 2.6.27.32-170.2.90 +- 2.6.27.32 final +- Drop linux-2.6-ocfs2-handle-len-0.patch, added after .32-rc1 +* Mon Sep 7 2009 Chuck Ebbert 2.6.27.32-170.2.89.rc1 +- Backport fix for b43 on ppc64 to 2.6.27 (#514787) +* Sun Sep 6 2009 Chuck Ebbert 2.6.27.32-170.2.88.rc1 +- Add patches requested for the next stable release: +linux-2.6-slub-fix-destroy-by-rcu.patch (fixes bug in 2.6.27.29) +linux-2.6-ocfs2-handle-len-0.patch (fixes bug in 2.6.27.32-rc1) +* Fri Sep 4 2009 Chuck Ebbert 2.6.27.32-170.2.87.rc1 +- Copy fix for NFS short write reporting from F-10 2.6.29 kernel (#493500) + +References: + +[ 1 ] Bug #515392 - CVE-2009-2847 kernel: information leak in sigaltstack +https://bugzilla.redhat.com/show_bug.cgi?id=515392 +[ 2 ] Bug #524124 - CVE-2009-3290 kernel: KVM: x86: Disallow hypercalls for guest callers in rings > 0 +https://bugzilla.redhat.com/show_bug.cgi?id=524124 +[ 3 ] Bug #522331 - CVE-2009-2903 kernel: appletalk: denial of service when handling IP tunnelled over DDP datagrams +https://bugzilla.redhat.com/show_bug.cgi?id=522331 +[ 4 ] Bug #519305 - CVE-2009-3001, CVE-2009-3002 kernel: numerous getname() infoleaks +https://bugzilla.redhat.com/show_bug.cgi?id=519305 + +Solution: Apply the appropriate updates. + +This update can be installed with the yum update program. Use +su -c 'yum update kernel' at the command line. +For more information, refer to Managing Software with yum, +available at http://docs.fedoraproject.org/yum/. + +https://secure1.securityspace.com/smysecure/catid.html?in=FEDORA-2009-10165 + +Risk factor : High"; + + script_description(desc); + + script_summary("Fedora Core 10 FEDORA-2009-10165 (kernel)"); + + script_category(ACT_GATHER_INFO); + + script_copyright("Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com"); + script_family("Fedora Local Security Checks"); + script_dependencies("gather-package-list.nasl"); + script_require_keys("ssh/login/rpms"); + exit(0); +} + +# +# The script code starts here +# + +include("revisions-lib.inc"); +include("pkg-lib-rpm.inc"); +vuln = 0; +if(isrpmvuln(pkg:"kernel-headers", rpm:"kernel-headers~2.6.27.35~170.2.94.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel", rpm:"kernel~2.6.27.35~170.2.94.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-devel", rpm:"kernel-devel~2.6.27.35~170.2.94.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-debuginfo", rpm:"kernel-debuginfo~2.6.27.35~170.2.94.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-debuginfo-common", rpm:"kernel-debuginfo-common~2.6.27.35~170.2.94.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-PAE", rpm:"kernel-PAE~2.6.27.35~170.2.94.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-PAE-devel", rpm:"kernel-PAE-devel~2.6.27.35~170.2.94.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-PAEdebug", rpm:"kernel-PAEdebug~2.6.27.35~170.2.94.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-PAEdebug-devel", rpm:"kernel-PAEdebug-devel~2.6.27.35~170.2.94.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-debug", rpm:"kernel-debug~2.6.27.35~170.2.94.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-debug-devel", rpm:"kernel-debug-devel~2.6.27.35~170.2.94.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-PAE-debuginfo", rpm:"kernel-PAE-debuginfo~2.6.27.35~170.2.94.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-PAEdebug-debuginfo", rpm:"kernel-PAEdebug-debuginfo~2.6.27.35~170.2.94.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-debug-debuginfo", rpm:"kernel-debug-debuginfo~2.6.27.35~170.2.94.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-doc", rpm:"kernel-doc~2.6.27.35~170.2.94.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-firmware", rpm:"kernel-firmware~2.6.27.35~170.2.94.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-bootwrapper", rpm:"kernel-bootwrapper~2.6.27.35~170.2.94.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-smp", rpm:"kernel-smp~2.6.27.35~170.2.94.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-smp-devel", rpm:"kernel-smp-devel~2.6.27.35~170.2.94.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"kernel-smp-debuginfo", rpm:"kernel-smp-debuginfo~2.6.27.35~170.2.94.fc10", rls:"FC10")) { + vuln = 1; +} + +if(vuln) { + security_hole(0); +} Added: trunk/openvas-plugins/scripts/fcore_2009_10172.nasl =================================================================== --- trunk/openvas-plugins/scripts/fcore_2009_10172.nasl 2009-10-05 21:54:23 UTC (rev 5377) +++ trunk/openvas-plugins/scripts/fcore_2009_10172.nasl 2009-10-06 00:49:40 UTC (rev 5378) @@ -0,0 +1,140 @@ +# OpenVAS Vulnerability Test +# $Id$ +# Description: Auto-generated from advisory FEDORA-2009-10172 (samba) +# +# Authors: +# Thomas Reinke +# +# Copyright: +# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com +# Text descriptions are largely excerpted from the referenced +# advisory, and are Copyright (c) the respective author(s) +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2, +# or at your option, GNU General Public License version 3, +# as published by the Free Software Foundation +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# + +if(description) +{ + script_id(65001); + script_cve_id("CVE-2009-2813", "CVE-2009-2948", "CVE-2009-2906", "CVE-2009-0022", "CVE-2008-4314"); + script_version ("$"); + script_name("Fedora Core 10 FEDORA-2009-10172 (samba)"); + + desc = " +The remote host is missing an update to samba +announced via advisory FEDORA-2009-10172. + +Update Information: + +Security Release, fixes CVE-2009-2813, CVE-2009-2948 and CVE-2009-2906 + +ChangeLog: + +* Thu Oct 1 2009 Guenther Deschner - 3.2.15-0.36 +- Update to 3.2.15 +- Security Release, fixes CVE-2009-2813, CVE-2009-2948 and CVE-2009-2906 + +References: + +[ 1 ] Bug #523752 - CVE-2009-2813 Samba: Share restriction bypass via home-less directory user account(s) +https://bugzilla.redhat.com/show_bug.cgi?id=523752 +[ 2 ] Bug #526074 - CVE-2009-2948 samba: information disclosure in suid mount.cifs +https://bugzilla.redhat.com/show_bug.cgi?id=526074 +[ 3 ] Bug #526645 - CVE-2009-2906 samba: infinite loop flaw in smbd on unexpected oplock break notification reply +https://bugzilla.redhat.com/show_bug.cgi?id=526645 + +Solution: Apply the appropriate updates. + +This update can be installed with the yum update program. Use +su -c 'yum update samba' at the command line. +For more information, refer to Managing Software with yum, +available at http://docs.fedoraproject.org/yum/. + +https://secure1.securityspace.com/smysecure/catid.html?in=FEDORA-2009-10172 + +Risk factor : High"; + + script_description(desc); + + script_summary("Fedora Core 10 FEDORA-2009-10172 (samba)"); + + script_category(ACT_GATHER_INFO); + + script_copyright("Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com"); + script_family("Fedora Local Security Checks"); + script_dependencies("gather-package-list.nasl"); + script_require_keys("ssh/login/rpms"); + exit(0); +} + +# +# The script code starts here +# + +include("revisions-lib.inc"); +include("pkg-lib-rpm.inc"); +vuln = 0; +if(isrpmvuln(pkg:"libsmbclient", rpm:"libsmbclient~3.2.15~0.36.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libsmbclient-devel", rpm:"libsmbclient-devel~3.2.15~0.36.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libtalloc", rpm:"libtalloc~1.2.0~36.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libtalloc-devel", rpm:"libtalloc-devel~1.2.0~36.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libtdb", rpm:"libtdb~1.1.1~36.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libtdb-devel", rpm:"libtdb-devel~1.1.1~36.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"samba", rpm:"samba~3.2.15~0.36.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"samba-client", rpm:"samba-client~3.2.15~0.36.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"samba-common", rpm:"samba-common~3.2.15~0.36.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"samba-doc", rpm:"samba-doc~3.2.15~0.36.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"samba-domainjoin-gui", rpm:"samba-domainjoin-gui~3.2.15~0.36.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"samba-swat", rpm:"samba-swat~3.2.15~0.36.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"samba-winbind", rpm:"samba-winbind~3.2.15~0.36.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"samba-winbind-devel", rpm:"samba-winbind-devel~3.2.15~0.36.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"tdb-tools", rpm:"tdb-tools~1.1.1~36.fc10", rls:"FC10")) { + vuln = 1; +} +if(isrpmvuln(pkg:"samba-debuginfo", rpm:"samba-debuginfo~3.2.15~0.36.fc10", rls:"FC10")) { + vuln = 1; +} + +if(vuln) { + security_hole(0); +} Added: trunk/openvas-plugins/scripts/fcore_2009_10180.nasl =================================================================== --- trunk/openvas-plugins/scripts/fcore_2009_10180.nasl 2009-10-05 21:54:23 UTC (rev 5377) +++ trunk/openvas-plugins/scripts/fcore_2009_10180.nasl 2009-10-06 00:49:40 UTC (rev 5378) @@ -0,0 +1,127 @@ +# OpenVAS Vulnerability Test +# $Id$ +# Description: Auto-generated from advisory FEDORA-2009-10180 (samba) +# +# Authors: +# Thomas Reinke +# +# Copyright: +# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com +# Text descriptions are largely excerpted from the referenced +# advisory, and are Copyright (c) the respective author(s) +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2, +# or at your option, GNU General Public License version 3, +# as published by the Free Software Foundation +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# + +if(description) +{ + script_id(65000); + script_cve_id("CVE-2009-2813", "CVE-2009-2948", "CVE-2009-2906"); + script_version ("$"); + script_name("Fedora Core 11 FEDORA-2009-10180 (samba)"); + + desc = " +The remote host is missing an update to samba +announced via advisory FEDORA-2009-10180. + +Update Information: + +Security Release, fixes CVE-2009-2813, CVE-2009-2948 and CVE-2009-2906 + +ChangeLog: + +* Thu Oct 1 2009 Guenther Deschner - 3.4.2-0.42 +- Update to 3.4.2 +- Security Release, fixes CVE-2009-2813, CVE-2009-2948 and CVE-2009-2906 +* Wed Sep 9 2009 Guenther Deschner - 3.4.1.0-41 +- Update to 3.4.1 + +References: + +[ 1 ] Bug #523752 - CVE-2009-2813 Samba: Share restriction bypass via home-less directory user account(s) +https://bugzilla.redhat.com/show_bug.cgi?id=523752 +[ 2 ] Bug #526074 - CVE-2009-2948 samba: information disclosure in suid mount.cifs +https://bugzilla.redhat.com/show_bug.cgi?id=526074 +[ 3 ] Bug #526645 - CVE-2009-2906 samba: infinite loop flaw in smbd on unexpected oplock break notification reply +https://bugzilla.redhat.com/show_bug.cgi?id=526645 + +Solution: Apply the appropriate updates. + +This update can be installed with the yum update program. Use +su -c 'yum update samba' at the command line. +For more information, refer to Managing Software with yum, +available at http://docs.fedoraproject.org/yum/. + +https://secure1.securityspace.com/smysecure/catid.html?in=FEDORA-2009-10180 + +Risk factor : High"; + + script_description(desc); + + script_summary("Fedora Core 11 FEDORA-2009-10180 (samba)"); + + script_category(ACT_GATHER_INFO); + + script_copyright("Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com"); + script_family("Fedora Local Security Checks"); + script_dependencies("gather-package-list.nasl"); + script_require_keys("ssh/login/rpms"); + exit(0); +} + +# +# The script code starts here +# + +include("revisions-lib.inc"); +include("pkg-lib-rpm.inc"); +vuln = 0; +if(isrpmvuln(pkg:"libsmbclient", rpm:"libsmbclient~3.4.2~0.42.fc11", rls:"FC11")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libsmbclient-devel", rpm:"libsmbclient-devel~3.4.2~0.42.fc11", rls:"FC11")) { + vuln = 1; +} +if(isrpmvuln(pkg:"samba", rpm:"samba~3.4.2~0.42.fc11", rls:"FC11")) { + vuln = 1; +} +if(isrpmvuln(pkg:"samba-client", rpm:"samba-client~3.4.2~0.42.fc11", rls:"FC11")) { + vuln = 1; +} +if(isrpmvuln(pkg:"samba-common", rpm:"samba-common~3.4.2~0.42.fc11", rls:"FC11")) { + vuln = 1; +} +if(isrpmvuln(pkg:"samba-doc", rpm:"samba-doc~3.4.2~0.42.fc11", rls:"FC11")) { + vuln = 1; +} +if(isrpmvuln(pkg:"samba-domainjoin-gui", rpm:"samba-domainjoin-gui~3.4.2~0.42.fc11", rls:"FC11")) { + vuln = 1; +} +if(isrpmvuln(pkg:"samba-swat", rpm:"samba-swat~3.4.2~0.42.fc11", rls:"FC11")) { + vuln = 1; +} +if(isrpmvuln(pkg:"samba-winbind", rpm:"samba-winbind~3.4.2~0.42.fc11", rls:"FC11")) { + vuln = 1; +} +if(isrpmvuln(pkg:"samba-winbind-devel", rpm:"samba-winbind-devel~3.4.2~0.42.fc11", rls:"FC11")) { + vuln = 1; +} +if(isrpmvuln(pkg:"samba-debuginfo", rpm:"samba-debuginfo~3.4.2~0.42.fc11", rls:"FC11")) { + vuln = 1; +} + +if(vuln) { + security_hole(0); +} Added: trunk/openvas-plugins/scripts/freebsd_mybb.nasl =================================================================== --- trunk/openvas-plugins/scripts/freebsd_mybb.nasl 2009-10-05 21:54:23 UTC (rev 5377) +++ trunk/openvas-plugins/scripts/freebsd_mybb.nasl 2009-10-06 00:49:40 UTC (rev 5378) @@ -0,0 +1,82 @@ +# +#VID beb6f4a8-add5-11de-8b55-0030843d3802 +# OpenVAS Vulnerability Test +# $ +# Description: Auto generated from VID beb6f4a8-add5-11de-8b55-0030843d3802 +# +# Authors: +# Thomas Reinke +# +# Copyright: +# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com +# Text descriptions are largely excerpted from the referenced +# advisories, and are Copyright (c) the respective author(s) +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2, +# as published by the Free Software Foundation +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# + +if(description) +{ + script_id(65012); + script_bugtraq_id(36460); + script_version ("$"); + script_name("FreeBSD Ports: mybb"); + + desc = " +The remote host is missing an update to the system +as announced in the referenced advisory. + +The following package is affected: mybb + +Solution: +Update your system with the appropriate patches or +software upgrades. + +http://dev.mybboard.net/issues/464 +http://dev.mybboard.net/issues/418 +http://secunia.com/advisories/36803 +http://blog.mybboard.net/2009/09/21/mybb-1-4-9-released-security-update/ +http://www.vuxml.org/freebsd/beb6f4a8-add5-11de-8b55-0030843d3802.html + +Risk factor : High"; + + script_description(desc); + + script_summary("FreeBSD Ports: mybb"); + + script_category(ACT_GATHER_INFO); + + script_copyright("Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com"); + script_family("FreeBSD Local Security Checks"); + script_dependencies("gather-package-list.nasl"); + script_require_keys("ssh/login/freebsdrel"); + exit(0); +} + +# +# The script code starts here +# + +include("revisions-lib.inc"); +include("pkg-lib-bsd.inc"); +vuln = 0; +bver = portver(pkg:"mybb"); +if(!isnull(bver) && revcomp(a:bver, b:"1.4.9")<0) { + security_note(0, data:"Package mybb version " + bver + " is installed which is known to be vulnerable."); + vuln = 1; +} + +if(vuln) { + security_hole(0); +} Added: trunk/openvas-plugins/scripts/freebsdsa_devfs1.nasl =================================================================== --- trunk/openvas-plugins/scripts/freebsdsa_devfs1.nasl 2009-10-05 21:54:23 UTC (rev 5377) +++ trunk/openvas-plugins/scripts/freebsdsa_devfs1.nasl 2009-10-06 00:49:40 UTC (rev 5378) @@ -0,0 +1,90 @@ +# +#ADV FreeBSD-SA-09:14.devfs.asc +# OpenVAS Vulnerability Test +# $ +# Description: Auto generated from ADV FreeBSD-SA-09:14.devfs.asc +# +# Authors: +# Thomas Reinke +# +# Copyright: +# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com +# Text descriptions are largely excerpted from the referenced +# advisories, and are Copyright (c) the respective author(s) +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2, +# as published by the Free Software Foundation +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# + +if(description) +{ + script_id(65014); + script_version ("$"); + script_name("FreeBSD Security Advisory (FreeBSD-SA-09:14.devfs.asc)"); + + desc = " +The remote host is missing an update to the system +as announced in the referenced advisory FreeBSD-SA-09:14.devfs.asc + +The device file system (devfs) provides access to system devices, such as +storage devices and serial ports, via the file system namespace. + +VFS is the Virtual File System, which abstracts file system operations in +the kernel from the actual underlying file system. + +Due to the interaction between devfs and VFS, a race condition exists +where the kernel might dereference a NULL pointer. + +Solution: +Upgrade your system to the appropriate stable release +or security branch dated after the correction date + +https://secure1.securityspace.com/smysecure/catid.html?in=FreeBSD-SA-09:14.devfs.asc +Risk factor : High"; + + script_description(desc); + + script_summary("FreeBSD Security Advisory (FreeBSD-SA-09:14.devfs.asc)"); + + script_category(ACT_GATHER_INFO); + + script_copyright("Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com"); + script_family("FreeBSD Local Security Checks"); + script_dependencies("gather-package-list.nasl"); + script_require_keys("ssh/login/freebsdpatchlevel"); + exit(0); +} + +# +# The script code starts here +# + +include("revisions-lib.inc"); +include("pkg-lib-bsd.inc"); +vuln = 0; +if(patchlevelcmp(rel:"7.2", patchlevel:"4")<0) { + vuln = 1; +} +if(patchlevelcmp(rel:"7.1", patchlevel:"8")<0) { + vuln = 1; +} +if(patchlevelcmp(rel:"6.4", patchlevel:"7")<0) { + vuln = 1; +} +if(patchlevelcmp(rel:"6.3", patchlevel:"13")<0) { + vuln = 1; +} + +if(vuln) { + security_hole(0); +} Added: trunk/openvas-plugins/scripts/freebsdsa_pipe1.nasl =================================================================== --- trunk/openvas-plugins/scripts/freebsdsa_pipe1.nasl 2009-10-05 21:54:23 UTC (rev 5377) +++ trunk/openvas-plugins/scripts/freebsdsa_pipe1.nasl 2009-10-06 00:49:40 UTC (rev 5378) @@ -0,0 +1,84 @@ +# +#ADV FreeBSD-SA-09:13.pipe.asc +# OpenVAS Vulnerability Test +# $ +# Description: Auto generated from ADV FreeBSD-SA-09:13.pipe.asc +# +# Authors: +# Thomas Reinke +# +# Copyright: +# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com +# Text descriptions are largely excerpted from the referenced +# advisories, and are Copyright (c) the respective author(s) +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2, +# as published by the Free Software Foundation +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# + +if(description) +{ + script_id(65013); + script_version ("$"); + script_name("FreeBSD Security Advisory (FreeBSD-SA-09:13.pipe.asc)"); + + desc = " +The remote host is missing an update to the system +as announced in the referenced advisory FreeBSD-SA-09:13.pipe.asc + +Pipes are a form of inter-process communication (IPC) provided by the +FreeBSD kernel. kqueue is an event management API that applications can +use to monitor pipes and other kernel services. + +A race condition exists in the pipe close() code relating to kqueues, +causing use-after-free for kernel memory, which may lead to an +exploitable NULL pointer vulnerability in the kernel, kernel memory +corruption, and other unpredictable results. + +Solution: +Upgrade your system to the appropriate stable release +or security branch dated after the correction date + +https://secure1.securityspace.com/smysecure/catid.html?in=FreeBSD-SA-09:13.pipe.asc +Risk factor : High"; + + script_description(desc); + + script_summary("FreeBSD Security Advisory (FreeBSD-SA-09:13.pipe.asc)"); + + script_category(ACT_GATHER_INFO); + + script_copyright("Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com"); + script_family("FreeBSD Local Security Checks"); + script_dependencies("gather-package-list.nasl"); + script_require_keys("ssh/login/freebsdpatchlevel"); + exit(0); +} + +# +# The script code starts here +# + +include("revisions-lib.inc"); +include("pkg-lib-bsd.inc"); +vuln = 0; +if(patchlevelcmp(rel:"6.4", patchlevel:"7")<0) { + vuln = 1; +} +if(patchlevelcmp(rel:"6.3", patchlevel:"13")<0) { + vuln = 1; +} + +if(vuln) { + security_hole(0); +} Added: trunk/openvas-plugins/scripts/mdksa_2009_249.nasl =================================================================== --- trunk/openvas-plugins/scripts/mdksa_2009_249.nasl 2009-10-05 21:54:23 UTC (rev 5377) +++ trunk/openvas-plugins/scripts/mdksa_2009_249.nasl 2009-10-06 00:49:40 UTC (rev 5378) @@ -0,0 +1,185 @@ +# OpenVAS Vulnerability Test +# $Id$ +# Description: Auto-generated from advisory MDVSA-2009:249 (newt) +# +# Authors: +# Thomas Reinke +# +# Copyright: +# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com +# Text descriptions are largely excerpted from the referenced +# advisory, and are Copyright (c) the respective author(s) +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2, +# or at your option, GNU General Public License version 3, +# as published by the Free Software Foundation +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# + +if(description) +{ + script_id(64995); + script_cve_id("CVE-2009-2905"); + script_version ("$"); + script_name("Mandrake Security Advisory MDVSA-2009:249 (newt)"); + + desc = " +The remote host is missing an update to newt +announced via advisory MDVSA-2009:249. + +A vulnerability was discovered and corrected in newt: + +A heap-based buffer overflow flaw was found in the way newt processes +content that is to be displayed in a text dialog box. A local attacker +could issue a specially-crafted text dialog box display request +(direct or via a custom application), leading to a denial of service +(application crash) or, potentially, arbitrary code execution with the +privileges of the user running the application using the newt library +(CVE-2009-2905). + +This update provides a solution to this vulnerability. + +Affected: 2008.1, 2009.0, 2009.1, Corporate 3.0, Corporate 4.0, + Enterprise Server 5.0, Multi Network Firewall 2.0 + + +Solution: +To upgrade automatically use MandrakeUpdate or urpmi. The verification +of md5 checksums and GPG signatures is performed automatically for you. + +https://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:249 + +Risk factor : High"; + + script_description(desc); + + script_summary("Mandrake Security Advisory MDVSA-2009:249 (newt)"); + + script_category(ACT_GATHER_INFO); + + script_copyright("Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com"); + script_family("Mandrake Local Security Checks"); + script_dependencies("gather-package-list.nasl"); + script_require_keys("ssh/login/rpms"); + exit(0); +} + +# +# The script code starts here +# + +include("revisions-lib.inc"); +include("pkg-lib-rpm.inc"); +vuln = 0; +if(isrpmvuln(pkg:"libnewt0.52", rpm:"libnewt0.52~0.52.6~4.1mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libnewt0.52-devel", rpm:"libnewt0.52-devel~0.52.6~4.1mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"newt", rpm:"newt~0.52.6~4.1mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64newt0.52", rpm:"lib64newt0.52~0.52.6~4.1mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64newt0.52-devel", rpm:"lib64newt0.52-devel~0.52.6~4.1mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libnewt0.52", rpm:"libnewt0.52~0.52.6~5.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libnewt0.52-devel", rpm:"libnewt0.52-devel~0.52.6~5.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"newt", rpm:"newt~0.52.6~5.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64newt0.52", rpm:"lib64newt0.52~0.52.6~5.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64newt0.52-devel", rpm:"lib64newt0.52-devel~0.52.6~5.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libnewt0.52", rpm:"libnewt0.52~0.52.6~8.1mdv2009.1", rls:"MNDK_2009.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libnewt0.52-devel", rpm:"libnewt0.52-devel~0.52.6~8.1mdv2009.1", rls:"MNDK_2009.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"newt", rpm:"newt~0.52.6~8.1mdv2009.1", rls:"MNDK_2009.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64newt0.52", rpm:"lib64newt0.52~0.52.6~8.1mdv2009.1", rls:"MNDK_2009.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64newt0.52-devel", rpm:"lib64newt0.52-devel~0.52.6~8.1mdv2009.1", rls:"MNDK_2009.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libnewt0.51", rpm:"libnewt0.51~0.51.6~7.1.C30mdk", rls:"MNDK_3.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libnewt0.51-devel", rpm:"libnewt0.51-devel~0.51.6~7.1.C30mdk", rls:"MNDK_3.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"newt", rpm:"newt~0.51.6~7.1.C30mdk", rls:"MNDK_3.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64newt0.51", rpm:"lib64newt0.51~0.51.6~7.1.C30mdk", rls:"MNDK_3.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64newt0.51-devel", rpm:"lib64newt0.51-devel~0.51.6~7.1.C30mdk", rls:"MNDK_3.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libnewt0.51", rpm:"libnewt0.51~0.51.6~11.1.20060mlcs4", rls:"MNDK_4.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libnewt0.51-devel", rpm:"libnewt0.51-devel~0.51.6~11.1.20060mlcs4", rls:"MNDK_4.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"newt", rpm:"newt~0.51.6~11.1.20060mlcs4", rls:"MNDK_4.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64newt0.51", rpm:"lib64newt0.51~0.51.6~11.1.20060mlcs4", rls:"MNDK_4.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64newt0.51-devel", rpm:"lib64newt0.51-devel~0.51.6~11.1.20060mlcs4", rls:"MNDK_4.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libnewt0.52", rpm:"libnewt0.52~0.52.6~5.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libnewt0.52-devel", rpm:"libnewt0.52-devel~0.52.6~5.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"newt", rpm:"newt~0.52.6~5.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64newt0.52", rpm:"lib64newt0.52~0.52.6~5.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64newt0.52-devel", rpm:"lib64newt0.52-devel~0.52.6~5.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libnewt0.51", rpm:"libnewt0.51~0.51.6~7.1.C30mdk", rls:"MNDK_2.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libnewt0.51-devel", rpm:"libnewt0.51-devel~0.51.6~7.1.C30mdk", rls:"MNDK_2.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"newt", rpm:"newt~0.51.6~7.1.C30mdk", rls:"MNDK_2.0")) { + vuln = 1; +} + +if(vuln) { + security_hole(0); +} Added: trunk/openvas-plugins/scripts/mdksa_2009_253.nasl =================================================================== --- trunk/openvas-plugins/scripts/mdksa_2009_253.nasl 2009-10-05 21:54:23 UTC (rev 5377) +++ trunk/openvas-plugins/scripts/mdksa_2009_253.nasl 2009-10-06 00:49:40 UTC (rev 5378) @@ -0,0 +1,85 @@ +# OpenVAS Vulnerability Test +# $Id$ +# Description: Auto-generated from advisory MDVSA-2009:253 (backuppc) +# +# Authors: +# Thomas Reinke +# +# Copyright: +# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com +# Text descriptions are largely excerpted from the referenced +# advisory, and are Copyright (c) the respective author(s) +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2, +# or at your option, GNU General Public License version 3, +# as published by the Free Software Foundation +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# + +if(description) +{ + script_id(64996); + script_cve_id("CVE-2009-3369"); + script_version ("$"); + script_name("Mandrake Security Advisory MDVSA-2009:253 (backuppc)"); + + desc = " +The remote host is missing an update to backuppc +announced via advisory MDVSA-2009:253. + +A vulnerability was discovered and corrected in backuppc: + +CgiUserConfigEdit in BackupPC 3.1.0, when SSH keys and Rsync are in +use in a multi-user environment, does not restrict users from the +ClientNameAlias function, which allows remote authenticated users to +read and write sensitive files by modifying ClientNameAlias to match +another system, then initiating a backup or restore (CVE-2009-3369). + +This update provides a fix for this vulnerability. + +Affected: Enterprise Server 5.0 + +Solution: +To upgrade automatically use MandrakeUpdate or urpmi. The verification +of md5 checksums and GPG signatures is performed automatically for you. + +https://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:253 + +Risk factor : High"; + + script_description(desc); + + script_summary("Mandrake Security Advisory MDVSA-2009:253 (backuppc)"); + + script_category(ACT_GATHER_INFO); + + script_copyright("Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com"); + script_family("Mandrake Local Security Checks"); + script_dependencies("gather-package-list.nasl"); + script_require_keys("ssh/login/rpms"); + exit(0); +} + +# +# The script code starts here +# + +include("revisions-lib.inc"); +include("pkg-lib-rpm.inc"); +vuln = 0; +if(isrpmvuln(pkg:"backuppc", rpm:"backuppc~3.1.0~7.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} + +if(vuln) { + security_hole(0); +} Added: trunk/openvas-plugins/scripts/mdksa_2009_254.nasl =================================================================== --- trunk/openvas-plugins/scripts/mdksa_2009_254.nasl 2009-10-05 21:54:23 UTC (rev 5377) +++ trunk/openvas-plugins/scripts/mdksa_2009_254.nasl 2009-10-06 00:49:40 UTC (rev 5378) @@ -0,0 +1,325 @@ +# OpenVAS Vulnerability Test +# $Id$ +# Description: Auto-generated from advisory MDVSA-2009:254 (graphviz) +# +# Authors: +# Thomas Reinke +# +# Copyright: +# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com +# Text descriptions are largely excerpted from the referenced +# advisory, and are Copyright (c) the respective author(s) +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2, +# or at your option, GNU General Public License version 3, +# as published by the Free Software Foundation +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# + +if(description) +{ + script_id(64997); + script_cve_id("CVE-2008-4555"); + script_version ("$"); + script_name("Mandrake Security Advisory MDVSA-2009:254 (graphviz)"); + + desc = " +The remote host is missing an update to graphviz +announced via advisory MDVSA-2009:254. + +A vulnerability was discovered and corrected in graphviz: + +Stack-based buffer overflow in the push_subg function in parser.y +(lib/graph/parser.c) in Graphviz 2.20.2, and possibly earlier versions, +allows user-assisted remote attackers to cause a denial of service +(memory corruption) or execute arbitrary code via a DOT file with a +large number of Agraph_t elements (CVE-2008-4555). + +This update provides a fix for this vulnerability. + +Affected: 2008.1, 2009.0, Corporate 4.0, Enterprise Server 5.0 + +Solution: +To upgrade automatically use MandrakeUpdate or urpmi. The verification +of md5 checksums and GPG signatures is performed automatically for you. + +https://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:254 + +Risk factor : High"; + + script_description(desc); + + script_summary("Mandrake Security Advisory MDVSA-2009:254 (graphviz)"); + + script_category(ACT_GATHER_INFO); + + script_copyright("Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com"); + script_family("Mandrake Local Security Checks"); + script_dependencies("gather-package-list.nasl"); + script_require_keys("ssh/login/rpms"); + exit(0); +} + +# +# The script code starts here +# + +include("revisions-lib.inc"); +include("pkg-lib-rpm.inc"); +vuln = 0; +if(isrpmvuln(pkg:"graphviz", rpm:"graphviz~2.16.1~3.2mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"graphviz-doc", rpm:"graphviz-doc~2.16.1~3.2mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphviz4", rpm:"libgraphviz4~2.16.1~3.2mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphviz-devel", rpm:"libgraphviz-devel~2.16.1~3.2mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphvizlua0", rpm:"libgraphvizlua0~2.16.1~3.2mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphvizocaml0", rpm:"libgraphvizocaml0~2.16.1~3.2mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphvizperl0", rpm:"libgraphvizperl0~2.16.1~3.2mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphvizphp0", rpm:"libgraphvizphp0~2.16.1~3.2mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphvizpython0", rpm:"libgraphvizpython0~2.16.1~3.2mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphvizr0", rpm:"libgraphvizr0~2.16.1~3.2mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphvizruby0", rpm:"libgraphvizruby0~2.16.1~3.2mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphviz-static-devel", rpm:"libgraphviz-static-devel~2.16.1~3.2mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphviztcl0", rpm:"libgraphviztcl0~2.16.1~3.2mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphviz4", rpm:"lib64graphviz4~2.16.1~3.2mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphviz-devel", rpm:"lib64graphviz-devel~2.16.1~3.2mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphvizlua0", rpm:"lib64graphvizlua0~2.16.1~3.2mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphvizocaml0", rpm:"lib64graphvizocaml0~2.16.1~3.2mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphvizperl0", rpm:"lib64graphvizperl0~2.16.1~3.2mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphvizphp0", rpm:"lib64graphvizphp0~2.16.1~3.2mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphvizpython0", rpm:"lib64graphvizpython0~2.16.1~3.2mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphvizr0", rpm:"lib64graphvizr0~2.16.1~3.2mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphvizruby0", rpm:"lib64graphvizruby0~2.16.1~3.2mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphviz-static-devel", rpm:"lib64graphviz-static-devel~2.16.1~3.2mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphviztcl0", rpm:"lib64graphviztcl0~2.16.1~3.2mdv2008.1", rls:"MNDK_2008.1")) { + vuln = 1; +} +if(isrpmvuln(pkg:"graphviz", rpm:"graphviz~2.20.2~3.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"graphviz-doc", rpm:"graphviz-doc~2.20.2~3.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphviz4", rpm:"libgraphviz4~2.20.2~3.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphviz-devel", rpm:"libgraphviz-devel~2.20.2~3.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphvizlua0", rpm:"libgraphvizlua0~2.20.2~3.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphvizocaml0", rpm:"libgraphvizocaml0~2.20.2~3.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphvizperl0", rpm:"libgraphvizperl0~2.20.2~3.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphvizphp0", rpm:"libgraphvizphp0~2.20.2~3.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphvizpython0", rpm:"libgraphvizpython0~2.20.2~3.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphvizr0", rpm:"libgraphvizr0~2.20.2~3.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphvizruby0", rpm:"libgraphvizruby0~2.20.2~3.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphviz-static-devel", rpm:"libgraphviz-static-devel~2.20.2~3.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphviztcl0", rpm:"libgraphviztcl0~2.20.2~3.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphviz4", rpm:"lib64graphviz4~2.20.2~3.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphviz-devel", rpm:"lib64graphviz-devel~2.20.2~3.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphvizlua0", rpm:"lib64graphvizlua0~2.20.2~3.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphvizocaml0", rpm:"lib64graphvizocaml0~2.20.2~3.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphvizperl0", rpm:"lib64graphvizperl0~2.20.2~3.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphvizphp0", rpm:"lib64graphvizphp0~2.20.2~3.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphvizpython0", rpm:"lib64graphvizpython0~2.20.2~3.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphvizr0", rpm:"lib64graphvizr0~2.20.2~3.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphvizruby0", rpm:"lib64graphvizruby0~2.20.2~3.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphviz-static-devel", rpm:"lib64graphviz-static-devel~2.20.2~3.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphviztcl0", rpm:"lib64graphviztcl0~2.20.2~3.1mdv2009.0", rls:"MNDK_2009.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"graphviz", rpm:"graphviz~2.2.1~3.2.20060mdk", rls:"MNDK_4.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphviz7", rpm:"libgraphviz7~2.2.1~3.2.20060mdk", rls:"MNDK_4.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphviz7-devel", rpm:"libgraphviz7-devel~2.2.1~3.2.20060mdk", rls:"MNDK_4.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphviztcl7", rpm:"libgraphviztcl7~2.2.1~3.2.20060mdk", rls:"MNDK_4.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphviztcl7-devel", rpm:"libgraphviztcl7-devel~2.2.1~3.2.20060mdk", rls:"MNDK_4.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphviz7", rpm:"lib64graphviz7~2.2.1~3.2.20060mdk", rls:"MNDK_4.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphviz7-devel", rpm:"lib64graphviz7-devel~2.2.1~3.2.20060mdk", rls:"MNDK_4.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphviztcl7", rpm:"lib64graphviztcl7~2.2.1~3.2.20060mdk", rls:"MNDK_4.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphviztcl7-devel", rpm:"lib64graphviztcl7-devel~2.2.1~3.2.20060mdk", rls:"MNDK_4.0")) { + vuln = 1; +} +if(isrpmvuln(pkg:"graphviz", rpm:"graphviz~2.20.2~3.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"graphviz-doc", rpm:"graphviz-doc~2.20.2~3.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphviz4", rpm:"libgraphviz4~2.20.2~3.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphviz-devel", rpm:"libgraphviz-devel~2.20.2~3.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphvizlua0", rpm:"libgraphvizlua0~2.20.2~3.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphvizocaml0", rpm:"libgraphvizocaml0~2.20.2~3.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphvizperl0", rpm:"libgraphvizperl0~2.20.2~3.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphvizphp0", rpm:"libgraphvizphp0~2.20.2~3.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphvizpython0", rpm:"libgraphvizpython0~2.20.2~3.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphvizr0", rpm:"libgraphvizr0~2.20.2~3.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphvizruby0", rpm:"libgraphvizruby0~2.20.2~3.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphviz-static-devel", rpm:"libgraphviz-static-devel~2.20.2~3.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"libgraphviztcl0", rpm:"libgraphviztcl0~2.20.2~3.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphviz4", rpm:"lib64graphviz4~2.20.2~3.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphviz-devel", rpm:"lib64graphviz-devel~2.20.2~3.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphvizlua0", rpm:"lib64graphvizlua0~2.20.2~3.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphvizocaml0", rpm:"lib64graphvizocaml0~2.20.2~3.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphvizperl0", rpm:"lib64graphvizperl0~2.20.2~3.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphvizphp0", rpm:"lib64graphvizphp0~2.20.2~3.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphvizpython0", rpm:"lib64graphvizpython0~2.20.2~3.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphvizr0", rpm:"lib64graphvizr0~2.20.2~3.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphvizruby0", rpm:"lib64graphvizruby0~2.20.2~3.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphviz-static-devel", rpm:"lib64graphviz-static-devel~2.20.2~3.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} +if(isrpmvuln(pkg:"lib64graphviztcl0", rpm:"lib64graphviztcl0~2.20.2~3.1mdvmes5", rls:"MNDK_mes5")) { + vuln = 1; +} + +if(vuln) { + security_hole(0); +} Added: trunk/openvas-plugins/scripts/mdksa_2009_255.nasl =================================================================== --- trunk/openvas-plugins/scripts/mdksa_2009_255.nasl 2009-10-05 21:54:23 UTC (rev 5377) +++ trunk/openvas-plugins/scripts/mdksa_2009_255.nasl 2009-10-06 00:49:40 UTC (rev 5378) @@ -0,0 +1,84 @@ +# OpenVAS Vulnerability Test +# $Id$ +# Description: Auto-generated from advisory MDVSA-2009:255 (perl-DBD-Pg) +# +# Authors: +# Thomas Reinke +# +# Copyright: +# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com +# Text descriptions are largely excerpted from the referenced +# advisory, and are Copyright (c) the respective author(s) +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2, +# or at your option, GNU General Public License version 3, +# as published by the Free Software Foundation +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# + +if(description) +{ + script_id(64998); + script_cve_id("CVE-2009-0663"); + script_version ("$"); + script_name("Mandrake Security Advisory MDVSA-2009:255 (perl-DBD-Pg)"); + + desc = " +The remote host is missing an update to perl-DBD-Pg +announced via advisory MDVSA-2009:255. + +A vulnerability was discovered and corrected in perl-DBD-Pg: + +Heap-based buffer overflow in the DBD::Pg module for Perl might allow +context-dependent attackers to execute arbitrary code via unspecified +input to an application that uses the getline and pg_getline functions +to read database rows. + +This update provides a fix for this vulnerability. + +Affected: Corporate 4.0 + +Solution: +To upgrade automatically use MandrakeUpdate or urpmi. The verification +of md5 checksums and GPG signatures is performed automatically for you. + +https://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:255 + +Risk factor : High"; + + script_description(desc); + + script_summary("Mandrake Security Advisory MDVSA-2009:255 (perl-DBD-Pg)"); + + script_category(ACT_GATHER_INFO); + + script_copyright("Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com"); + script_family("Mandrake Local Security Checks"); + script_dependencies("gather-package-list.nasl"); + script_require_keys("ssh/login/rpms"); + exit(0); +} + +# +# The script code starts here +# + +include("revisions-lib.inc"); +include("pkg-lib-rpm.inc"); +vuln = 0; +if(isrpmvuln(pkg:"perl-DBD-Pg", rpm:"perl-DBD-Pg~1.43~2.1.20060mlcs4", rls:"MNDK_4.0")) { + vuln = 1; +} + +if(vuln) { + security_hole(0); +} Added: trunk/openvas-plugins/scripts/ubuntu_838_1.nasl =================================================================== --- trunk/openvas-plugins/scripts/ubuntu_838_1.nasl 2009-10-05 21:54:23 UTC (rev 5377) +++ trunk/openvas-plugins/scripts/ubuntu_838_1.nasl 2009-10-06 00:49:40 UTC (rev 5378) @@ -0,0 +1,138 @@ +# OpenVAS Vulnerability Test +# $Id$ +# Description: Auto-generated from advisory USN-838-1 (dovecot) +# +# Authors: +# Thomas Reinke +# +# Copyright: +# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com +# Text descriptions are largely excerpted from the referenced +# advisory, and are Copyright (c) the respective author(s) +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2, +# or at your option, GNU General Public License version 3, +# as published by the Free Software Foundation +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# + +if(description) +{ + script_id(65010); + script_cve_id("CVE-2008-4577", "CVE-2008-5301", "CVE-2009-2632", "CVE-2009-3235"); + script_version ("$"); + script_name("Ubuntu USN-838-1 (dovecot)"); + + desc = " +The remote host is missing an update to dovecot +announced via advisory USN-838-1. + +Details follow: + +It was discovered that the ACL plugin in Dovecot would incorrectly handle +negative access rights. An attacker could exploit this flaw to access the +Dovecot server, bypassing the indended access restrictions. This only +affected Ubuntu 8.04 LTS. (CVE-2008-4577) + +It was discovered that the ManageSieve service in Dovecot incorrectly +handled .. in script names. A remote attacker could exploit this to read +and modify arbitrary sieve files on the server. This only affected Ubuntu +8.10. (CVE-2008-5301) + +It was discovered that the Sieve plugin in Dovecot incorrectly handled +certain sieve scripts. An authenticated user could exploit this with a +crafted sieve script to cause a denial of service or possibly execute +arbitrary code. (CVE-2009-2632, CVE-2009-3235) + +Solution: +The problem can be corrected by upgrading your system to the +following package versions: + +Ubuntu 8.04 LTS: + dovecot-common 1:1.0.10-1ubuntu5.2 + +Ubuntu 8.10: + dovecot-common 1:1.1.4-0ubuntu1.3 + +Ubuntu 9.04: + dovecot-common 1:1.1.11-0ubuntu4.1 + +In general, a standard system upgrade is sufficient to effect the +necessary changes. + +https://secure1.securityspace.com/smysecure/catid.html?in=USN-838-1 + +Risk factor : High"; + + script_description(desc); + + script_summary("Ubuntu USN-838-1 (dovecot)"); + + script_category(ACT_GATHER_INFO); + + script_copyright("Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com"); + script_family("Ubuntu Local Security Checks"); + script_dependencies("gather-package-list.nasl"); + script_require_keys("ssh/login/packages"); + exit(0); +} + +# +# The script code starts here +# + +include("revisions-lib.inc"); +include("pkg-lib-deb.inc"); +vuln = 0; +if(isdpkgvuln(pkg:"dovecot-common", ver:"1.0.10-1ubuntu5.2", rls:"UBUNTU8.04 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"dovecot-dev", ver:"1.0.10-1ubuntu5.2", rls:"UBUNTU8.04 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"dovecot-imapd", ver:"1.0.10-1ubuntu5.2", rls:"UBUNTU8.04 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"dovecot-pop3d", ver:"1.0.10-1ubuntu5.2", rls:"UBUNTU8.04 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"dovecot-common", ver:"1.1.4-0ubuntu1.3", rls:"UBUNTU8.10")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"dovecot-dev", ver:"1.1.4-0ubuntu1.3", rls:"UBUNTU8.10")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"dovecot-imapd", ver:"1.1.4-0ubuntu1.3", rls:"UBUNTU8.10")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"dovecot-pop3d", ver:"1.1.4-0ubuntu1.3", rls:"UBUNTU8.10")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"dovecot-postfix", ver:"1.1.11-0ubuntu4.1", rls:"UBUNTU9.04")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"dovecot-common", ver:"1.1.11-0ubuntu4.1", rls:"UBUNTU9.04")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"dovecot-dev", ver:"1.1.11-0ubuntu4.1", rls:"UBUNTU9.04")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"dovecot-imapd", ver:"1.1.11-0ubuntu4.1", rls:"UBUNTU9.04")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"dovecot-pop3d", ver:"1.1.11-0ubuntu4.1", rls:"UBUNTU9.04")) { + vuln = 1; +} + +if(vuln) { + security_hole(0); +} Added: trunk/openvas-plugins/scripts/ubuntu_839_1.nasl =================================================================== --- trunk/openvas-plugins/scripts/ubuntu_839_1.nasl 2009-10-05 21:54:23 UTC (rev 5377) +++ trunk/openvas-plugins/scripts/ubuntu_839_1.nasl 2009-10-06 00:49:40 UTC (rev 5378) @@ -0,0 +1,278 @@ +# OpenVAS Vulnerability Test +# $Id$ +# Description: Auto-generated from advisory USN-839-1 (samba) +# +# Authors: +# Thomas Reinke +# +# Copyright: +# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com +# Text descriptions are largely excerpted from the referenced +# advisory, and are Copyright (c) the respective author(s) +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2, +# or at your option, GNU General Public License version 3, +# as published by the Free Software Foundation +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# + +if(description) +{ + script_id(65011); + script_cve_id("CVE-2009-1886", "CVE-2009-1888", "CVE-2009-2813", "CVE-2009-2906", "CVE-2009-2948"); + script_version ("$"); + script_name("Ubuntu USN-839-1 (samba)"); + + desc = " +The remote host is missing an update to samba +announced via advisory USN-839-1. + +Details follow: + +J. David Hester discovered that Samba incorrectly handled users that lack +home directories when the automated [homes] share is enabled. An +authenticated user could connect to that share name and gain access to the +whole filesystem. (CVE-2009-2813) + +Tim Prouty discovered that the smbd daemon in Samba incorrectly handled +certain unexpected network replies. A remote attacker could send malicious +replies to the server and cause smbd to use all available CPU, leading to a +denial of service. (CVE-2009-2906) + +Ronald Volgers discovered that the mount.cifs utility, when installed as a +setuid program, would not verify user permissions before opening a +credentials file. A local user could exploit this to use or read the +contents of unauthorized credential files. (CVE-2009-2948) + +Reinhard Ni?l discovered that the smbclient utility contained format string +vulnerabilities in its file name handling. Because of security features in +Ubuntu, exploitation of this vulnerability is limited. If a user or +automated system were tricked into processing a specially crafted file +name, smbclient could be made to crash, possibly leading to a denial of +service. This only affected Ubuntu 8.10. (CVE-2009-1886) + +Jeremy Allison discovered that the smbd daemon in Samba incorrectly handled +permissions to modify access control lists when dos filemode is enabled. A +remote attacker could exploit this to modify access control lists. This +only affected Ubuntu 8.10 and Ubuntu 9.04. (CVE-2009-1886) + +Solution: +The problem can be corrected by upgrading your system to the +following package versions: + +Ubuntu 6.06 LTS: + samba 3.0.22-1ubuntu3.9 + smbfs 3.0.22-1ubuntu3.9 + +Ubuntu 8.04 LTS: + samba 3.0.28a-1ubuntu4.9 + smbfs 3.0.28a-1ubuntu4.9 + +Ubuntu 8.10: + samba 2:3.2.3-1ubuntu3.6 + smbclient 2:3.2.3-1ubuntu3.6 + smbfs 2:3.2.3-1ubuntu3.6 + +Ubuntu 9.04: + samba 2:3.3.2-1ubuntu3.2 + smbfs 2:3.3.2-1ubuntu3.2 + +In general, a standard system upgrade is sufficient to effect the +necessary changes. + +https://secure1.securityspace.com/smysecure/catid.html?in=USN-839-1 + +Risk factor : High"; + + script_description(desc); + + script_summary("Ubuntu USN-839-1 (samba)"); + + script_category(ACT_GATHER_INFO); + + script_copyright("Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com"); + script_family("Ubuntu Local Security Checks"); + script_dependencies("gather-package-list.nasl"); + script_require_keys("ssh/login/packages"); + exit(0); +} + +# +# The script code starts here +# + +include("revisions-lib.inc"); +include("pkg-lib-deb.inc"); +vuln = 0; +if(isdpkgvuln(pkg:"samba-doc-pdf", ver:"3.0.22-1ubuntu3.9", rls:"UBUNTU6.06 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"samba-doc", ver:"3.0.22-1ubuntu3.9", rls:"UBUNTU6.06 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libpam-smbpass", ver:"3.0.22-1ubuntu3.9", rls:"UBUNTU6.06 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libsmbclient-dev", ver:"3.0.22-1ubuntu3.9", rls:"UBUNTU6.06 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libsmbclient", ver:"3.0.22-1ubuntu3.9", rls:"UBUNTU6.06 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"python2.4-samba", ver:"3.0.22-1ubuntu3.9", rls:"UBUNTU6.06 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"samba-common", ver:"3.0.22-1ubuntu3.9", rls:"UBUNTU6.06 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"samba-dbg", ver:"3.0.22-1ubuntu3.9", rls:"UBUNTU6.06 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"samba", ver:"3.0.22-1ubuntu3.9", rls:"UBUNTU6.06 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"smbclient", ver:"3.0.22-1ubuntu3.9", rls:"UBUNTU6.06 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"smbfs", ver:"3.0.22-1ubuntu3.9", rls:"UBUNTU6.06 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"swat", ver:"3.0.22-1ubuntu3.9", rls:"UBUNTU6.06 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"winbind", ver:"3.0.22-1ubuntu3.9", rls:"UBUNTU6.06 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"samba-doc-pdf", ver:"3.0.28a-1ubuntu4.9", rls:"UBUNTU8.04 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"samba-doc", ver:"3.0.28a-1ubuntu4.9", rls:"UBUNTU8.04 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libpam-smbpass", ver:"3.0.28a-1ubuntu4.9", rls:"UBUNTU8.04 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libsmbclient-dev", ver:"3.0.28a-1ubuntu4.9", rls:"UBUNTU8.04 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libsmbclient", ver:"3.0.28a-1ubuntu4.9", rls:"UBUNTU8.04 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"samba-common", ver:"3.0.28a-1ubuntu4.9", rls:"UBUNTU8.04 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"samba-dbg", ver:"3.0.28a-1ubuntu4.9", rls:"UBUNTU8.04 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"samba", ver:"3.0.28a-1ubuntu4.9", rls:"UBUNTU8.04 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"smbclient", ver:"3.0.28a-1ubuntu4.9", rls:"UBUNTU8.04 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"smbfs", ver:"3.0.28a-1ubuntu4.9", rls:"UBUNTU8.04 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"swat", ver:"3.0.28a-1ubuntu4.9", rls:"UBUNTU8.04 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"winbind", ver:"3.0.28a-1ubuntu4.9", rls:"UBUNTU8.04 LTS")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"samba-doc-pdf", ver:"3.2.3-1ubuntu3.6", rls:"UBUNTU8.10")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"samba-doc", ver:"3.2.3-1ubuntu3.6", rls:"UBUNTU8.10")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libpam-smbpass", ver:"3.2.3-1ubuntu3.6", rls:"UBUNTU8.10")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libsmbclient-dev", ver:"3.2.3-1ubuntu3.6", rls:"UBUNTU8.10")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libsmbclient", ver:"3.2.3-1ubuntu3.6", rls:"UBUNTU8.10")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libwbclient0", ver:"3.2.3-1ubuntu3.6", rls:"UBUNTU8.10")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"samba-common", ver:"3.2.3-1ubuntu3.6", rls:"UBUNTU8.10")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"samba-dbg", ver:"3.2.3-1ubuntu3.6", rls:"UBUNTU8.10")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"samba-tools", ver:"3.2.3-1ubuntu3.6", rls:"UBUNTU8.10")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"samba", ver:"3.2.3-1ubuntu3.6", rls:"UBUNTU8.10")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"smbclient", ver:"3.2.3-1ubuntu3.6", rls:"UBUNTU8.10")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"smbfs", ver:"3.2.3-1ubuntu3.6", rls:"UBUNTU8.10")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"swat", ver:"3.2.3-1ubuntu3.6", rls:"UBUNTU8.10")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"winbind", ver:"3.2.3-1ubuntu3.6", rls:"UBUNTU8.10")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"samba-doc-pdf", ver:"3.3.2-1ubuntu3.2", rls:"UBUNTU9.04")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"samba-doc", ver:"3.3.2-1ubuntu3.2", rls:"UBUNTU9.04")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libpam-smbpass", ver:"3.3.2-1ubuntu3.2", rls:"UBUNTU9.04")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libsmbclient-dev", ver:"3.3.2-1ubuntu3.2", rls:"UBUNTU9.04")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libsmbclient", ver:"3.3.2-1ubuntu3.2", rls:"UBUNTU9.04")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"libwbclient0", ver:"3.3.2-1ubuntu3.2", rls:"UBUNTU9.04")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"samba-common", ver:"3.3.2-1ubuntu3.2", rls:"UBUNTU9.04")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"samba-dbg", ver:"3.3.2-1ubuntu3.2", rls:"UBUNTU9.04")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"samba", ver:"3.3.2-1ubuntu3.2", rls:"UBUNTU9.04")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"smbclient", ver:"3.3.2-1ubuntu3.2", rls:"UBUNTU9.04")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"smbfs", ver:"3.3.2-1ubuntu3.2", rls:"UBUNTU9.04")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"winbind", ver:"3.3.2-1ubuntu3.2", rls:"UBUNTU9.04")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"samba-tools", ver:"3.3.2-1ubuntu3.2", rls:"UBUNTU9.04")) { + vuln = 1; +} +if(isdpkgvuln(pkg:"swat", ver:"3.3.2-1ubuntu3.2", rls:"UBUNTU9.04")) { + vuln = 1; +} + +if(vuln) { + security_hole(0); +} From scm-commit at wald.intevation.org Tue Oct 6 07:21:20 2009 From: scm-commit at wald.intevation.org (scm-commit@wald.intevation.org) Date: Tue, 6 Oct 2009 07:21:20 +0200 (CEST) Subject: [Openvas-commits] r5379 - in trunk/openvas-plugins: . scripts Message-ID: <20091006052120.59458852B84E@pyrosoma.intevation.org> Author: chandra Date: 2009-10-06 07:21:15 +0200 (Tue, 06 Oct 2009) New Revision: 5379 Added: trunk/openvas-plugins/scripts/gb_adobe_acrobat_pdf_dos_vuln.nasl trunk/openvas-plugins/scripts/gb_cpcreator_detect.nasl trunk/openvas-plugins/scripts/gb_cpcreator_sql_inj_vuln.nasl trunk/openvas-plugins/scripts/gb_google_chrome_sec_bypass_vuln_oct09.nasl trunk/openvas-plugins/scripts/gb_ibm_db2_mult_vuln_lin_oct09.nasl trunk/openvas-plugins/scripts/gb_ibm_db2_mult_vuln_win_oct09.nasl trunk/openvas-plugins/scripts/gb_ibm_db2_unspesified_vuln_lin.nasl trunk/openvas-plugins/scripts/gb_ibm_db2_unspesified_vuln_win.nasl trunk/openvas-plugins/scripts/gb_ms_ie_ssl_certi_sec_bypass_vuln_oct09.nasl Modified: trunk/openvas-plugins/ChangeLog trunk/openvas-plugins/cve_current.txt Log: Added new plugins Modified: trunk/openvas-plugins/ChangeLog =================================================================== --- trunk/openvas-plugins/ChangeLog 2009-10-06 00:49:40 UTC (rev 5378) +++ trunk/openvas-plugins/ChangeLog 2009-10-06 05:21:15 UTC (rev 5379) @@ -1,3 +1,16 @@ +2009-10-06 Chandrashekhar B + + * scripts/gb_ibm_db2_unspesified_vuln_win.nasl, + scripts/gb_google_chrome_sec_bypass_vuln_oct09.nasl, + scripts/gb_cpcreator_detect.nasl, + scripts/gb_cpcreator_sql_inj_vuln.nasl, + scripts/gb_ibm_db2_unspesified_vuln_lin.nasl, + scripts/gb_ms_ie_ssl_certi_sec_bypass_vuln_oct09.nasl, + scripts/gb_ibm_db2_mult_vuln_win_oct09.nasl, + scripts/gb_ibm_db2_mult_vuln_lin_oct09.nasl, + scripts/gb_adobe_acrobat_pdf_dos_vuln.nasl: + Added new plugins. + 2009-10-05 Thomas Reinke *scripts/deb_1896_1.nasl, Modified: trunk/openvas-plugins/cve_current.txt =================================================================== --- trunk/openvas-plugins/cve_current.txt 2009-10-06 00:49:40 UTC (rev 5378) +++ trunk/openvas-plugins/cve_current.txt 2009-10-06 05:21:15 UTC (rev 5379) @@ -72,22 +72,22 @@ CVE-2009-3293 SecPod svn R CVE-2009-3328 SecPod CVE-2009-3327 SecPod -CVE-2009-3330 SecPod -CVE-2009-3369 SecPod -CVE-2009-2817 SecPod svn L +CVE-2009-3330 SecPod svn R +CVE-2009-3369 SecPod +CVE-2009-2817 SecPod svn L CVE-2009-3366 SecPod svn R -CVE-2009-3367 Secpod svn R -CVE-2009-3364 SecPod svn L -CVE-2009-3340 SecPod svn L -CVE-2009-3431 SecPod -CVE-2009-3444 SecPod -CVE-2009-3455 SecPod -CVE-2009-3454 SecPod -CVE-2009-3456 SecPod +CVE-2009-3367 Secpod svn R +CVE-2009-3364 SecPod svn L +CVE-2009-3340 SecPod svn L +CVE-2009-3431 SecPod svn L +CVE-2009-3444 SecPod +CVE-2009-3455 SecPod +CVE-2009-3454 SecPod svn L +CVE-2009-3456 SecPod svn L CVE-2009-3471 SecPod CVE-2009-3473 SecPod -CVE-2009-3472 SecPod -CVE-2009-3478 SecPod +CVE-2009-3472 SecPod +CVE-2009-3478 SecPod 36407 Greenbone svn R CVE-2006-5789 Greenbone svn R CVE-2009-2629 Greenbone svn R Added: trunk/openvas-plugins/scripts/gb_adobe_acrobat_pdf_dos_vuln.nasl =================================================================== --- trunk/openvas-plugins/scripts/gb_adobe_acrobat_pdf_dos_vuln.nasl 2009-10-06 00:49:40 UTC (rev 5378) +++ trunk/openvas-plugins/scripts/gb_adobe_acrobat_pdf_dos_vuln.nasl 2009-10-06 05:21:15 UTC (rev 5379) @@ -0,0 +1,84 @@ +############################################################################### +# OpenVAS Vulnerability Test +# $Id: gb_adobe_acrobat_pdf_dos_vuln.nasl 5056 2009-10-05 18:14:26Z oct $ +# +# Adobe Acrobat PDF File Denial Of Service Vulnerability +# +# Authors: +# Sharath S +# +# Copyright: +# Copyright (c) 2009 Intevation GmbH, http://www.intevation.net +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 +# (or any later version), as published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +############################################################################### + +if(description) +{ + script_id(801104); + script_version("$Revision: 1.0 $"); + script_cve_id("CVE-2009-3431"); + script_bugtraq_id(35148); + script_name("Adobe Acrobat PDF File Denial Of Service Vulnerability"); + desc = " + Overview: This host has Adobe Acrobat or Adobe Acrobat Reader installed and + is prone to Denial of Service vulnerability. + + Vulnerability Insight: + A Stack consumption error exists when handling a PDF file containing a large + number of '[' characters to the alert method. + + Impact: + Successful attacks results in Denial of Service. + + Impact Level: Application + + Affected Software/OS: + Adobe Acrobat version 9.1.1 and prior on Windows. + + Fix: No solution or patch is available as on 05th October, 2009. Information + regarding this issue will be updated once the solution details are available. + For updates refer, http://www.adobe.com/products/acrobat/?promoid=BPDDU + + References: + http://www.security-database.com/detail.php?alert=CVE-2009-3431 + + CVSS Score: + CVSS Base Score : 5.0 (AV:N/AC:L/Au:NR/C:N/I:N/A:P) + CVSS Temporal Score : 4.5 + Risk factor: Medium"; + + script_description(desc); + script_summary("Check for the version of Adobe Acrobat"); + script_category(ACT_GATHER_INFO); + script_copyright("Copyright (C) 2009 Intevation GmbH"); + script_family("Denial of Service"); + script_dependencies("secpod_adobe_prdts_detect_win.nasl"); + script_require_keys("Adobe/Acrobat/Win/Ver"); + exit(0); +} + + +include("version_func.inc"); + +# Check for Adobe Acrobat version <= 9.1.1 +acrobatVer = get_kb_item("Adobe/Acrobat/Win/Ver"); +if(acrobatVer) +{ + if(version_is_less_equal(version:acrobatVer, test_version:"9.1.1")) + { + security_warning(0); + exit(0); + } +} Property changes on: trunk/openvas-plugins/scripts/gb_adobe_acrobat_pdf_dos_vuln.nasl ___________________________________________________________________ Name: svn:executable + * Added: trunk/openvas-plugins/scripts/gb_cpcreator_detect.nasl =================================================================== --- trunk/openvas-plugins/scripts/gb_cpcreator_detect.nasl 2009-10-06 00:49:40 UTC (rev 5378) +++ trunk/openvas-plugins/scripts/gb_cpcreator_detect.nasl 2009-10-06 05:21:15 UTC (rev 5379) @@ -0,0 +1,68 @@ +############################################################################### +# OpenVAS Vulnerability Test +# $Id: gb_cpcreator_detect.nasl 4962 2009-10-05 16:25:36Z oct $ +# +# cP Creator Version Detection +# +# Authors: +# Antu Sanadi +# +# Copyright: +# Copyright (c) 2009 Intevation GmbH, http://www.intevation.net +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 +# (or any later version), as published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +############################################################################### + +if(description) +{ + script_id(801005); + script_version("$Revision: 1.0$"); + script_name("cP Creator Version Detection"); + desc = " + Overview: This script finds the installed cP Creator version and saves + the result in KB. + + Risk factor: Informational"; + + script_description(desc); + script_summary("Set the version of cP Creator in KB"); + script_category(ACT_GATHER_INFO); + script_copyright("Copyright (C) 2009 Intevation GmbH"); + script_family("Service detection"); + script_dependencies("find_service.nes"); + script_require_ports("Services/www", 80); + exit(0); +} + + +include("http_func.inc"); + +cpcreatPort = get_http_port(default:80); +if(!cpcreatPort){ + exit(0); +} + +foreach path (make_list("/", "/cPcreator", "/cp", cgi_dirs())) +{ + sndReq = http_get(item:string(path, "/index.php"), port:cpcreatPort); + rcvRes = http_send_recv(port:cpcreatPort, data:sndReq); + if("cP Creator" >< rcvRes) + { + cpcreatVer = eregmatch(pattern:"[V|v]([0-9.]+)", string:rcvRes); + if(cpcreatVer[1] != NULL){ + set_kb_item(name:"www/" + cpcreatPort + "/cPCreator", + value:cpcreatVer[1] + " under " + path); + } + } +} Added: trunk/openvas-plugins/scripts/gb_cpcreator_sql_inj_vuln.nasl =================================================================== --- trunk/openvas-plugins/scripts/gb_cpcreator_sql_inj_vuln.nasl 2009-10-06 00:49:40 UTC (rev 5378) +++ trunk/openvas-plugins/scripts/gb_cpcreator_sql_inj_vuln.nasl 2009-10-06 05:21:15 UTC (rev 5379) @@ -0,0 +1,95 @@ +############################################################################### +# OpenVAS Vulnerability Test +# $Id: gb_cpcreator_sql_inj_vuln.nasl 4962 2009-10-05 15:11:27Z oct $ +# +# cP Creator 'tickets' Cookie SQL Injection Vulnerability +# +# Authors: +# Antu Sanadi +# +# Copyright: +# Copyright (c) 2009 Intevation GmbH, http://www.intevation.net +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 +# (or any later version), as published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +############################################################################### + +if(description) +{ + script_id(801006); + script_version("$Revision: 1.0 $"); + script_cve_id("CVE-2009-3330"); + script_name("cP Creator 'tickets' Cookie SQL Injection Vulnerability"); + desc =" + Overview: The host is running cP Creator and is prone to SQL Injection + Vulnerability + + Vulnerability Insight: + Input passed to the 'tickets' cookie in index.php (if 'page' is set to + 'support' and 'task' is set to 'ticket') is not properly sanitised before + being used in SQL queries. + + Impact: + Successful exploitation could allow remote attackers to conduct SQL injection + attacks. + + Impact Level: Application. + + Affected Software/OS: + cP Creator Version 2.7.1 and prior. + + Fix: + No solution or patch is available as on 05th October, 2009. Information + regarding this issue will be updated once the solution details are available. + For updates refer, http://www.cpcreator.com/download.php + + References: + http://secunia.com/advisories/36815 + http://www.milw0rm.com/exploits/9726 + + CVSS Score: + CVSS Base Score : 6.8 (AV:N/AC:M/Au:NR/C:P/I:P/A:P) + CVSS Temporal Score : 6.1 + Risk factor: High"; + + script_description(desc); + script_summary("Check for the version cP Creator"); + script_category(ACT_GATHER_INFO); + script_copyright("Copyright (C) Intevation GmbH"); + script_dependencies("gb_cpcreator_detect.nasl"); + script_family("Web application abuses"); + script_require_ports("Services/www", 80); + exit(0); +} + + +include("http_func.inc"); +include("version_func.inc"); + +cpcreatPort = get_http_port(default:80); +if(!cpcreatPort){ + exit(0); +} + +cpcreatVer = get_kb_item("www/" + cpcreatPort + "/cPCreator"); +if(!cpcreatVer){ + exit(0); +} + +cpcreatVer = eregmatch(pattern:"^(.+) under (/.*)$", string:cpcreatVer); +if(cpcreatVer[1] != NULL) +{ + if(version_is_less_equal(version:cpcreatVer[1], test_version:"2.7.1")){ + security_hole(cpcreatPort); + } +} Added: trunk/openvas-plugins/scripts/gb_google_chrome_sec_bypass_vuln_oct09.nasl =================================================================== --- trunk/openvas-plugins/scripts/gb_google_chrome_sec_bypass_vuln_oct09.nasl 2009-10-06 00:49:40 UTC (rev 5378) +++ trunk/openvas-plugins/scripts/gb_google_chrome_sec_bypass_vuln_oct09.nasl 2009-10-06 05:21:15 UTC (rev 5379) @@ -0,0 +1,86 @@ +############################################################################### +# OpenVAS Vulnerability Test +# $Id: gb_google_chrome_sec_bypass_vuln_oct09.nasl 5092 2009-10-05 21:33:26Z oct $ +# +# Google Chrome CA SSL Certificate Security Bypass Vulnerability - Oct09 +# +# Authors: +# Sharath S +# +# Copyright: +# Copyright (c) 2009 Intevation GmbH, http://www.intevation.net +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 +# (or any later version), as published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +############################################################################### + +if(description) +{ + script_id(801108); + script_version("$Revision: 1.0 $"); + script_cve_id("CVE-2009-3456"); + script_bugtraq_id(36479); + script_name("Google Chrome CA SSL Certificate Security Bypass Vulnerability - Oct09"); + desc = " + Overview: This host is installed with Google Chrome Web Browser and is prone + to Security Bypass vulnerability. + + Vulnerability Insight: + Google Chrome fails to properly validate '\0' character in the domain name + in a signed CA certificate, allowing attackers to substitute malicious SSL + certificates for trusted ones. + + Impact: + Successfully exploitation will let the attackers to perform man-in-the-middle + attacks or impersonate trusted servers, which will aid in further attack. + + Impact Level: Application + + Affected Software/OS: + Google Chrome version 3.0.193.21 and prior on Windows. + + Fix: + No solution or patch is available as on 05th October, 2009. Information + regarding this issue will be updated once the solution details are available. + For updates refer, http://www.google.com/chrome + + References: + http://en.securitylab.ru/nvd/386075.php + + CVSS Score: + CVSS Base Score : 7.5 (AV:N/AC:L/Au:NR/C:P/I:P/A:P) + CVSS Temporal Score : 6.4 + Risk factor: High"; + + script_description(desc); + script_summary("Check for the version of Google Chrome"); + script_category(ACT_GATHER_INFO); + script_copyright("Copyright (C) 2009 Intevation GmbH"); + script_family("General"); + script_dependencies("gb_google_chrome_detect_win.nasl"); + script_require_keys("GoogleChrome/Win/Ver"); + exit(0); +} + + +include("version_func.inc"); + +chromeVer = get_kb_item("GoogleChrome/Win/Ver"); +if(isnull(chromeVer)){ + exit(0); +} + +# Check for Google Chrome Version <= 3.0.195.21 +if(version_is_less_equal(version:chromeVer, test_version:"3.0.195.21")){ + security_hole(0); +} Property changes on: trunk/openvas-plugins/scripts/gb_google_chrome_sec_bypass_vuln_oct09.nasl ___________________________________________________________________ Name: svn:executable + * Added: trunk/openvas-plugins/scripts/gb_ibm_db2_mult_vuln_lin_oct09.nasl =================================================================== --- trunk/openvas-plugins/scripts/gb_ibm_db2_mult_vuln_lin_oct09.nasl 2009-10-06 00:49:40 UTC (rev 5378) +++ trunk/openvas-plugins/scripts/gb_ibm_db2_mult_vuln_lin_oct09.nasl 2009-10-06 05:21:15 UTC (rev 5379) @@ -0,0 +1,91 @@ +############################################################################### +# OpenVAS Vulnerability Test +# $Id: gb_ibm_db2_mult_vuln_lin_oct09.nasl 5093 2009-10-05 16:03:51Z oct $ +# +# IBM DB2 Multiple Vulnerabilities - Oct09 (Linux) +# +# Authors: +# Antu Sanadi +# +# Copyright: +# Copyright (c) 2009 Intevation GmbH, http://www.intevation.net +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 +# (or any later version), as published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +############################################################################### + +if(description) +{ + script_id(801001); + script_version("$Revision: 1.0 $"); + script_cve_id("CVE-2009-3471", "CVE-2009-3472"); + script_bugtraq_id(36540); + script_name("IBM DB2 Multiple Vulnerabilities - Oct09 (Linux)"); + + desc = " + Overview: The host is installed with IBM DB2 and is prone to multiple + vulnerabilities. + + Vulnerability Insight: + - An unspecified error exists related to a table function when the definer + loses required privileges. + - An unspecified error can be exploited to insert, update, or delete rows in + a table without having required privileges. + + Impact: Unknow impact. + + Impact Level: System/Application + + Affected Software/OS: + IBM DB2 version 8 prior to Fixpak 18 + IBM DB2 version 9.1 prior to Fixpak 8 + IBM DB2 version 9.5 prior to Fixpak 4 + + Fix:Update DB2 8 Fixpak 18 or 9.1 Fixpak 8 or 9.5 Fixpak 4 or later. + http://www-01.ibm.com/support/docview.wss?rs=71&uid=swg27007053 + + References: + http://secunia.com/advisories/36890 + http://www-01.ibm.com/support/docview.wss?uid=swg21403619 + http://www-01.ibm.com/support/docview.wss?uid=swg21386689 + + CVSS Score: + CVSS Base Score : 7.5 (AV:N/AC:L/Au:NR/C:P/I:P/A:P) + CVSS Temporal Score : 5.5 + Risk factor: High"; + + script_description(desc); + script_summary("Check for the version of IBM DB2"); + script_category(ACT_GATHER_INFO); + script_copyright("Copyright (C) 2009 Intevation GmbH"); + script_family("General"); + script_dependencies("secpod_ibm_db2_detect_linux_900217.nasl"); + script_require_keys("Linux/IBM-db2/Ver"); + exit(0); +} + + +include("version_func.inc"); + +ibmVer = get_kb_item("Linux/IBM-db2/Ver"); +if(!ibmVer){ + exit(0); +} + +# Check for IBM DB2 version 8 before FP18, 9.1 before FP8, 9.5 before FP4 +# 9.1 FP8 =>9.1.0.8, 9.5 FP4 =>9.5.0.4, 8 FP18 =>8.1.18 +if(version_in_range(version:ibmVer, test_version:"8.0", test_version2:"8.1.17")|| + version_in_range(version:ibmVer, test_version:"9.1", test_version2:"9.1.0.7")|| + version_in_range(version:ibmVer, test_version:"9.5", test_version2:"9.5.0.3")){ + security_hole(0); +} Added: trunk/openvas-plugins/scripts/gb_ibm_db2_mult_vuln_win_oct09.nasl =================================================================== --- trunk/openvas-plugins/scripts/gb_ibm_db2_mult_vuln_win_oct09.nasl 2009-10-06 00:49:40 UTC (rev 5378) +++ trunk/openvas-plugins/scripts/gb_ibm_db2_mult_vuln_win_oct09.nasl 2009-10-06 05:21:15 UTC (rev 5379) @@ -0,0 +1,91 @@ +############################################################################### +# OpenVAS Vulnerability Test +# $Id: gb_ibm_db2_mult_vuln_win_oct09.nasl 5093 2009-10-05 15:11:27Z oct $ +# +# IBM DB2 Multiple Vulnerabilities - Oct09 (Win) +# +# Authors: +# Antu Sanadi +# +# Copyright: +# Copyright (c) 2009 Intevation GmbH, http://www.intevation.net +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 +# (or any later version), as published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +############################################################################### + +if(description) +{ + script_id(801009); + script_version("$Revision: 1.0 $"); + script_cve_id("CVE-2009-3471", "CVE-2009-3472"); + script_bugtraq_id(36540); + script_name("IBM DB2 Multiple Vulnerabilities - Oct09 (Win)"); + + desc = " + Overview: The host is installed with IBM DB2 and is prone to multiple + vulnerabilities. + + Vulnerability Insight: + - An unspecified error exists related to a table function when the definer + loses required privileges. + - An unspecified error can be exploited to insert, update, or delete rows in + a table without having required privileges. + + Impact: Unknow impact. + + Impact Level: System/Application + + Affected Software/OS: + IBM DB2 version 8 prior to Fixpak 18 + IBM DB2 version 9.1 prior to Fixpak 8 + IBM DB2 version 9.5 prior to Fixpak 4 + + Fix:Update DB2 8 Fixpak 18 or 9.1 Fixpak 8 or 9.5 Fixpak 4 or later. + http://www-01.ibm.com/support/docview.wss?rs=71&uid=swg27007053 + + References: + http://secunia.com/advisories/36890 + http://www-01.ibm.com/support/docview.wss?uid=swg21403619 + http://www-01.ibm.com/support/docview.wss?uid=swg21386689 + + CVSS Score: + CVSS Base Score : 7.5 (AV:N/AC:L/Au:NR/C:P/I:P/A:P) + CVSS Temporal Score : 5.5 + Risk factor: High"; + + script_description(desc); + script_summary("Check for the version of IBM DB2"); + script_category(ACT_GATHER_INFO); + script_copyright("Copyright (C) 2009 Intevation GmbH"); + script_family("General"); + script_dependencies("secpod_ibm_db2_detect_win_900218.nasl"); + script_require_keys("Win/IBM-db2/Ver"); + exit(0); +} + + +include("version_func.inc"); + +ibmVer = get_kb_item("Win/IBM-db2/Ver"); +if(!ibmVer){ + exit(0); +} + +# Check for IBM DB2 version 8 before FP18, 9.1 before FP8, 9.5 before FP4 +# 9.1 FP8 => 9.1.800.1023, 9.5 FP4 => 9.5.400.576, 8 FP18 =>8.1.18 +if(version_in_range(version:ibmVer, test_version:"8.0", test_version2:"8.1.17")|| + version_in_range(version:ibmVer, test_version:"9.1", test_version2:"9.1.800.1022")|| + version_in_range(version:ibmVer, test_version:"9.5", test_version2:"9.5.400.575")){ + security_hole(0); +} Added: trunk/openvas-plugins/scripts/gb_ibm_db2_unspesified_vuln_lin.nasl =================================================================== --- trunk/openvas-plugins/scripts/gb_ibm_db2_unspesified_vuln_lin.nasl 2009-10-06 00:49:40 UTC (rev 5378) +++ trunk/openvas-plugins/scripts/gb_ibm_db2_unspesified_vuln_lin.nasl 2009-10-06 05:21:15 UTC (rev 5379) @@ -0,0 +1,85 @@ +############################################################################### +# OpenVAS Vulnerability Test +# $Id: gb_ibm_db2_unspesified_vuln_lin.nasl 5093 2009-10-05 18:11:27Z oct $ +# +# IBM DB2 Unspecified Vulnerability (Linux) +# +# Authors: +# Antu Sanadi +# +# Copyright: +# Copyright (c) 2009 Intevation GmbH, http://www.intevation.net +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 +# (or any later version), as published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +############################################################################### + +if(description) +{ + script_id(801003); + script_version("$Revision: 1.0 $"); + script_cve_id("CVE-2009-3473"); + script_name("IBM DB2 Unspecified Vulnerability (Linux)"); + desc = " + Overview: The host is installed with IBM DB2 and is prone to unspecified + vulnerability. + + Vulnerability Insight: + An unspecified error in the handling of 'SET SESSION AUTHORIZATION' + statements that can be exploited to execute the statement without having + the required privileges. + + Impact: Unknow impact. + + Impact Level: System/Application. + + Affected Software/OS: + IBM DB2 version 9.1 prior to Fixpak 8 + + Fix:Update DB2 9.1 Fixpak 8 or later. + http://www-01.ibm.com/support/docview.wss?rs=71&uid=swg27007053 + + References: + http://secunia.com/advisories/36890 + http://www-01.ibm.com/support/docview.wss?uid=swg21403619 + http://www-01.ibm.com/support/docview.wss?uid=swg21386689 + + CVSS Score: + CVSS Base Score : 10.0 (AV:N/AC:L/Au:NR/C:C/I:C/A:C) + CVSS Temporal Score : 7.4 + Risk factor: High"; + + script_description(desc); + script_summary("Check for the version of IBM DB2"); + script_category(ACT_GATHER_INFO); + script_copyright("Copyright (C) 2009 Intevation GmbH"); + script_family("General"); + script_dependencies("secpod_ibm_db2_detect_linux_900217.nasl"); + script_require_keys("Linux/IBM-db2/Ver"); + exit(0); +} + + +include("version_func.inc"); + +ibmVer = get_kb_item("Linux/IBM-db2/Ver"); +if(!ibmVer){ + exit(0); +} + +# Check for IBM DB2 Products Version 9.1 before FP8 +# IBM DB2 9.1 FP8 =>9.1.0.8 +if(version_in_range(version:ibmVer, test_version:"9.1", + test_version2:"9.1.0.7")){ + security_hole(0); +} Property changes on: trunk/openvas-plugins/scripts/gb_ibm_db2_unspesified_vuln_lin.nasl ___________________________________________________________________ Name: svn:executable + * Added: trunk/openvas-plugins/scripts/gb_ibm_db2_unspesified_vuln_win.nasl =================================================================== --- trunk/openvas-plugins/scripts/gb_ibm_db2_unspesified_vuln_win.nasl 2009-10-06 00:49:40 UTC (rev 5378) +++ trunk/openvas-plugins/scripts/gb_ibm_db2_unspesified_vuln_win.nasl 2009-10-06 05:21:15 UTC (rev 5379) @@ -0,0 +1,85 @@ +############################################################################### +# OpenVAS Vulnerability Test +# $Id: gb_ibm_db2_unspesified_vuln_win.nasl 5093 2009-10-05 17:11:27Z oct $ +# +# IBM DB2 Unspecified Vulnerability (Win) +# +# Authors: +# Antu Sanadi +# +# Copyright: +# Copyright (c) 2009 Intevation GmbH, http://www.intevation.net +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 +# (or any later version), as published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +############################################################################### + +if(description) +{ + script_id(801002); + script_version("$Revision: 1.0 $"); + script_cve_id("CVE-2009-3473"); + script_name("IBM DB2 Unspecified Vulnerability (Win)"); + desc = " + Overview: The host is installed with IBM DB2 and is prone to unspecified + vulnerability. + + Vulnerability Insight: + An unspecified error in the handling of 'SET SESSION AUTHORIZATION' + statements that can be exploited to execute the statement without having + the required privileges. + + Impact: Unknown impact. + + Impact Level: System/Application. + + Affected Software/OS: + IBM DB2 version 9.1 prior to Fixpak 8 + + Fix:Update DB2 9.1 Fixpak 8 or later. + http://www-01.ibm.com/support/docview.wss?rs=71&uid=swg27007053 + + References: + http://secunia.com/advisories/36890 + http://www-01.ibm.com/support/docview.wss?uid=swg21403619 + http://www-01.ibm.com/support/docview.wss?uid=swg21386689 + + CVSS Score: + CVSS Base Score : 10.0 (AV:N/AC:L/Au:NR/C:C/I:C/A:C) + CVSS Temporal Score : 7.4 + Risk factor: High"; + + script_description(desc); + script_summary("Check for the version of IBM DB2"); + script_category(ACT_GATHER_INFO); + script_copyright("Copyright (C) 2009 Intevation GmbH"); + script_family("General"); + script_dependencies("secpod_ibm_db2_detect_win_900218.nasl"); + script_require_keys("Win/IBM-db2/Ver"); + exit(0); +} + + +include("version_func.inc"); + +ibmVer = get_kb_item("Win/IBM-db2/Ver"); +if(!ibmVer){ + exit(0); +} + +# Check for IBM DB2 Products Version 9.1 before FP8 +# IBM DB2 9.1 FP8 => 9.1.800.1023 +if(version_in_range(version:ibmVer, test_version:"9.1", + test_version2:"9.1.800.1022")){ + security_hole(0); +} Property changes on: trunk/openvas-plugins/scripts/gb_ibm_db2_unspesified_vuln_win.nasl ___________________________________________________________________ Name: svn:executable + * Added: trunk/openvas-plugins/scripts/gb_ms_ie_ssl_certi_sec_bypass_vuln_oct09.nasl =================================================================== --- trunk/openvas-plugins/scripts/gb_ms_ie_ssl_certi_sec_bypass_vuln_oct09.nasl 2009-10-06 00:49:40 UTC (rev 5378) +++ trunk/openvas-plugins/scripts/gb_ms_ie_ssl_certi_sec_bypass_vuln_oct09.nasl 2009-10-06 05:21:15 UTC (rev 5379) @@ -0,0 +1,87 @@ +############################################################################### +# OpenVAS Vulnerability Test +# $Id: gb_ms_ie_ssl_certi_sec_bypass_vuln_oct09.nasl 5091 2009-10-05 21:51:26Z oct $ +# +# Microsoft IE CA SSL Certificate Security Bypass Vulnerability - Oct09 +# +# Authors: +# Sharath S +# +# Copyright: +# Copyright (c) 2009 Intevation GmbH, http://www.intevation.net +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 +# (or any later version), as published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +############################################################################### + +if(description) +{ + script_id(801109); + script_version("$Revision: 1.0 $"); + script_cve_id("CVE-2009-3454"); + script_bugtraq_id(36475); + script_name("Microsoft IE CA SSL Certificate Security Bypass Vulnerability - Oct09"); + desc = " + Overview: This host is installed with Internet Explorer and is prone to + Security Bypass vulnerability. + + Vulnerability Insight: + Microsoft Internet Explorer fails to properly validate '\0' character in the + domain name in a signed CA certificate, allowing attackers to substitute + malicious SSL certificates for trusted ones. + + Impact: + Successful exploitation will let the attackers to perform man-in-the-middle + attacks or impersonate trusted servers, which will aid in further attack. + + Impact Level: Application + + Affected Software/OS: + Microsoft IE version 6.x/7.x/8.x + + Fix: No solution or patch is available as on 05th October, 2009. Information + regarding this issue will be updated once the solution details are available. + For updates refer, http://www.google.com/chrome + + References: + http://www.wired.com/threatlevel/2009/07/kaminsky/ + http://www.networkworld.com/news/2009/073009-more-holes-found-in-webs.html + http://www.networkworld.com/news/2009/091709-microsoft-ie-security-hole.html + + CVSS Score: + CVSS Base Score : 6.8 (AV:N/AC:M/Au:NR/C:P/I:P/A:P) + CVSS Temporal Score : 5.8 + Risk factor: High"; + + script_description(desc); + script_summary("Check for the version of Google Chrome"); + script_category(ACT_GATHER_INFO); + script_copyright("Copyright (C) 2009 Intevation GmbH"); + script_family("General"); + script_dependencies("gb_ms_ie_detect.nasl"); + script_require_keys("MS/IE/Version"); + exit(0); +} + + +include("version_func.inc"); + +ieVer = get_kb_item("MS/IE/Version"); +if(isnull(ieVer)){ + exit(0); +} + +# Check for IE version 6.x or 7.x or 8.x +if(ieVer =~ "^(6|7|8)\..*"){ + security_hole(0); +} Property changes on: trunk/openvas-plugins/scripts/gb_ms_ie_ssl_certi_sec_bypass_vuln_oct09.nasl ___________________________________________________________________ Name: svn:executable + * From scm-commit at wald.intevation.org Tue Oct 6 07:45:14 2009 From: scm-commit at wald.intevation.org (scm-commit@wald.intevation.org) Date: Tue, 6 Oct 2009 07:45:14 +0200 (CEST) Subject: [Openvas-commits] r5380 - trunk/doc/website Message-ID: <20091006054514.C60DE852B84E@pyrosoma.intevation.org> Author: timb Date: 2009-10-06 07:45:14 +0200 (Tue, 06 Oct 2009) New Revision: 5380 Modified: trunk/doc/website/Makefile Log: Force protocol version 29 Modified: trunk/doc/website/Makefile =================================================================== --- trunk/doc/website/Makefile 2009-10-06 05:21:15 UTC (rev 5379) +++ trunk/doc/website/Makefile 2009-10-06 05:45:14 UTC (rev 5380) @@ -54,7 +54,7 @@ online: all echo "Going to put current contents online for openvas.wald.intevation.org ..." - rsync -urvP --exclude='.svn' $(ADD_INST_TYPES) $(TARGETS) $(ADD_INST_DIRS) \ + rsync --proto=29 -urvP --exclude='.svn' $(ADD_INST_TYPES) $(TARGETS) $(ADD_INST_DIRS) \ $(USER)@wald.intevation.org:/openvas/htdocs/ install: all From scm-commit at wald.intevation.org Tue Oct 6 07:48:03 2009 From: scm-commit at wald.intevation.org (scm-commit@wald.intevation.org) Date: Tue, 6 Oct 2009 07:48:03 +0200 (CEST) Subject: [Openvas-commits] r5381 - trunk/doc/website Message-ID: <20091006054803.87B4F852B84F@pyrosoma.intevation.org> Author: timb Date: 2009-10-06 07:48:03 +0200 (Tue, 06 Oct 2009) New Revision: 5381 Modified: trunk/doc/website/Makefile Log: Fix typo Modified: trunk/doc/website/Makefile =================================================================== --- trunk/doc/website/Makefile 2009-10-06 05:45:14 UTC (rev 5380) +++ trunk/doc/website/Makefile 2009-10-06 05:48:03 UTC (rev 5381) @@ -54,7 +54,7 @@ online: all echo "Going to put current contents online for openvas.wald.intevation.org ..." - rsync --proto=29 -urvP --exclude='.svn' $(ADD_INST_TYPES) $(TARGETS) $(ADD_INST_DIRS) \ + rsync --protocol=29 -urvP --exclude='.svn' $(ADD_INST_TYPES) $(TARGETS) $(ADD_INST_DIRS) \ $(USER)@wald.intevation.org:/openvas/htdocs/ install: all From scm-commit at wald.intevation.org Tue Oct 6 07:48:42 2009 From: scm-commit at wald.intevation.org (scm-commit@wald.intevation.org) Date: Tue, 6 Oct 2009 07:48:42 +0200 (CEST) Subject: [Openvas-commits] r5382 - trunk/doc/website Message-ID: <20091006054842.A1E93852B84F@pyrosoma.intevation.org> Author: timb Date: 2009-10-06 07:48:42 +0200 (Tue, 06 Oct 2009) New Revision: 5382 Modified: trunk/doc/website/constitution.htm4 trunk/doc/website/openvas-contest-2008.htm4 trunk/doc/website/openvas-contest.htm4 trunk/doc/website/openvas.css trunk/doc/website/template_header.m4 Log: Fix up contact email address Modified: trunk/doc/website/constitution.htm4 =================================================================== --- trunk/doc/website/constitution.htm4 2009-10-06 05:48:03 UTC (rev 5381) +++ trunk/doc/website/constitution.htm4 2009-10-06 05:48:42 UTC (rev 5382) @@ -6,7 +6,7 @@ m4_dnl Description: Constitution for OpenVAS project m4_dnl m4_dnl Authors: -m4_dnl Tim Brown +m4_dnl Tim Brown m4_dnl m4_dnl Copyright: m4_dnl Copyright (C) 2007 Tim Brown @@ -39,7 +39,7 @@

Project contacts

Project initiator: Tim Brown
Project initiator: Tim Brown
Development coordinator: William Anderson
Administrative coordinator: Robert Berkowitz

Modified: trunk/doc/website/openvas-contest-2008.htm4 =================================================================== --- trunk/doc/website/openvas-contest-2008.htm4 2009-10-06 05:48:03 UTC (rev 5381) +++ trunk/doc/website/openvas-contest-2008.htm4 2009-10-06 05:48:42 UTC (rev 5382) @@ -7,7 +7,7 @@ m4_dnl m4_dnl Authors: m4_dnl Michael Wiegand -m4_dnl Tim Brown +m4_dnl Tim Brown m4_dnl m4_dnl Copyright: m4_dnl Copyright (C) 2008 Intevation GmbH @@ -73,7 +73,7 @@

Modified: trunk/doc/website/openvas-contest.htm4 =================================================================== --- trunk/doc/website/openvas-contest.htm4 2009-10-06 05:48:03 UTC (rev 5381) +++ trunk/doc/website/openvas-contest.htm4 2009-10-06 05:48:42 UTC (rev 5382) @@ -85,7 +85,7 @@

Modified: trunk/doc/website/openvas.css =================================================================== --- trunk/doc/website/openvas.css 2009-10-06 05:48:03 UTC (rev 5381) +++ trunk/doc/website/openvas.css 2009-10-06 05:48:42 UTC (rev 5382) @@ -4,7 +4,7 @@ * * Authors: * Jan-Oliver Wagner - * Tim Brown + * Tim Brown * * Copyright: * Copyright (C) 2007 Intevation GmbH Modified: trunk/doc/website/template_header.m4 =================================================================== --- trunk/doc/website/template_header.m4 2009-10-06 05:48:03 UTC (rev 5381) +++ trunk/doc/website/template_header.m4 2009-10-06 05:48:42 UTC (rev 5382) @@ -8,7 +8,7 @@ m4_dnl m4_dnl Authors: m4_dnl Jan-Oliver Wagner -m4_dnl Tim Brown +m4_dnl Tim Brown m4_dnl m4_dnl Copyright: m4_dnl Copyright (C) 2007 Intevation GmbH From scm-commit at wald.intevation.org Tue Oct 6 07:51:07 2009 From: scm-commit at wald.intevation.org (scm-commit@wald.intevation.org) Date: Tue, 6 Oct 2009 07:51:07 +0200 (CEST) Subject: [Openvas-commits] r5383 - trunk/openvas-compendium Message-ID: <20091006055107.7AED2852B84F@pyrosoma.intevation.org> Author: timb Date: 2009-10-06 07:51:06 +0200 (Tue, 06 Oct 2009) New Revision: 5383 Modified: trunk/openvas-compendium/ChangeLog trunk/openvas-compendium/openvas-compendium.tex Log: Fix up contact email address Modified: trunk/openvas-compendium/ChangeLog =================================================================== --- trunk/openvas-compendium/ChangeLog 2009-10-06 05:48:42 UTC (rev 5382) +++ trunk/openvas-compendium/ChangeLog 2009-10-06 05:51:06 UTC (rev 5383) @@ -160,7 +160,7 @@ translation, updated information regarding port usage by older and more recent versions of OpenVAS. -2009-01-04 Tim Brown +2009-01-04 Tim Brown * openvas-compendium.de.tex, openvas-compendium.tex: Updated to reflect IANA's port assignment. @@ -382,7 +382,7 @@ * openvas-compendium.de.tex: Minor spelling fixes in the OTP chapter. -2008-10-16 Tim Brown +2008-10-16 Tim Brown * openvas-compendium.tex: Updated with details of knowledge base items in use for Solaris Local Security Checks and @@ -560,7 +560,7 @@ * openvas-compendium.tex: Adapted OTP documentation from specification. -2008-09-10 Tim Brown +2008-09-10 Tim Brown * openvas-compendium.tex: Added details about automatically updating. Modified: trunk/openvas-compendium/openvas-compendium.tex =================================================================== --- trunk/openvas-compendium/openvas-compendium.tex 2009-10-06 05:48:42 UTC (rev 5382) +++ trunk/openvas-compendium/openvas-compendium.tex 2009-10-06 05:51:06 UTC (rev 5383) @@ -6,7 +6,7 @@ % Authors: % Jan-Oliver Wagner % Michael Wiegand -% Tim Brown +% Tim Brown % % Copyright: % Copyright (C) 2008, 2009 Intevation GmbH From scm-commit at wald.intevation.org Tue Oct 6 08:02:08 2009 From: scm-commit at wald.intevation.org (scm-commit@wald.intevation.org) Date: Tue, 6 Oct 2009 08:02:08 +0200 (CEST) Subject: [Openvas-commits] r5384 - trunk/openvas-plugins/scripts Message-ID: <20091006060208.4FD08861EAB2@pyrosoma.intevation.org> Author: timb Date: 2009-10-06 08:02:06 +0200 (Tue, 06 Oct 2009) New Revision: 5384 Modified: trunk/openvas-plugins/scripts/checkpoint-vpn1-pat-information-disclosure.nasl trunk/openvas-plugins/scripts/ike-scan.nasl Log: Tidied up plugins Modified: trunk/openvas-plugins/scripts/checkpoint-vpn1-pat-information-disclosure.nasl =================================================================== --- trunk/openvas-plugins/scripts/checkpoint-vpn1-pat-information-disclosure.nasl 2009-10-06 05:51:06 UTC (rev 5383) +++ trunk/openvas-plugins/scripts/checkpoint-vpn1-pat-information-disclosure.nasl 2009-10-06 06:02:06 UTC (rev 5384) @@ -26,7 +26,13 @@ # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. # -desc = "Checkpoint VPN-1 PAT information disclosure +if (description) +{ + script_id(80096); + script_cve_id("CVE-2008-5849"); + name = "Checkpoint VPN-1 PAT information disclosure"; + script_name(name); + desc = "Checkpoint VPN-1 PAT information disclosure By sending crafted packets to ports on the firewall which are mapped by port address translation (PAT) to ports on internal devices, information about the internal network may be disclosed in the resulting ICMP error packets. Port 18264/tcp on the firewall is typically configured in such a manner, with packets to this port being rewritten to reach the firewall management server. For example, the firewall fails to correctly sanitise the encapsulated IP headers in ICMP time-to-live exceeded packets resulting in internal IP addresses being disclosed. @@ -49,13 +55,6 @@ where this vulnerability is reported. Risk factor: Low"; - -if (description) -{ - script_id(80096); - script_cve_id("CVE-2008-5849"); - name = "Checkpoint VPN-1 PAT information disclosure"; - script_name(name); script_description(desc); summary = "Determines whether Checkpoint VPN-1 is disclosing information about the internal network via PAT"; script_summary(summary); Modified: trunk/openvas-plugins/scripts/ike-scan.nasl =================================================================== --- trunk/openvas-plugins/scripts/ike-scan.nasl 2009-10-06 05:51:06 UTC (rev 5383) +++ trunk/openvas-plugins/scripts/ike-scan.nasl 2009-10-06 06:02:06 UTC (rev 5384) @@ -49,9 +49,9 @@ script_name(name); desc = "ike-scan (NASL wrapper) - This plugin runs ike-scan to identify IPSEC VPN endpoints. It will attempt to enumerate supported cipher suites, bruteforce valid groupnames and fingerprint any endpoint identified. +This plugin runs ike-scan to identify IPSEC VPN endpoints. It will attempt to enumerate supported cipher suites, bruteforce valid groupnames and fingerprint any endpoint identified. - See the section 'plugins options' to configure it"; +See the section 'plugins options' to configure it"; script_description(desc); summary = "Identifies IPSEC VPN endpoints"; script_summary(summary); From scm-commit at wald.intevation.org Tue Oct 6 08:12:51 2009 From: scm-commit at wald.intevation.org (scm-commit@wald.intevation.org) Date: Tue, 6 Oct 2009 08:12:51 +0200 (CEST) Subject: [Openvas-commits] r5385 - in trunk/openvas-plugins: . scripts Message-ID: <20091006061251.7C290861EAC3@pyrosoma.intevation.org> Author: timb Date: 2009-10-06 08:12:48 +0200 (Tue, 06 Oct 2009) New Revision: 5385 Modified: trunk/openvas-plugins/ChangeLog trunk/openvas-plugins/scripts/checkpoint-vpn1-pat-information-disclosure.nasl trunk/openvas-plugins/scripts/dns_xfer.nasl trunk/openvas-plugins/scripts/gather-package-list.nasl trunk/openvas-plugins/scripts/ike-scan.nasl trunk/openvas-plugins/scripts/msdns-server-hostname-disclosure.nasl trunk/openvas-plugins/scripts/visionsoft-audit-detect.nasl Log: Fix up contact email address Modified: trunk/openvas-plugins/ChangeLog =================================================================== --- trunk/openvas-plugins/ChangeLog 2009-10-06 06:02:06 UTC (rev 5384) +++ trunk/openvas-plugins/ChangeLog 2009-10-06 06:12:48 UTC (rev 5385) @@ -38,7 +38,6 @@ scripts/fcore_2009_10180.nasl: New plugins. - 2009-10-05 Michael Meyer * scripts/cvspserver_version.nasl, @@ -29697,7 +29696,7 @@ * scripts/nikto.nasl: Removed useless display(). -2009-07-20 Tim Brown +2009-07-20 Tim Brown * scripts/msdns-server-hostname-disclosure.nasl, scripts/checkpoint-vpn1-pat-information-disclosure.nasl: Added @@ -29819,12 +29818,12 @@ scripts/mdksa_2009_148.nasl: Added new plugins. -2009-07-14 Tim Brown +2009-07-14 Tim Brown * scripts/msdns-server-hostname-disclosure.nasl: Fixed dependency. -2009-07-13 Tim Brown +2009-07-13 Tim Brown * scripts/msdns-server-hostname-disclosure.nasl: Now checks response flags. Handles empty responses, DNS compression with @@ -30092,12 +30091,12 @@ current i18n concepts, http://www.openvas.org/openvas-cr-36.html) using the script provided by Markus Schr?der. -2009-07-11 Tim Brown +2009-07-11 Tim Brown * visionsoft-audit-detect.nasl: Fixed misnamed function call. -2009-07-10 Tim Brown +2009-07-10 Tim Brown * scripts/msdns-server-hostname-disclosure.nasl, scripts/visionsoft-audit-detect.nasl: Added new plugins. @@ -40106,7 +40105,7 @@ * scripts/gb_trillian_mult_vuln.nasl: Added new plugin. -2008-12-16 Tim Brown +2008-12-16 Tim Brown * scripts/ike-scan.nasl: Fixed minor bug. @@ -40503,7 +40502,7 @@ * scripts/webserver_favicon.nasl: Added MD5 fingerprints of popular software. -2008-11-05 Tim Brown +2008-11-05 Tim Brown * scripts/checkpoint-vpn1-pat-information-disclosure.nasl: Added check for Checkpoint VPN-1 PAT information disclosure. @@ -40940,7 +40939,7 @@ connections to target host. Changed find_bin function using case insensitive search. -2008-10-12 Tim Brown +2008-10-12 Tim Brown * scripts/aix_maintenance_level.nasl, scripts/apple-sa-2004-08-09.nasl, @@ -41224,7 +41223,7 @@ * MANIFEST: Updated. -2008-09-18 Tim Brown +2008-09-18 Tim Brown openvas.tmpl.in: Honour LDFLAGS. @@ -41306,7 +41305,7 @@ freebsd_twiki1.nasl freebsd_wordpress7.nasl New scripts -2008-09-15 Tim Brown +2008-09-15 Tim Brown * scripts/ike-scan.nasl: Fixes typo in previous fix. @@ -41319,7 +41318,7 @@ * scripts/pnscan.nasl, scripts/portbunny.nasl: Fixed leftovers from experimental ID's to production ID's in error reporting -2008-09-14 Tim Brown +2008-09-14 Tim Brown * scripts/ike-scan.nasl: Completely rewritten, it will now attempt to enumerate supported cipher suites, bruteforce @@ -41463,7 +41462,7 @@ secpod_reg_enum.nasl and secpod_reg.inc as they are re-written. -2008-09-10 Tim Brown +2008-09-10 Tim Brown * openvas-nvt-sync.in: Fixed rsync options not to trust remote group and user. @@ -42851,7 +42850,7 @@ scripts/deb_1495_2.nasl, scripts/deb_1502_1.nasl, scripts/deb_1497_1.nasl: New Debian scripts. -2008-02-20 Tim Brown +2008-02-20 Tim Brown * scripts/telnet_func.inc, scripts/pop3_func.inc, scripts/nfs_func.inc, scripts/misc_func.inc, @@ -44144,7 +44143,7 @@ scripts/debian_DSA-999.nasl: Removed. They are replaced by a new set of debian local security checks. -2007-11-08 Tim Brown +2007-11-08 Tim Brown * openvas-nvt-sync.in: Minor bug fix to resolve issues where current working directory is not the plugins directory. Modified: trunk/openvas-plugins/scripts/checkpoint-vpn1-pat-information-disclosure.nasl =================================================================== --- trunk/openvas-plugins/scripts/checkpoint-vpn1-pat-information-disclosure.nasl 2009-10-06 06:02:06 UTC (rev 5384) +++ trunk/openvas-plugins/scripts/checkpoint-vpn1-pat-information-disclosure.nasl 2009-10-06 06:12:48 UTC (rev 5385) @@ -3,7 +3,7 @@ # Description: Checkpoint VPN-1 PAT information disclosure # # Authors: -# Tim Brown +# Tim Brown # # Fixes (+note about FP): Vlatko Kosturjak # Modified: trunk/openvas-plugins/scripts/dns_xfer.nasl =================================================================== --- trunk/openvas-plugins/scripts/dns_xfer.nasl 2009-10-06 06:02:06 UTC (rev 5384) +++ trunk/openvas-plugins/scripts/dns_xfer.nasl 2009-10-06 06:12:48 UTC (rev 5385) @@ -4,7 +4,7 @@ # Modified by Axel Nennker # Modified by Erik Anderson # Modified by Pavel Kankovsky -# Modified by Tim Brown +# Modified by Tim Brown # # See the Nessus Scripts License for details # Modified: trunk/openvas-plugins/scripts/gather-package-list.nasl =================================================================== --- trunk/openvas-plugins/scripts/gather-package-list.nasl 2009-10-06 06:02:06 UTC (rev 5384) +++ trunk/openvas-plugins/scripts/gather-package-list.nasl 2009-10-06 06:12:48 UTC (rev 5385) @@ -4,7 +4,7 @@ # # Authors: # Thomas Reinke -# Tim Brown +# Tim Brown # # Copyright: # Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com Modified: trunk/openvas-plugins/scripts/ike-scan.nasl =================================================================== --- trunk/openvas-plugins/scripts/ike-scan.nasl 2009-10-06 06:02:06 UTC (rev 5384) +++ trunk/openvas-plugins/scripts/ike-scan.nasl 2009-10-06 06:12:48 UTC (rev 5385) @@ -4,7 +4,7 @@ # # Authors: # Vlatko Kosturjak (Original development and fixes to rewrite) -# Tim Brown (Complete rewrite) +# Tim Brown (Complete rewrite) # # Copyright: # Copyright (c) 2008 Vlatko Kosturjak Modified: trunk/openvas-plugins/scripts/msdns-server-hostname-disclosure.nasl =================================================================== --- trunk/openvas-plugins/scripts/msdns-server-hostname-disclosure.nasl 2009-10-06 06:02:06 UTC (rev 5384) +++ trunk/openvas-plugins/scripts/msdns-server-hostname-disclosure.nasl 2009-10-06 06:12:48 UTC (rev 5385) @@ -3,7 +3,7 @@ # Description: Microsoft DNS server internal hostname disclosure detection # # Authors: -# Tim Brown +# Tim Brown # # Copyright: # Copyright (c) 2009 Tim Brown @@ -40,7 +40,7 @@ http://support.microsoft.com/default.aspx?id=198410 See also: -http://www.nth-dimension.org.uk/blog.php?id=31 +http://www.openvas.org/blog.php?id=31 Risk factor: Low"; script_description(desc); Modified: trunk/openvas-plugins/scripts/visionsoft-audit-detect.nasl =================================================================== --- trunk/openvas-plugins/scripts/visionsoft-audit-detect.nasl 2009-10-06 06:02:06 UTC (rev 5384) +++ trunk/openvas-plugins/scripts/visionsoft-audit-detect.nasl 2009-10-06 06:12:48 UTC (rev 5385) @@ -3,7 +3,7 @@ # Description: Visionsoft Audit multiple vulnerability detection # # Authors: -# Tim Brown +# Tim Brown # # Copyright: # Copyright (c) 2009 Tim Brown and Portcullis Computer Security Ltd From scm-commit at wald.intevation.org Tue Oct 6 08:54:34 2009 From: scm-commit at wald.intevation.org (scm-commit@wald.intevation.org) Date: Tue, 6 Oct 2009 08:54:34 +0200 (CEST) Subject: [Openvas-commits] r5386 - in trunk/openvas-libraries: . misc Message-ID: <20091006065434.DA9C6803D8DB@pyrosoma.intevation.org> Author: mwiegand Date: 2009-10-06 08:54:33 +0200 (Tue, 06 Oct 2009) New Revision: 5386 Modified: trunk/openvas-libraries/ChangeLog trunk/openvas-libraries/misc/proctitle.c Log: * misc/proctitle.c (setproctitle): Changed start of proctitle to match the new openvas-scanner binary name. Modified: trunk/openvas-libraries/ChangeLog =================================================================== --- trunk/openvas-libraries/ChangeLog 2009-10-06 06:12:48 UTC (rev 5385) +++ trunk/openvas-libraries/ChangeLog 2009-10-06 06:54:33 UTC (rev 5386) @@ -1,3 +1,8 @@ +2009-10-06 Michael Wiegand + + * misc/proctitle.c (setproctitle): Changed start of proctitle to match + the new openvas-scanner binary name. + 2009-10-05 Felix Wolfsteller * include/libopenvas.h: Emptied, except for documentation. Modified: trunk/openvas-libraries/misc/proctitle.c =================================================================== --- trunk/openvas-libraries/misc/proctitle.c 2009-10-06 06:12:48 UTC (rev 5385) +++ trunk/openvas-libraries/misc/proctitle.c 2009-10-06 06:54:33 UTC (rev 5386) @@ -88,7 +88,7 @@ #endif va_end(param); - snprintf(buf2, sizeof(buf2), "openvasd: %s", buf); /* RATS: ignore */ + snprintf(buf2, sizeof(buf2), "openvassd: %s", buf); /* RATS: ignore */ bzero(buf, sizeof(buf)); strncpy(buf, buf2, sizeof(buf) - 1); From scm-commit at wald.intevation.org Tue Oct 6 09:52:27 2009 From: scm-commit at wald.intevation.org (scm-commit@wald.intevation.org) Date: Tue, 6 Oct 2009 09:52:27 +0200 (CEST) Subject: [Openvas-commits] r5387 - trunk/doc/website Message-ID: <20091006075227.17DF884F7462@pyrosoma.intevation.org> Author: timb Date: 2009-10-06 09:52:25 +0200 (Tue, 06 Oct 2009) New Revision: 5387 Modified: trunk/doc/website/Makefile Log: Make rsync ignore "CVS" files Modified: trunk/doc/website/Makefile =================================================================== --- trunk/doc/website/Makefile 2009-10-06 06:54:33 UTC (rev 5386) +++ trunk/doc/website/Makefile 2009-10-06 07:52:25 UTC (rev 5387) @@ -54,7 +54,7 @@ online: all echo "Going to put current contents online for openvas.wald.intevation.org ..." - rsync --protocol=29 -urvP --exclude='.svn' $(ADD_INST_TYPES) $(TARGETS) $(ADD_INST_DIRS) \ + rsync --protocol=29 -urvPC --exclude='.svn' $(ADD_INST_TYPES) $(TARGETS) $(ADD_INST_DIRS) \ $(USER)@wald.intevation.org:/openvas/htdocs/ install: all From scm-commit at wald.intevation.org Tue Oct 6 10:28:51 2009 From: scm-commit at wald.intevation.org (scm-commit@wald.intevation.org) Date: Tue, 6 Oct 2009 10:28:51 +0200 (CEST) Subject: [Openvas-commits] r5388 - trunk/openvas-libraries Message-ID: <20091006082851.9BE3385D9191@pyrosoma.intevation.org> Author: mwiegand Date: 2009-10-06 10:28:50 +0200 (Tue, 06 Oct 2009) New Revision: 5388 Modified: trunk/openvas-libraries/ChangeLog trunk/openvas-libraries/Makefile Log: * Makefile: Expose $localstatedir and $sysconfdir set during configure time to CMake. Modified: trunk/openvas-libraries/ChangeLog =================================================================== --- trunk/openvas-libraries/ChangeLog 2009-10-06 07:52:25 UTC (rev 5387) +++ trunk/openvas-libraries/ChangeLog 2009-10-06 08:28:50 UTC (rev 5388) @@ -1,5 +1,10 @@ 2009-10-06 Michael Wiegand + * Makefile: Expose $localstatedir and $sysconfdir set during configure + time to CMake. + +2009-10-06 Michael Wiegand + * misc/proctitle.c (setproctitle): Changed start of proctitle to match the new openvas-scanner binary name. Modified: trunk/openvas-libraries/Makefile =================================================================== --- trunk/openvas-libraries/Makefile 2009-10-06 07:52:25 UTC (rev 5387) +++ trunk/openvas-libraries/Makefile 2009-10-06 08:28:50 UTC (rev 5388) @@ -30,11 +30,11 @@ ALLDEPS = openvas-libraries.tmpl all: $(ALLDEPS) - cd base && cmake -DCMAKE_INSTALL_PREFIX=${prefix} -DHAVE_WMI=$(HAVE_WMI) && ${MAKE} + cd base && cmake -DCMAKE_INSTALL_PREFIX=${prefix} -DSYSCONFDIR=${sysconfdir} -DLOCALSTATEDIR=${localstatedir} -DHAVE_WMI=$(HAVE_WMI) && ${MAKE} cd hg && ${MAKE} cd misc && ${MAKE} - cd nasl && cmake -DCMAKE_INSTALL_PREFIX=${prefix} && ${MAKE} - cd omp && cmake -DCMAKE_INSTALL_PREFIX=${prefix} && ${MAKE} + cd nasl && cmake -DCMAKE_INSTALL_PREFIX=${prefix} -DSYSCONFDIR=${sysconfdir} -DLOCALSTATEDIR=${localstatedir} && ${MAKE} + cd omp && cmake -DCMAKE_INSTALL_PREFIX=${prefix} -DSYSCONFDIR=${sysconfdir} -DLOCALSTATEDIR=${localstatedir} && ${MAKE} openvas-libraries.tmpl: openvas-libraries.tmpl.in configure VERSION $(SHELL) configure $(CONFIGURE_ARGS) From scm-commit at wald.intevation.org Tue Oct 6 10:50:03 2009 From: scm-commit at wald.intevation.org (scm-commit@wald.intevation.org) Date: Tue, 6 Oct 2009 10:50:03 +0200 (CEST) Subject: [Openvas-commits] r5389 - in trunk/openvas-client: . openvas openvas/prefs_dialog Message-ID: <20091006085003.276CE9503ABF@pyrosoma.intevation.org> Author: mattm Date: 2009-10-06 10:50:01 +0200 (Tue, 06 Oct 2009) New Revision: 5389 Modified: trunk/openvas-client/ChangeLog trunk/openvas-client/openvas/openvas-client.c trunk/openvas-client/openvas/prefs_dialog/prefs_scope_tree.c Log: * openvas/prefs_dialog/prefs_scope_tree.c (scopetree_refresh): Remove verbose flag setting. Correct indentation. * openvas/openvas-client.c (refresh_server): Save context to disk afterwards, so that new scopes can copy it. Modified: trunk/openvas-client/ChangeLog =================================================================== --- trunk/openvas-client/ChangeLog 2009-10-06 08:28:50 UTC (rev 5388) +++ trunk/openvas-client/ChangeLog 2009-10-06 08:50:01 UTC (rev 5389) @@ -1,3 +1,11 @@ +2009-10-06 Matthew Mundell + + * openvas/prefs_dialog/prefs_scope_tree.c (scopetree_refresh): Remove + verbose flag setting. Correct indentation. + + * openvas/openvas-client.c (refresh_server): Save context to disk + afterwards, so that new scopes can copy it. + 2009-10-02 Felix Wolfsteller * include/config.h.in: Set ENABLE_SAFE_TESTS to 0. Modified: trunk/openvas-client/openvas/openvas-client.c =================================================================== --- trunk/openvas-client/openvas/openvas-client.c 2009-10-06 08:28:50 UTC (rev 5388) +++ trunk/openvas-client/openvas/openvas-client.c 2009-10-06 08:50:01 UTC (rev 5389) @@ -460,6 +460,9 @@ plugin_cache_write (context, context->plugins_md5sum); } + /* Save the RC to disk, so that new scopes can copy it. */ + context_save_recurse (context); + return NULL; } #endif /* USE_OMP */ Modified: trunk/openvas-client/openvas/prefs_dialog/prefs_scope_tree.c =================================================================== --- trunk/openvas-client/openvas/prefs_dialog/prefs_scope_tree.c 2009-10-06 08:28:50 UTC (rev 5388) +++ trunk/openvas-client/openvas/prefs_dialog/prefs_scope_tree.c 2009-10-06 08:50:01 UTC (rev 5389) @@ -1172,8 +1172,6 @@ GtkTreeStore *treestore; const char *message; - //verbose = 1; // FIX - switch(type) { case CONTEXT_SERVER: @@ -1387,7 +1385,7 @@ /* Create the children of the manager in the scope tree. */ treeview = GTK_TREE_VIEW (arg_get_value (arg_get_value (MainDialog, - "SCOPETREE"), + "SCOPETREE"), "TREEVIEW")); treestore = GTK_TREE_STORE (gtk_tree_view_get_model (treeview)); scope_create_treestore_children (treestore, context); From scm-commit at wald.intevation.org Tue Oct 6 11:22:01 2009 From: scm-commit at wald.intevation.org (scm-commit@wald.intevation.org) Date: Tue, 6 Oct 2009 11:22:01 +0200 (CEST) Subject: [Openvas-commits] r5390 - in trunk/openvas-libraries: . misc nasl Message-ID: <20091006092201.64D3F865F477@pyrosoma.intevation.org> Author: felix Date: 2009-10-06 11:21:55 +0200 (Tue, 06 Oct 2009) New Revision: 5390 Modified: trunk/openvas-libraries/ChangeLog trunk/openvas-libraries/misc/store.c trunk/openvas-libraries/nasl/nasl_scanner_glue.c Log: * misc/store.c, nasl/nasl_scanner_glue.c: Replaced openvasd by openvassd in documentation, minor cosmetics. Modified: trunk/openvas-libraries/ChangeLog =================================================================== --- trunk/openvas-libraries/ChangeLog 2009-10-06 08:50:01 UTC (rev 5389) +++ trunk/openvas-libraries/ChangeLog 2009-10-06 09:21:55 UTC (rev 5390) @@ -1,3 +1,8 @@ +2009-10-06 Felix Wolfsteller + + * misc/store.c, nasl/nasl_scanner_glue.c: Replaced openvasd by + openvassd in documentation, minor cosmetics. + 2009-10-06 Michael Wiegand * Makefile: Expose $localstatedir and $sysconfdir set during configure Modified: trunk/openvas-libraries/misc/store.c =================================================================== --- trunk/openvas-libraries/misc/store.c 2009-10-06 08:50:01 UTC (rev 5389) +++ trunk/openvas-libraries/misc/store.c 2009-10-06 09:21:55 UTC (rev 5390) @@ -43,7 +43,7 @@ * store returns NULL (cache is either outdated, contains error or an error * occurred). * - * The store is updated at each openvasd start up. There the plugin loader + * The store is updated at each openvassd start up. There the plugin loader * iterates over plugin files and tries to retrieve the cached version. * If there is no cached version (or @ref store_load_plugin returns Null for * another reason, e.g.because the script file seems to have been modified in @@ -133,7 +133,7 @@ } str = t+1; } - + while(str[0]==' ')str++; if(str[0] != '\0') arg_add_value(ret, str, ARG_INT, 0, (void*)1); Modified: trunk/openvas-libraries/nasl/nasl_scanner_glue.c =================================================================== --- trunk/openvas-libraries/nasl/nasl_scanner_glue.c 2009-10-06 08:50:01 UTC (rev 5389) +++ trunk/openvas-libraries/nasl/nasl_scanner_glue.c 2009-10-06 09:21:55 UTC (rev 5390) @@ -20,7 +20,7 @@ /** * @file * This file contains all the functions that make the "glue" between - * as NASL script and openvasd. + * as NASL script and openvassd. * (script_*(), *kb*(), scanner_*()) */ @@ -830,18 +830,19 @@ return FAKE_CELL; } -tree_cell * set_kb_item(lex_ctxt * lexic) +tree_cell * +set_kb_item (lex_ctxt * lexic) { struct arglist * script_infos = lexic->script_infos; char * name = get_str_local_var_by_name(lexic, "name"); int type = get_local_var_type_by_name(lexic, "value"); - + if( name == NULL ) { nasl_perror(lexic, "Syntax error with set_kb_item() [null name]\n", name); return FAKE_CELL; } - + if (! lexic->authenticated && strncmp(name, SECRET_KB_PREFIX, sizeof(SECRET_KB_PREFIX) - 1) == 0) { @@ -879,11 +880,11 @@ /** - * Function is used when the script wants to report a problem back to openvasd. + * Function is used when the script wants to report a problem back to openvassd. */ typedef void(*proto_post_something_t)(struct arglist*, int, const char*, const char *); /** - * Function is used when the script wants to report a problem back to openvasd. + * Function is used when the script wants to report a problem back to openvassd. */ typedef void(*post_something_t)(struct arglist*, int, const char*); From scm-commit at wald.intevation.org Tue Oct 6 11:38:05 2009 From: scm-commit at wald.intevation.org (scm-commit@wald.intevation.org) Date: Tue, 6 Oct 2009 11:38:05 +0200 (CEST) Subject: [Openvas-commits] r5391 - in trunk/openvas-manager: . src Message-ID: <20091006093805.DBF7B861EACA@pyrosoma.intevation.org> Author: mattm Date: 2009-10-06 11:38:00 +0200 (Tue, 06 Oct 2009) New Revision: 5391 Modified: trunk/openvas-manager/ChangeLog trunk/openvas-manager/src/manage.h trunk/openvas-manager/src/omp.c trunk/openvas-manager/src/omp.h trunk/openvas-manager/src/ompd.c trunk/openvas-manager/src/ompd.h trunk/openvas-manager/src/openvasmd.c trunk/openvas-manager/src/tasks_sql.h Log: Complete database initialisation check started yesterday. * src/tasks_sql.h (init_manage): Add nvt_cache_mode arg. Update caller. Enable and complete database initialisation check. * src/manage.h: Update header. * src/omp.c (init_omp): Add nvt_cache_mode arg. Update caller. * src/omp.h: Update header. * src/ompd.c (init_ompd): Add nvt_cache_mode arg. Update caller. * src/ompd.h: Update header. * src/openvasmd.c (main): Add "must init" failure to init_ompd return checks. Modified: trunk/openvas-manager/ChangeLog =================================================================== --- trunk/openvas-manager/ChangeLog 2009-10-06 09:21:55 UTC (rev 5390) +++ trunk/openvas-manager/ChangeLog 2009-10-06 09:38:00 UTC (rev 5391) @@ -1,3 +1,20 @@ +2009-10-06 Matthew Mundell + + Complete database initialisation check started yesterday. + + * src/tasks_sql.h (init_manage): Add nvt_cache_mode arg. Update caller. + Enable and complete database initialisation check. + * src/manage.h: Update header. + + * src/omp.c (init_omp): Add nvt_cache_mode arg. Update caller. + * src/omp.h: Update header. + + * src/ompd.c (init_ompd): Add nvt_cache_mode arg. Update caller. + * src/ompd.h: Update header. + + * src/openvasmd.c (main): Add "must init" failure to init_ompd return + checks. + 2009-10-05 Matthew Mundell Move caching of NVT preferences to the database. Modified: trunk/openvas-manager/src/manage.h =================================================================== --- trunk/openvas-manager/src/manage.h 2009-10-06 09:21:55 UTC (rev 5390) +++ trunk/openvas-manager/src/manage.h 2009-10-06 09:38:00 UTC (rev 5391) @@ -52,7 +52,7 @@ extern scanner_t scanner; int -init_manage (GSList*); +init_manage (GSList*, int); void init_manage_process (); Modified: trunk/openvas-manager/src/omp.c =================================================================== --- trunk/openvas-manager/src/omp.c 2009-10-06 09:21:55 UTC (rev 5390) +++ trunk/openvas-manager/src/omp.c 2009-10-06 09:38:00 UTC (rev 5391) @@ -5174,18 +5174,19 @@ * @brief Initialise OMP library. * * @param[in] log_config Logging configuration list. + * @param[in] nvt_cache_mode True when running in NVT caching mode. * * @return 0 success, -1 error, -2 database is wrong version, -3 database * needs to be initialized from server. */ int -init_omp (GSList *log_config) +init_omp (GSList *log_config, int nvt_cache_mode) { g_log_set_handler (G_LOG_DOMAIN, ALL_LOG_LEVELS, (GLogFunc) openvas_log_func, log_config); - return init_manage (log_config); + return init_manage (log_config, nvt_cache_mode); } /** Modified: trunk/openvas-manager/src/omp.h =================================================================== --- trunk/openvas-manager/src/omp.h 2009-10-06 09:21:55 UTC (rev 5390) +++ trunk/openvas-manager/src/omp.h 2009-10-06 09:38:00 UTC (rev 5391) @@ -36,7 +36,7 @@ #define TO_CLIENT_BUFFER_SIZE 26214400 int -init_omp (GSList*); +init_omp (GSList*, int); void init_omp_process (); Modified: trunk/openvas-manager/src/ompd.c =================================================================== --- trunk/openvas-manager/src/ompd.c 2009-10-06 09:21:55 UTC (rev 5390) +++ trunk/openvas-manager/src/ompd.c 2009-10-06 09:38:00 UTC (rev 5391) @@ -93,15 +93,16 @@ /** * @brief Initialise the OMP library for the OMP daemon. * - * @param[in] log_config Log configuration + * @param[in] log_config Log configuration + * @param[in] nvt_cache_mode True when running in NVT caching mode. * * @return 0 success, -1 error, -2 database is wrong version, -3 database * needs to be initialized from server. */ int -init_ompd (GSList *log_config) +init_ompd (GSList *log_config, int nvt_cache_mode) { - return init_omp (log_config); + return init_omp (log_config, nvt_cache_mode); } /** Modified: trunk/openvas-manager/src/ompd.h =================================================================== --- trunk/openvas-manager/src/ompd.h 2009-10-06 09:21:55 UTC (rev 5390) +++ trunk/openvas-manager/src/ompd.h 2009-10-06 09:38:00 UTC (rev 5391) @@ -31,7 +31,7 @@ #include int -init_ompd (GSList*); +init_ompd (GSList*, int); int serve_omp (gnutls_session_t*, gnutls_session_t*, Modified: trunk/openvas-manager/src/openvasmd.c =================================================================== --- trunk/openvas-manager/src/openvasmd.c 2009-10-06 09:21:55 UTC (rev 5390) +++ trunk/openvas-manager/src/openvasmd.c 2009-10-06 09:38:00 UTC (rev 5391) @@ -627,7 +627,7 @@ /* Initialise OMP daemon. */ - switch (init_ompd (log_config)) + switch (init_ompd (log_config, 1)) { case 0: break; @@ -636,6 +636,8 @@ free_log_configuration (log_config); exit (EXIT_FAILURE); break; + case -3: + assert (0); case -1: default: g_critical ("%s: failed to initialise OMP daemon\n", __FUNCTION__); @@ -792,7 +794,7 @@ /* Initialise OMP daemon. */ - switch (init_ompd (log_config)) + switch (init_ompd (log_config, 0)) { case 0: break; @@ -801,6 +803,13 @@ free_log_configuration (log_config); exit (EXIT_FAILURE); break; + case -3: + g_critical ("%s: database must be initialised" + " (with the --update command line option)\n", + __FUNCTION__); + free_log_configuration (log_config); + exit (EXIT_FAILURE); + break; case -1: default: g_critical ("%s: failed to initialise OMP daemon\n", __FUNCTION__); Modified: trunk/openvas-manager/src/tasks_sql.h =================================================================== --- trunk/openvas-manager/src/tasks_sql.h 2009-10-06 09:21:55 UTC (rev 5390) +++ trunk/openvas-manager/src/tasks_sql.h 2009-10-06 09:38:00 UTC (rev 5391) @@ -889,11 +889,14 @@ * Beware that calling this function while tasks are running may lead to * problems. * + * @param[in] log_config Log configuration. + * @param[in] nvt_cache_mode True when running in NVT caching mode. + * * @return 0 success, -1 error, -2 database is wrong version, -3 database needs * to be initialised from server. */ int -init_manage (GSList *log_config) +init_manage (GSList *log_config, int nvt_cache_mode) { const char *database_version; task_t index; @@ -911,25 +914,36 @@ database_version = sql_string (0, 0, "SELECT value FROM meta" " WHERE name = 'database_version';"); - if (database_version - && strcmp (database_version, G_STRINGIFY (DATABASE_VERSION))) - return -2; + if (nvt_cache_mode) + { + if (database_version + && strcmp (database_version, G_STRINGIFY (DATABASE_VERSION))) + return -2; -#if 0 - /** @todo Skip this when in NVT caching mode. */ + /* If database_version was NULL then meta was missing, so assume + * that the database is missing, which is OK. */ + } + else + { + if (database_version) + { + if (strcmp (database_version, G_STRINGIFY (DATABASE_VERSION))) + return -2; + } + else + /* Assume database is missing. */ + return -3; - /* Check that the database was initialised from the scanner. */ + /* Check that the database was initialised from the scanner. */ - { - long long int count; - if (sql_int64 (&count, 0, 0, - "SELECT count(*) FROM meta" - " WHERE name = 'nvt_md5sum'" - " OR name = 'nvt_preferences_enabled';") - || count < 2) - return -3; - } -#endif + long long int count; + if (sql_int64 (&count, 0, 0, + "SELECT count(*) FROM meta" + " WHERE name = 'nvts_md5sum'" + " OR name = 'nvt_preferences_enabled';") + || count < 2) + return -3; + } /* Ensure the tables exist. */ From scm-commit at wald.intevation.org Tue Oct 6 11:43:07 2009 From: scm-commit at wald.intevation.org (scm-commit@wald.intevation.org) Date: Tue, 6 Oct 2009 11:43:07 +0200 (CEST) Subject: [Openvas-commits] r5392 - in trunk/openvas-libraries: . doc Message-ID: <20091006094307.9B35F861EAB2@pyrosoma.intevation.org> Author: mwiegand Date: 2009-10-06 11:43:06 +0200 (Tue, 06 Oct 2009) New Revision: 5392 Modified: trunk/openvas-libraries/CHANGES trunk/openvas-libraries/ChangeLog trunk/openvas-libraries/VERSION trunk/openvas-libraries/doc/Doxyfile trunk/openvas-libraries/doc/Doxyfile_full Log: Preparing the openvas-libraries 3.0.0-beta3 release. * CHANGES: Updated. * VERSION: Set to 3.0.0.beta3. * doc/Doxyfile, doc/Doxyfile_full: Updated PROJECT_NUMBER. Modified: trunk/openvas-libraries/CHANGES =================================================================== --- trunk/openvas-libraries/CHANGES 2009-10-06 09:38:00 UTC (rev 5391) +++ trunk/openvas-libraries/CHANGES 2009-10-06 09:43:06 UTC (rev 5392) @@ -1,3 +1,55 @@ +openvas-libraries 3.0.0-beta3 (2009-10-06) + +This release is the third beta version of openvas-libraries +leading up to the upcoming 3.0 release of OpenVAS. +It introduces a significantly improved and changed source +code architecture and therefore introduces a new API for the +other OpenVAS components. + +OpenVAS 3.0 will introduce a new architecture where openvas-libraries +now includes openvas-libnasl as well as redundant code from openvas-client +and where openvas-server is renamed to openvas-scanner and includes any +platform-dependent elements of openvas-plugins. As a result of this, +the source code will shrink, though new features will be added. Also, +for running the scanner now only 2 modules are required (instead of 4 +as for OpenVAS 2.0). + +New features of OpenVAS include support for IPv6 and WMI-Clients. +Version 3.0 prepares the new OpenVAS Manager and OpenVAS Administrator +as optional extension. This combination leverages the vulnerability +scanner to a comprehensive vulnerability management solution. + +The "beta" releases are intended to allow testing of the upcoming +3.0 series. It should be kept separate from OpenVAS 2.0 installations +and not be used in a production environment. + +Many thanks to everyone who has contributed to the 3.0.0 release: +Chandrashekhar B, Marcus Brinkmann, Tim Brown, Vlatko Kosturjak, Michael Meyer, +Matthew Mundell, Laban Mwangi, Srinivasa NL, Jan Wagner, Jan-Oliver Wagner, +Michael Wiegand and Felix Wolfsteller. + +Main changes compared to 2.0.x: + +* IPv6 support +* WMI-Client support +* Integration of openvas-libnasl +* New library "base" +* New library "omp" +* Former libopenvas renamed to libopenvas_misc +* New NVT cache implementation to overcome limitations +* Several files from openvas-client integrated +* Use of "cmake" to build base, omp and nasl +* glib dependency raised from 2.6 to 2.12 + +Main changes compared to 3.0.0-beta2: + +* Minimum cmake version raised from 2.4 to 2.6 +* Internal library reorganisation +* Proctitle now contains the correct binary name for openvas-scanner +* Configured values for the local state directory and for the system + configuration directory are now honoured correctly during build time + + openvas-libraries 3.0.0-beta2 (2009-09-28) This release is the second beta version of openvas-libraries Modified: trunk/openvas-libraries/ChangeLog =================================================================== --- trunk/openvas-libraries/ChangeLog 2009-10-06 09:38:00 UTC (rev 5391) +++ trunk/openvas-libraries/ChangeLog 2009-10-06 09:43:06 UTC (rev 5392) @@ -1,3 +1,13 @@ +2009-10-06 Michael Wiegand + + Preparing the openvas-libraries 3.0.0-beta3 release. + + * CHANGES: Updated. + + * VERSION: Set to 3.0.0.beta3. + + * doc/Doxyfile, doc/Doxyfile_full: Updated PROJECT_NUMBER. + 2009-10-06 Felix Wolfsteller * misc/store.c, nasl/nasl_scanner_glue.c: Replaced openvasd by Modified: trunk/openvas-libraries/VERSION =================================================================== --- trunk/openvas-libraries/VERSION 2009-10-06 09:38:00 UTC (rev 5391) +++ trunk/openvas-libraries/VERSION 2009-10-06 09:43:06 UTC (rev 5392) @@ -1 +1 @@ -3.0.0.beta3.SVN +3.0.0.beta3 Modified: trunk/openvas-libraries/doc/Doxyfile =================================================================== --- trunk/openvas-libraries/doc/Doxyfile 2009-10-06 09:38:00 UTC (rev 5391) +++ trunk/openvas-libraries/doc/Doxyfile 2009-10-06 09:43:06 UTC (rev 5392) @@ -23,7 +23,7 @@ # This could be handy for archiving the generated documentation or # if some version control system is used. -PROJECT_NUMBER = 3.0.0.beta3.SVN +PROJECT_NUMBER = 3.0.0.beta3 # The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute) # base path where the generated documentation will be put. Modified: trunk/openvas-libraries/doc/Doxyfile_full =================================================================== --- trunk/openvas-libraries/doc/Doxyfile_full 2009-10-06 09:38:00 UTC (rev 5391) +++ trunk/openvas-libraries/doc/Doxyfile_full 2009-10-06 09:43:06 UTC (rev 5392) @@ -23,7 +23,7 @@ # This could be handy for archiving the generated documentation or # if some version control system is used. -PROJECT_NUMBER = 3.0.0.beta3.SVN +PROJECT_NUMBER = 3.0.0.beta3 # The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute) # base path where the generated documentation will be put. From scm-commit at wald.intevation.org Tue Oct 6 11:46:36 2009 From: scm-commit at wald.intevation.org (scm-commit@wald.intevation.org) Date: Tue, 6 Oct 2009 11:46:36 +0200 (CEST) Subject: [Openvas-commits] r5393 - tags Message-ID: <20091006094636.00946865F477@pyrosoma.intevation.org> Author: mwiegand Date: 2009-10-06 11:46:36 +0200 (Tue, 06 Oct 2009) New Revision: 5393 Added: tags/openvas-libraries-release-3.0.0-beta3/ Log: Tagging openvas-libraries-3.0.0-beta3 release. Copied: tags/openvas-libraries-release-3.0.0-beta3 (from rev 5392, trunk/openvas-libraries) From scm-commit at wald.intevation.org Tue Oct 6 11:48:22 2009 From: scm-commit at wald.intevation.org (scm-commit@wald.intevation.org) Date: Tue, 6 Oct 2009 11:48:22 +0200 (CEST) Subject: [Openvas-commits] r5394 - in trunk/openvas-manager: . src Message-ID: <20091006094822.9CBD785D9F7B@pyrosoma.intevation.org> Author: mattm Date: 2009-10-06 11:48:22 +0200 (Tue, 06 Oct 2009) New Revision: 5394 Modified: trunk/openvas-manager/ChangeLog trunk/openvas-manager/src/tasks_sql.h Log: * src/tasks_sql.h (init_manage): Log database versions on version failure. Modified: trunk/openvas-manager/ChangeLog =================================================================== --- trunk/openvas-manager/ChangeLog 2009-10-06 09:46:36 UTC (rev 5393) +++ trunk/openvas-manager/ChangeLog 2009-10-06 09:48:22 UTC (rev 5394) @@ -1,5 +1,9 @@ 2009-10-06 Matthew Mundell + * src/tasks_sql.h (init_manage): Log database versions on version failure. + +2009-10-06 Matthew Mundell + Complete database initialisation check started yesterday. * src/tasks_sql.h (init_manage): Add nvt_cache_mode arg. Update caller. Modified: trunk/openvas-manager/src/tasks_sql.h =================================================================== --- trunk/openvas-manager/src/tasks_sql.h 2009-10-06 09:46:36 UTC (rev 5393) +++ trunk/openvas-manager/src/tasks_sql.h 2009-10-06 09:48:22 UTC (rev 5394) @@ -918,7 +918,15 @@ { if (database_version && strcmp (database_version, G_STRINGIFY (DATABASE_VERSION))) - return -2; + { + g_message ("%s: database version of database: %s\n", + __FUNCTION__, + database_version); + g_message ("%s: database version supported by manager: %s\n", + __FUNCTION__, + G_STRINGIFY (DATABASE_VERSION)); + return -2; + } /* If database_version was NULL then meta was missing, so assume * that the database is missing, which is OK. */ @@ -928,7 +936,15 @@ if (database_version) { if (strcmp (database_version, G_STRINGIFY (DATABASE_VERSION))) - return -2; + { + g_message ("%s: database version of database: %s\n", + __FUNCTION__, + database_version); + g_message ("%s: database version supported by manager: %s\n", + __FUNCTION__, + G_STRINGIFY (DATABASE_VERSION)); + return -2; + } } else /* Assume database is missing. */ From scm-commit at wald.intevation.org Tue Oct 6 11:49:30 2009 From: scm-commit at wald.intevation.org (scm-commit@wald.intevation.org) Date: Tue, 6 Oct 2009 11:49:30 +0200 (CEST) Subject: [Openvas-commits] r5395 - in trunk/openvas-libraries: . doc Message-ID: <20091006094930.6F7DB861EAD4@pyrosoma.intevation.org> Author: mwiegand Date: 2009-10-06 11:49:30 +0200 (Tue, 06 Oct 2009) New Revision: 5395 Modified: trunk/openvas-libraries/ChangeLog trunk/openvas-libraries/VERSION trunk/openvas-libraries/doc/Doxyfile trunk/openvas-libraries/doc/Doxyfile_full Log: Post-release version bump. * VERSION: Set to 3.0.0.beta4.SVN. * doc/Doxyfile, doc/Doxyfile_full: Updated PROJECT_NUMBER. Modified: trunk/openvas-libraries/ChangeLog =================================================================== --- trunk/openvas-libraries/ChangeLog 2009-10-06 09:48:22 UTC (rev 5394) +++ trunk/openvas-libraries/ChangeLog 2009-10-06 09:49:30 UTC (rev 5395) @@ -1,5 +1,13 @@ 2009-10-06 Michael Wiegand + Post-release version bump. + + * VERSION: Set to 3.0.0.beta4.SVN. + + * doc/Doxyfile, doc/Doxyfile_full: Updated PROJECT_NUMBER. + +2009-10-06 Michael Wiegand + Preparing the openvas-libraries 3.0.0-beta3 release. * CHANGES: Updated. Modified: trunk/openvas-libraries/VERSION =================================================================== --- trunk/openvas-libraries/VERSION 2009-10-06 09:48:22 UTC (rev 5394) +++ trunk/openvas-libraries/VERSION 2009-10-06 09:49:30 UTC (rev 5395) @@ -1 +1 @@ -3.0.0.beta3 +3.0.0.beta4.SVN Modified: trunk/openvas-libraries/doc/Doxyfile =================================================================== --- trunk/openvas-libraries/doc/Doxyfile 2009-10-06 09:48:22 UTC (rev 5394) +++ trunk/openvas-libraries/doc/Doxyfile 2009-10-06 09:49:30 UTC (rev 5395) @@ -23,7 +23,7 @@ # This could be handy for archiving the generated documentation or # if some version control system is used. -PROJECT_NUMBER = 3.0.0.beta3 +PROJECT_NUMBER = 3.0.0.beta4.SVN # The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute) # base path where the generated documentation will be put. Modified: trunk/openvas-libraries/doc/Doxyfile_full =================================================================== --- trunk/openvas-libraries/doc/Doxyfile_full 2009-10-06 09:48:22 UTC (rev 5394) +++ trunk/openvas-libraries/doc/Doxyfile_full 2009-10-06 09:49:30 UTC (rev 5395) @@ -23,7 +23,7 @@ # This could be handy for archiving the generated documentation or # if some version control system is used. -PROJECT_NUMBER = 3.0.0.beta3 +PROJECT_NUMBER = 3.0.0.beta4.SVN # The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute) # base path where the generated documentation will be put. From scm-commit at wald.intevation.org Tue Oct 6 11:55:26 2009 From: scm-commit at wald.intevation.org (scm-commit@wald.intevation.org) Date: Tue, 6 Oct 2009 11:55:26 +0200 (CEST) Subject: [Openvas-commits] r5396 - trunk/doc/website Message-ID: <20091006095526.CDBCA852FE2A@pyrosoma.intevation.org> Author: mwiegand Date: 2009-10-06 11:55:26 +0200 (Tue, 06 Oct 2009) New Revision: 5396 Modified: trunk/doc/website/template_header.m4 Log: Update version and download link for openvas-libraries 3.0.0-beta. Modified: trunk/doc/website/template_header.m4 =================================================================== --- trunk/doc/website/template_header.m4 2009-10-06 09:49:30 UTC (rev 5395) +++ trunk/doc/website/template_header.m4 2009-10-06 09:55:26 UTC (rev 5396) @@ -177,7 +177,7 @@

OpenVAS 3.0 BETA:
- -libraries 3.0.0-beta2
+ -libraries 3.0.0-beta3
-scanner 3.0.0-beta2
-client 3.0.0-beta1
Optional:
From scm-commit at wald.intevation.org Tue Oct 6 12:18:16 2009 From: scm-commit at wald.intevation.org (scm-commit@wald.intevation.org) Date: Tue, 6 Oct 2009 12:18:16 +0200 (CEST) Subject: [Openvas-commits] r5397 - trunk/openvas-packaging/openvas-libraries/debian/trunk/debian Message-ID: <20091006101816.7A778861EAB5@pyrosoma.intevation.org> Author: mwiegand Date: 2009-10-06 12:18:14 +0200 (Tue, 06 Oct 2009) New Revision: 5397 Modified: trunk/openvas-packaging/openvas-libraries/debian/trunk/debian/changelog trunk/openvas-packaging/openvas-libraries/debian/trunk/debian/control trunk/openvas-packaging/openvas-libraries/debian/trunk/debian/rules Log: * New upstream release. * rules: Set sysconfdir at configure time. * control: Bumped cmake dependency since it was raised upstream. Modified: trunk/openvas-packaging/openvas-libraries/debian/trunk/debian/changelog =================================================================== --- trunk/openvas-packaging/openvas-libraries/debian/trunk/debian/changelog 2009-10-06 09:55:26 UTC (rev 5396) +++ trunk/openvas-packaging/openvas-libraries/debian/trunk/debian/changelog 2009-10-06 10:18:14 UTC (rev 5397) @@ -1,3 +1,11 @@ +openvas-libraries (3.0.0-beta3) UNRELEASED; urgency=low + + * New upstream release. + * rules: Set sysconfdir at configure time. + * control: Bumped cmake dependency since it was raised upstream. + + -- Michael Wiegand Tue, 06 Oct 2009 12:06:19 +0200 + openvas-libraries (3.0.0-beta2) UNRELEASED; urgency=low * New upstream release. Modified: trunk/openvas-packaging/openvas-libraries/debian/trunk/debian/control =================================================================== --- trunk/openvas-packaging/openvas-libraries/debian/trunk/debian/control 2009-10-06 09:55:26 UTC (rev 5396) +++ trunk/openvas-packaging/openvas-libraries/debian/trunk/debian/control 2009-10-06 10:18:14 UTC (rev 5397) @@ -3,7 +3,7 @@ Priority: optional Maintainer: Debian OpenVAS Maintainers Uploaders: Tim Brown , Javier Fernandez-Sanguino Pen~a , Jan Wagner -Build-Depends: debhelper (>= 5), autotools-dev, libgnutls-dev, libpcap-dev, libglib2.0-dev, dpatch, libgpgme11-dev (>= 1.1.2), bison, cmake, libgcrypt11-dev +Build-Depends: debhelper (>= 5), autotools-dev, libgnutls-dev, libpcap-dev, libglib2.0-dev, dpatch, libgpgme11-dev (>= 1.1.2), bison, cmake (>= 2.6), libgcrypt11-dev Homepage: http://www.openvas.org/ Vcs-Browser: https://wald.intevation.org/plugins/scmsvn/viewcvs.php/trunk/openvas-packaging/openvas-libraries/debian/trunk/debian/?root=openvas Vcs-Svn: https://svn.wald.intevation.org/svn/openvas/trunk/openvas-packaging/openvas-libraries/debian/trunk/debian/ Modified: trunk/openvas-packaging/openvas-libraries/debian/trunk/debian/rules =================================================================== --- trunk/openvas-packaging/openvas-libraries/debian/trunk/debian/rules 2009-10-06 09:55:26 UTC (rev 5396) +++ trunk/openvas-packaging/openvas-libraries/debian/trunk/debian/rules 2009-10-06 10:18:14 UTC (rev 5397) @@ -41,7 +41,7 @@ ifneq "$(wildcard /usr/share/misc/config.guess)" "" cp -f /usr/share/misc/config.guess config.guess endif - ./configure $(CROSS) --prefix=/usr --mandir=\$${prefix}/share/man --infodir=\$${prefix}/share/info --localstatedir=/var CFLAGS="$(CFLAGS)" + ./configure $(CROSS) --prefix=/usr --mandir=\$${prefix}/share/man --infodir=\$${prefix}/share/info --localstatedir=/var --sysconfdir=/etc CFLAGS="$(CFLAGS)" build: build-stamp From scm-commit at wald.intevation.org Tue Oct 6 12:48:26 2009 From: scm-commit at wald.intevation.org (scm-commit@wald.intevation.org) Date: Tue, 6 Oct 2009 12:48:26 +0200 (CEST) Subject: [Openvas-commits] r5398 - in trunk/openvas-scanner: . doc Message-ID: <20091006104826.4C311861EABA@pyrosoma.intevation.org> Author: mwiegand Date: 2009-10-06 12:48:25 +0200 (Tue, 06 Oct 2009) New Revision: 5398 Modified: trunk/openvas-scanner/CHANGES trunk/openvas-scanner/ChangeLog trunk/openvas-scanner/VERSION trunk/openvas-scanner/doc/Doxyfile trunk/openvas-scanner/doc/Doxyfile_full Log: Preparing the openvas-scanner 3.0.0-beta3 release. * VERSION: Set to 3.0.0.beta3 * doc/Doxyfile, doc/Doxyfile_full: Updated PROJECT_NUMBER. * CHANGES: Updated. Modified: trunk/openvas-scanner/CHANGES =================================================================== --- trunk/openvas-scanner/CHANGES 2009-10-06 10:18:14 UTC (rev 5397) +++ trunk/openvas-scanner/CHANGES 2009-10-06 10:48:25 UTC (rev 5398) @@ -1,3 +1,51 @@ +openvas-scanner 3.0.0-beta3 (2009-10-06) + +This release is the third beta version of openvas-scanner +leading up to the upcoming 3.0 release of OpenVAS. +Apart from the name change from openvas-server to +openvas-scanner, the platform-dependent NVTs as +well as the OpenVAS NVT Feed synchronisation script +are now integrated. + +OpenVAS 3.0 will introduce a new architecture where openvas-libraries +now includes openvas-libnasl as well as redundant code from openvas-client +and where openvas-server is renamed to openvas-scanner and includes any +platform-dependent elements of openvas-plugins. As a result of this, +the source code will shrink, though new features will be added. Also, +for running the scanner now only 2 modules are required (instead of 4 +as for OpenVAS 2.0). + +New features of OpenVAS include support for IPv6 and WMI-Clients. +Version 3.0 prepares the new OpenVAS Manager and OpenVAS Administrator +as optional extension. This combination leverages the vulnerability +scanner to a comprehensive vulnerability management solution. + +The "beta" releases are intended to allow testing of the upcoming +3.0 series. It should be kept separate from OpenVAS 2.0 installations +and not be used in a production environment. + +Many thanks to everyone who has contributed to the 3.0.0 release: +Chandrashekhar B, Tim Brown, Javier Fern�ndez-Sanguino Pe�a, +Vlatko Kosturjak, Matthew Mundell, Srinivasa NL, Jan Wagner, +Jan-Oliver Wagner, Michael Wiegand and Felix Wolfsteller. + +Main changes compared to 2.0.x: + +* IPv6 support +* Integration of platform dependent NVTs from openvas-plugins +* Integration of openvas-nvt-sync script +* Renamed daemon from openvasd to openvassd +* glib dependency raised from 2.6 to 2.12 +* openvasd-config removed as no other packages require this + package for building. +* For the same reason, no header files are installed anymore + +Main changes compared to 3.0.0-beta2: + +* Adjustments for the API changes that happened from + openvas-libraries 3.0.0-beta2 to 3.0.0-beta3. + + openvas-scanner 3.0.0-beta2 (2009-09-28) This release is the second beta version of openvas-scanner Modified: trunk/openvas-scanner/ChangeLog =================================================================== --- trunk/openvas-scanner/ChangeLog 2009-10-06 10:18:14 UTC (rev 5397) +++ trunk/openvas-scanner/ChangeLog 2009-10-06 10:48:25 UTC (rev 5398) @@ -1,3 +1,13 @@ +2009-10-06 Michael Wiegand + + Preparing the openvas-scanner 3.0.0-beta3 release. + + * VERSION: Set to 3.0.0.beta3 + + * doc/Doxyfile, doc/Doxyfile_full: Updated PROJECT_NUMBER. + + * CHANGES: Updated. + 2009-10-05 Felix Wolfsteller Removed dependence on libopenvas.h. Modified: trunk/openvas-scanner/VERSION =================================================================== --- trunk/openvas-scanner/VERSION 2009-10-06 10:18:14 UTC (rev 5397) +++ trunk/openvas-scanner/VERSION 2009-10-06 10:48:25 UTC (rev 5398) @@ -1 +1 @@ -3.0.0.beta3.SVN +3.0.0.beta3 Modified: trunk/openvas-scanner/doc/Doxyfile =================================================================== --- trunk/openvas-scanner/doc/Doxyfile 2009-10-06 10:18:14 UTC (rev 5397) +++ trunk/openvas-scanner/doc/Doxyfile 2009-10-06 10:48:25 UTC (rev 5398) @@ -23,7 +23,7 @@ # This could be handy for archiving the generated documentation or # if some version control system is used. -PROJECT_NUMBER = 3.0.0.beta3.SVN +PROJECT_NUMBER = 3.0.0.beta3 # The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute) # base path where the generated documentation will be put. Modified: trunk/openvas-scanner/doc/Doxyfile_full =================================================================== --- trunk/openvas-scanner/doc/Doxyfile_full 2009-10-06 10:18:14 UTC (rev 5397) +++ trunk/openvas-scanner/doc/Doxyfile_full 2009-10-06 10:48:25 UTC (rev 5398) @@ -23,7 +23,7 @@ # This could be handy for archiving the generated documentation or # if some version control system is used. -PROJECT_NUMBER = 3.0.0.beta3.SVN +PROJECT_NUMBER = 3.0.0.beta3 # The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute) # base path where the generated documentation will be put. From scm-commit at wald.intevation.org Tue Oct 6 12:50:55 2009 From: scm-commit at wald.intevation.org (scm-commit@wald.intevation.org) Date: Tue, 6 Oct 2009 12:50:55 +0200 (CEST) Subject: [Openvas-commits] r5399 - tags Message-ID: <20091006105055.08106861EABA@pyrosoma.intevation.org> Author: mwiegand Date: 2009-10-06 12:50:54 +0200 (Tue, 06 Oct 2009) New Revision: 5399 Added: tags/openvas-scanner-release-3.0.0-beta3/ Log: Tagging openvas-scanner 3.0.0-beta3 release. Copied: tags/openvas-scanner-release-3.0.0-beta3 (from rev 5398, trunk/openvas-scanner) From scm-commit at wald.intevation.org Tue Oct 6 12:52:54 2009 From: scm-commit at wald.intevation.org (scm-commit@wald.intevation.org) Date: Tue, 6 Oct 2009 12:52:54 +0200 (CEST) Subject: [Openvas-commits] r5400 - in trunk/openvas-scanner: . doc Message-ID: <20091006105254.4A700865F480@pyrosoma.intevation.org> Author: mwiegand Date: 2009-10-06 12:52:52 +0200 (Tue, 06 Oct 2009) New Revision: 5400 Modified: trunk/openvas-scanner/ChangeLog trunk/openvas-scanner/VERSION trunk/openvas-scanner/doc/Doxyfile trunk/openvas-scanner/doc/Doxyfile_full Log: Post-release version bump. * VERSION: Set to 3.0.0.beta4.SVN. * doc/Doxyfile, doc/Doxyfile_full: Updated PROJECT_NUMBER. Modified: trunk/openvas-scanner/ChangeLog =================================================================== --- trunk/openvas-scanner/ChangeLog 2009-10-06 10:50:54 UTC (rev 5399) +++ trunk/openvas-scanner/ChangeLog 2009-10-06 10:52:52 UTC (rev 5400) @@ -1,5 +1,13 @@ 2009-10-06 Michael Wiegand + Post-release version bump. + + * VERSION: Set to 3.0.0.beta4.SVN. + + * doc/Doxyfile, doc/Doxyfile_full: Updated PROJECT_NUMBER. + +2009-10-06 Michael Wiegand + Preparing the openvas-scanner 3.0.0-beta3 release. * VERSION: Set to 3.0.0.beta3 Modified: trunk/openvas-scanner/VERSION =================================================================== --- trunk/openvas-scanner/VERSION 2009-10-06 10:50:54 UTC (rev 5399) +++ trunk/openvas-scanner/VERSION 2009-10-06 10:52:52 UTC (rev 5400) @@ -1 +1 @@ -3.0.0.beta3 +3.0.0.beta4.SVN Modified: trunk/openvas-scanner/doc/Doxyfile =================================================================== --- trunk/openvas-scanner/doc/Doxyfile 2009-10-06 10:50:54 UTC (rev 5399) +++ trunk/openvas-scanner/doc/Doxyfile 2009-10-06 10:52:52 UTC (rev 5400) @@ -23,7 +23,7 @@ # This could be handy for archiving the generated documentation or # if some version control system is used. -PROJECT_NUMBER = 3.0.0.beta3 +PROJECT_NUMBER = 3.0.0.beta4.SVN # The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute) # base path where the generated documentation will be put. Modified: trunk/openvas-scanner/doc/Doxyfile_full =================================================================== --- trunk/openvas-scanner/doc/Doxyfile_full 2009-10-06 10:50:54 UTC (rev 5399) +++ trunk/openvas-scanner/doc/Doxyfile_full 2009-10-06 10:52:52 UTC (rev 5400) @@ -23,7 +23,7 @@ # This could be handy for archiving the generated documentation or # if some version control system is used. -PROJECT_NUMBER = 3.0.0.beta3 +PROJECT_NUMBER = 3.0.0.beta4.SVN # The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute) # base path where the generated documentation will be put. From scm-commit at wald.intevation.org Tue Oct 6 12:59:30 2009 From: scm-commit at wald.intevation.org (scm-commit@wald.intevation.org) Date: Tue, 6 Oct 2009 12:59:30 +0200 (CEST) Subject: [Openvas-commits] r5401 - trunk/doc/website Message-ID: <20091006105930.891A7865F480@pyrosoma.intevation.org> Author: mwiegand Date: 2009-10-06 12:59:30 +0200 (Tue, 06 Oct 2009) New Revision: 5401 Modified: trunk/doc/website/template_header.m4 Log: Updated version and download link for openvas-scanner 3.0.0-beta. Modified: trunk/doc/website/template_header.m4 =================================================================== --- trunk/doc/website/template_header.m4 2009-10-06 10:52:52 UTC (rev 5400) +++ trunk/doc/website/template_header.m4 2009-10-06 10:59:30 UTC (rev 5401) @@ -178,7 +178,7 @@

	Mandatory	Max Length	Syntax	Example
Name	yes	80	Alphanumeric	Staging webservers
Hosts	yes	80	Comma separated list of IPs and/or hostnames	192.168.1.23, webserv1.mycompany.tld
Comment	no	40	Alphanumeric	Covers both of our web staging systems

Column	Description
Name	Shows name of the target and, + if specificied, the comment in brackets below + the name.
Hosts	The comma separated list of target hosts, specified + either via hostname or IP.
IPs	The total number of IPs that results from the + hosts specification.

	Mandatory	Max Length	Syntax	Example
Task Name	yes	80	Alphanumeric	All Windows desktops in-depth
Scan Type	yes	---	One of the + configured scan configs. +	Full and fast
Scan Targets	yes	---	One of the + configured targets.	The Windows Desktops

Configure Targets

New Target

Targets

Actions

Delete Target

New task

Readily available installation packages