[Openvas-commits] r5567 - in trunk/openvas-plugins: . scripts
scm-commit@wald.intevation.org
scm-commit at wald.intevation.org
Thu Oct 15 20:15:01 CEST 2009
Author: mime
Date: 2009-10-15 20:14:59 +0200 (Thu, 15 Oct 2009)
New Revision: 5567
Added:
trunk/openvas-plugins/plugins_current.txt
trunk/openvas-plugins/scripts/dopewars_server_36606.nasl
trunk/openvas-plugins/scripts/femitter_httpd_36656.nasl
trunk/openvas-plugins/scripts/samba_multiple_vulnerabilities.nasl
Modified:
trunk/openvas-plugins/ChangeLog
trunk/openvas-plugins/scripts/cvspserver_version.nasl
trunk/openvas-plugins/scripts/photopost_detect.nasl
trunk/openvas-plugins/scripts/secpod_ms09-050-remote.nasl
Log:
Added new plugins
Modified: trunk/openvas-plugins/ChangeLog
===================================================================
--- trunk/openvas-plugins/ChangeLog 2009-10-15 18:06:59 UTC (rev 5566)
+++ trunk/openvas-plugins/ChangeLog 2009-10-15 18:14:59 UTC (rev 5567)
@@ -1,3 +1,20 @@
+2009-10-15 Michael Meyer <michael.meyer at intevation.de>
+
+ * plugins_current.txt:
+ Added new file.
+
+ * scripts/femitter_httpd_36656.nasl,
+ scripts/samba_multiple_vulnerabilities.nasl,
+ scripts/dopewars_server_36606.nasl:
+ Added new plugins.
+
+ * scripts/secpod_ms09-050-remote.nasl:
+ Added check to make sure it is SMBv2.
+
+ * scripts/photopost_detect.nasl,
+ scripts/cvspserver_version.nasl:
+ Merged with plugins from LSS.
+
2009-10-15 Chandrashekhar B <bchandra at secpod.com>
* scripts/secpod_ms09-061.nasl:
Added: trunk/openvas-plugins/plugins_current.txt
===================================================================
--- trunk/openvas-plugins/plugins_current.txt 2009-10-15 18:06:59 UTC (rev 5566)
+++ trunk/openvas-plugins/plugins_current.txt 2009-10-15 18:14:59 UTC (rev 5567)
@@ -0,0 +1,14 @@
+This document is intended to maintain the Plugins (excluding plugins
+for CVE/BID. Use cve_current.txt instead) that are currently being
+implemented by NASL developers.
+
+Procedure:
+1. Before taking up for implementation, update this file to indicate that
+ it is being worked
+2. Before committing the plugin to SVN, change status to "svn".
+
+NVT Owner Status
+smb_enum_services.nasl LSS
+msrpc_dcom2.nasl LSS
+poptop_negative_read.nasl Greenbone
+
Modified: trunk/openvas-plugins/scripts/cvspserver_version.nasl
===================================================================
--- trunk/openvas-plugins/scripts/cvspserver_version.nasl 2009-10-15 18:06:59 UTC (rev 5566)
+++ trunk/openvas-plugins/scripts/cvspserver_version.nasl 2009-10-15 18:14:59 UTC (rev 5567)
@@ -6,9 +6,10 @@
#
# Authors:
# Michael Meyer
+# LSS Security Team <http://security.lss.hr>
#
# Copyright:
-# Copyright (c) 2009 Greenbone Networks GmbH
+# Copyright (c) 2009 Greenbone Networks GmbH / LSS <http://www.lss.hr>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2
@@ -40,7 +41,7 @@
script_summary("Set Version of CVS pserver in KB");
script_category(ACT_GATHER_INFO);
script_family("Service detection");
- script_copyright("This script is Copyright (C) 2009 Greenbone Networks GmbH");
+ script_copyright("This script is Copyright (C) 2009 Greenbone Networks GmbH / LSS");
script_dependencies("find_service.nes");
script_require_ports("Services/cvspserver", 2401);
exit(0);
@@ -50,9 +51,106 @@
if(!port)port = 2401;
if(!get_port_state(port))exit(0);
+function scramble(pass) {
+# see http://www.delorie.com/gnu/docs/cvs/cvsclient_4.html
+# for scramble information
+
+ local_var x, scrambled, c;
+
+# character substitution table
+ c[33] = 120; # !
+ c[34] = 53; # "
+ c[37] = 109; # %
+ c[38] = 72; # &
+ c[39] = 108; # '
+ c[40] = 70; # (
+ c[41] = 64; # )
+ c[42] = 76; # *
+ c[43] = 67; # +
+ c[44] = 116; # ,
+ c[45] = 74; # -
+ c[46] = 68; # .
+ c[47] = 87; # /
+ c[48] = 111; # 0
+ c[49] = 52; # 1
+ c[50] = 75; # 2
+ c[51] = 119; # 3
+ c[52] = 49; # 4
+ c[53] = 34; # 5
+ c[54] = 82; # 6
+ c[55] = 81; # 7
+ c[56] = 95; # 8
+ c[57] = 65; # 9
+ c[58] = 112; # :
+ c[59] = 86; # ;
+ c[60] = 118; # <
+ c[61] = 110; # =
+ c[62] = 122; # >
+ c[63] = 105; # ?
+ c[65] = 57; # A
+ c[66] = 83; # B
+ c[67] = 43; # C
+ c[68] = 46; # D
+ c[69] = 102; # E
+ c[70] = 40; # F
+ c[71] = 89; # G
+ c[72] = 38; # H
+ c[73] = 103; # I
+ c[74] = 45; # J
+ c[75] = 50; # K
+ c[76] = 42; # L
+ c[77] = 123; # M
+ c[78] = 91; # N
+ c[79] = 35; # O
+ c[80] = 125; # P
+ c[81] = 55; # Q
+ c[82] = 54; # R
+ c[83] = 66; # S
+ c[84] = 124; # T
+ c[85] = 126; # U
+ c[86] = 59; # V
+ c[87] = 47; # W
+ c[88] = 92; # X
+ c[89] = 71; # Y
+ c[90] = 115; # Z
+ c[95] = 56; # _
+ c[97] = 121; # a
+ c[98] = 117; # b
+ c[99] = 104; # c
+ c[100] = 101; # d
+ c[101] = 100; # e
+ c[102] = 69; # f
+ c[103] = 73; # g
+ c[104] = 99; # h
+ c[105] = 63; # i
+ c[106] = 94; # j
+ c[107] = 93; # k
+ c[108] = 39; # l
+ c[109] = 37; # m
+ c[110] = 61; # n
+ c[111] = 48; # o
+ c[112] = 58; # p
+ c[113] = 113; # q
+ c[114] = 32; # r
+ c[115] = 90; # s
+ c[116] = 44; # t
+ c[117] = 98; # u
+ c[118] = 60; # v
+ c[119] = 51; # w
+ c[120] = 33; # x
+ c[121] = 97; # y
+ c[122] = 62; # z
+
+ for (x=0; x<strlen(pass); x++) {
+ scrambled += raw_string(c[ord(pass[x])]);
+ }
+
+return scrambled;
+}
+
logins = make_list("anonymous", "anoncvs");
passwords = make_list("","anoncvs", "anon");
-dirs = make_list("/var/lib/cvsd/","/cvs", "/cvsroot", "/home/ncvs", "/usr/local/cvs");
+dirs = make_list("/var/lib/cvsd/","/cvs", "/cvsroot", "/home/ncvs", "/usr/local/cvs","/u/cvs","/usr/local/cvsroot");
foreach dir (dirs) {
foreach login (logins) {
@@ -61,7 +159,7 @@
soc = open_sock_tcp(port);
if(!soc)exit(0);
- req = string("BEGIN AUTH REQUEST\n", dir, "\n", login,"\n", "A", pass,"\n", "END AUTH REQUEST\n");
+ req = string("BEGIN AUTH REQUEST\n", dir, "\n", login,"\n", "A", scramble(password),"\n", "END AUTH REQUEST\n");
send(socket:soc, data:req);
buf = recv_line(socket:soc, length:4096);
Added: trunk/openvas-plugins/scripts/dopewars_server_36606.nasl
===================================================================
--- trunk/openvas-plugins/scripts/dopewars_server_36606.nasl 2009-10-15 18:06:59 UTC (rev 5566)
+++ trunk/openvas-plugins/scripts/dopewars_server_36606.nasl 2009-10-15 18:14:59 UTC (rev 5567)
@@ -0,0 +1,91 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id$
+#
+# Dopewars Server 'REQUESTJET' Message Remote Denial of Service Vulnerability
+#
+# Authors:
+# Michael Meyer
+#
+# Copyright:
+# Copyright (c) 2009 Greenbone Networks GmbH
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if (description)
+{
+ script_id(100305);
+ script_bugtraq_id(36606);
+ script_version ("1.0-$Revision$");
+
+ script_name("Dopewars Server 'REQUESTJET' Message Remote Denial of Service Vulnerability");
+
+desc = "Overview:
+Dopewars is prone to a denial-of-service vulnerability that affects
+the server part of the application.
+
+An attacker can exploit this issue to crash the affected application,
+denying service to legitimate users.
+
+This issue affects Dopewars 1.5.12; other versions may also be
+affected.
+
+Solution:
+Fixes are available in the SVN repository. Please see the references
+for details.
+
+References:
+http://www.securityfocus.com/bid/36606
+http://dopewars.sourceforge.net/
+http://dopewars.svn.sourceforge.net/viewvc/dopewars?view=rev&revision=1033
+
+Risk factor : Low";
+
+ script_description(desc);
+ script_summary("Determine if Dopewars is prone to a dos vulnerability");
+ script_category(ACT_GATHER_INFO);
+ script_family("Denial of Service");
+ script_copyright("This script is Copyright (C) 2009 Greenbone Networks GmbH");
+ script_dependencies("find_service.nes");
+ script_require_ports("Services/unknown", 7902);
+ exit(0);
+}
+
+include("version_func.inc");
+
+port = 7902;
+if(!get_port_state(port))exit(0);
+
+soc = open_sock_tcp(port);
+if(!soc)exit(0);
+
+req = string("OpenVAS^^Ar1111111\n^^AcOpenVAS\n");
+send(socket:soc, data:req);
+buf = recv(socket:soc, length:50);
+
+if(!buf)exit(0);
+
+if("^" >< buf[0]) {
+ if(!version = eregmatch(pattern:"\^Ak([0-9.]+)\^",string:buf))exit(0);
+ if(isnull(version[1]))exit(0);
+
+ if(version_is_equal(version:version[1], test_version: "1.5.12")) {
+ security_warning(port:port);
+ exit(0);
+ }
+}
+exit(0);
+
+
Property changes on: trunk/openvas-plugins/scripts/dopewars_server_36606.nasl
___________________________________________________________________
Name: svn:keywords
+ Id Revision
Added: trunk/openvas-plugins/scripts/femitter_httpd_36656.nasl
===================================================================
--- trunk/openvas-plugins/scripts/femitter_httpd_36656.nasl 2009-10-15 18:06:59 UTC (rev 5566)
+++ trunk/openvas-plugins/scripts/femitter_httpd_36656.nasl 2009-10-15 18:14:59 UTC (rev 5567)
@@ -0,0 +1,105 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id$
+#
+# Acritum Femitter Server HTTP Request Remote File Disclosure Vulnerability
+#
+# Authors:
+# Michael Meyer
+#
+# Copyright:
+# Copyright (c) 2009 Greenbone Networks GmbH
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if (description)
+{
+ script_id(100304);
+ script_bugtraq_id(36656);
+ script_version ("1.0-$Revision$");
+
+ script_name("Acritum Femitter Server HTTP Request Remote File Disclosure Vulnerability");
+
+desc = "Overview:
+Acritum Femitter Server is prone to a remote file-disclosure
+vulnerability because it fails to properly sanitize user-
+supplied input.
+
+An attacker can exploit this vulnerability to view the source code of
+the files in the context of the server process. This may aid in
+further attacks.
+
+Acritum Femitter Server 1.03 is affected; other versions may be
+vulnerable as well.
+
+References:
+http://www.securityfocus.com/bid/36656
+http://www.acritum.com/fem/index.htm
+
+Risk factor : Medium";
+
+ script_description(desc);
+ script_summary("Determine if Femitter HTTP Server is prone to a remote file-disclosure vulnerability.");
+ script_category(ACT_GATHER_INFO);
+ script_family("Web Servers");
+ script_copyright("This script is Copyright (C) 2009 Greenbone Networks GmbH");
+ script_dependencies("find_service.nes", "http_version.nasl","webmirror.nasl");
+ script_require_ports("Services/www", 80);
+ script_exclude_keys("Settings/disable_cgi_scanning");
+ exit(0);
+}
+
+include("http_func.inc");
+include("http_keepalive.inc");
+
+port = get_http_port(default:80);
+if(!get_port_state(port))exit(0);
+
+files = get_kb_list(string("www/", port, "/content/extensions/htm*"));
+if(!files) {
+ file = "/index.htm";
+} else {
+ files = make_list(files);
+ file = files[0];
+}
+
+url = string(file);
+req = http_get(item:url, port:port);
+buf = http_keepalive_send_recv(port:port, data:req, bodyonly:FALSE);
+if( buf == NULL )continue;
+
+if(egrep(pattern: "Content-Type", string: buf, icase: TRUE)) {
+
+ content_typ = eregmatch(pattern:"Content-Type: ([a-zA-Z/-]+)",string:buf);
+
+ if(content_typ) {
+
+ url = string(file,".");
+ req = http_get(item:url, port:port);
+ buf = http_keepalive_send_recv(port:port, data:req, bodyonly:FALSE);
+ if( buf == NULL )continue;
+
+ if(egrep(pattern: "Content-Type", string: buf, icase: TRUE)) {
+ content_typ1 = eregmatch(pattern:"Content-Type: ([a-zA-Z/-]+)",string:buf);
+ if(content_typ[1] >!< content_typ1[1] && "application/binary" >< content_typ1[1]) {
+ security_warning(port:port);
+ exit(0);
+ }
+ }
+ }
+}
+
+exit(0);
+
Property changes on: trunk/openvas-plugins/scripts/femitter_httpd_36656.nasl
___________________________________________________________________
Name: svn:keywords
+ Id Revision
Modified: trunk/openvas-plugins/scripts/photopost_detect.nasl
===================================================================
--- trunk/openvas-plugins/scripts/photopost_detect.nasl 2009-10-15 18:06:59 UTC (rev 5566)
+++ trunk/openvas-plugins/scripts/photopost_detect.nasl 2009-10-15 18:14:59 UTC (rev 5567)
@@ -5,10 +5,11 @@
# Photopost Detection
#
# Authors:
+# LSS Security Team <http://security.lss.hr>
# Michael Meyer
#
# Copyright:
-# Copyright (c) 2009 Greenbone Networks GmbH
+# Copyright (c) 2009 LSS <http://www.lss.hr> / Greenbone Networks GmbH
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2
@@ -43,14 +44,13 @@
script_summary("Checks for the presence of Photopost");
script_category(ACT_GATHER_INFO);
script_family("Service detection");
- script_copyright("This script is Copyright (C) 2009 Greenbone Networks GmbH");
+ script_copyright("This script is Copyright (C) 2009 LSS / Greenbone Networks GmbH");
script_dependencies("find_service.nes", "http_version.nasl");
script_require_ports("Services/www", 80);
script_exclude_keys("Settings/disable_cgi_scanning");
exit(0);
}
-
include("http_func.inc");
include("http_keepalive.inc");
include("global_settings.inc");
@@ -60,46 +60,46 @@
if(!get_port_state(port))exit(0);
if(!can_host_php(port:port))exit(0);
-dirs = make_list("/photopost","/photos","/gallery",cgi_dirs());
+dirs = make_list("/photopost","/photos","/gallery","/photo",cgi_dirs());
-foreach dir (dirs) {
+foreach dir (dirs)
+{
+ # Grab index.php
+ url = string(dir, "/index.php");
+ req = http_send_recv(data:http_get(item:url, port:port), port:port);
+ if(isnull(req)) exit(0);
- url = string(dir, "/index.php");
- req = http_get(item:url, port:port);
- buf = http_keepalive_send_recv(port:port, data:req, bodyonly:TRUE);
- if( buf == NULL )continue;
+ # Check if it is PhotoPost
+ match=egrep(pattern:'Powered by[^>]*>(<font[^>]*>)?PhotoPost',string:req, icase:1);
+ if(match) {
+ # If PhotoPost detected, try different grep to extract version
+ match=egrep(pattern:'Powered by[^>]*>(<font[^>]*>)?PhotoPost.*PHP ([0-9.a-z]+)',string:req, icase:1);
+ if(match)
+ item=eregmatch(pattern:'Powered by[^>]*>(<font[^>]*>)?PhotoPost.*PHP ([0-9.a-z]+)',string:match, icase:1);
+ ver=item[2];
- if(egrep(pattern: "<a [^>]+>Photo Sharing Gallery by PhotoPost", string: buf, icase: TRUE) &&
- egrep(pattern: "Copyright.*All Enthusiast, Inc", string: buf, icase: TRUE)
- )
- {
- if(strlen(dir)>0) {
- install=dir;
- } else {
- install=string("/");
- }
+ # If version couldn't be extracted, mark as unknown
+ if(!ver) ver="unknown";
- vers = string("unknown");
+ # PhotoPost installation found
+ set_kb_item(name:string("www/", port, "/photopost"),value:string(ver, " under ", dir));
+ if(report_verbosity) {
+ if(dir=="") dir="/";
+ info+=ver + " under " + dir + '\n';
+ }
+ n++;
+ if(!thorough_tests) break;
+ }
+}
- set_kb_item(name: string("www/", port, "/photopost"), value: string(vers," under ",install));
+if(!n) exit(0);
- info = string("None\n\nPhotoPost Version '");
- info += string(vers);
- info += string("' was detected on the remote host in the following directory(s):\n\n");
- info += string(install, "\n");
+if(report_verbosity) {
+ info='\n\n' + "The following version(s) of PhotoPost were detected: " + '\n\n'+info;
+ desc+=info;
+ security_note(port:port, data:desc);
+ exit(0);
+}
- desc = ereg_replace(
- string:desc,
- pattern:"None$",
- replace:info
- );
-
- if(report_verbosity > 0) {
- security_note(port:port,data:desc);
- }
- exit(0);
-
- }
-}
exit(0);
Added: trunk/openvas-plugins/scripts/samba_multiple_vulnerabilities.nasl
===================================================================
--- trunk/openvas-plugins/scripts/samba_multiple_vulnerabilities.nasl 2009-10-15 18:06:59 UTC (rev 5566)
+++ trunk/openvas-plugins/scripts/samba_multiple_vulnerabilities.nasl 2009-10-15 18:14:59 UTC (rev 5567)
@@ -0,0 +1,99 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id$
+#
+# Samba multiple vulnerabilities
+#
+# Authors:
+# Michael Meyer
+#
+# Copyright:
+# Copyright (c) 2009 Greenbone Networks GmbH
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if (description)
+{
+ script_id(100306);
+ script_bugtraq_id(36363,36572,36573);
+ script_cve_id("CVE-2009-2813","CVE-2009-2948","CVE-2009-2906");
+ script_version ("1.0-$Revision$");
+
+ script_name("Samba multiple vulnerabilities");
+
+desc = "Overview:
+Samba is prone to multiple vulnerabilities including a vulnerability
+that may allow attackers to bypass certain security restrictions, an
+information-disclosure vulnerability and a remote denial-of-service
+vulnerability.
+
+Successful exploits may allow attackers to gain access to resources
+that aren't supposed to be shared, allow attackers to obtain sensitive
+information that may aid in further attacks and to cause the
+application to consume excessive CPU resources, denying service to
+legitimate users.
+
+Versions prior to Samba 3.4.2, 3.3.8, 3.2.15, and 3.0.37 are
+vulnerable.
+
+Solution:
+Updates are available. Please see the references for more information.
+
+References:
+http://www.securityfocus.com/bid/36363
+http://www.securityfocus.com/bid/36573
+http://www.securityfocus.com/bid/36572
+http://www.samba.org/samba/security/CVE-2009-2813.html
+http://www.samba.org/samba/security/CVE-2009-2948.html
+http://www.samba.org/samba/security/CVE-2009-2906.html
+http://www.samba.org/samba/history/security.html
+http://us1.samba.org/samba/
+
+Risk factor : Medium";
+
+ script_description(desc);
+ script_summary("Determine if Samba is prone to multiple vulnerabilities");
+ script_category(ACT_GATHER_INFO);
+ script_family("General");
+ script_copyright("This script is Copyright (C) 2009 Greenbone Networks GmbH");
+ script_dependencies("smb_nativelanman.nasl");
+ script_require_ports(139, 445);
+ script_require_keys("SMB/NativeLanManager");
+ exit(0);
+}
+
+include("version_func.inc");
+
+port = get_kb_item("SMB/transport");
+if(!port)port = 139;
+
+if(!get_port_state(port))exit(0);
+
+if(!lanman = get_kb_item("SMB/NativeLanManager"))exit(0);
+if("Samba" >!< lanman)exit(0);
+
+if(!version = eregmatch(pattern:"Samba ([0-9.]+)", string: lanman))exit(0);
+if(isnull(version[1]))exit(0);
+
+if(version_in_range(version:version[1], test_version:"3.4", test_version2: "3.4.1") ||
+ version_in_range(version:version[1], test_version:"3.3", test_version2: "3.3.7") ||
+ version_in_range(version:version[1], test_version:"3.2", test_version2: "3.2.14") ||
+ version_in_range(version:version[1], test_version:"3.0", test_version2: "3.0.36"))
+ {
+ security_warning(port:port);
+ exit(0);
+ }
+
+exit(0);
Property changes on: trunk/openvas-plugins/scripts/samba_multiple_vulnerabilities.nasl
___________________________________________________________________
Name: svn:keywords
+ Id Revision
Modified: trunk/openvas-plugins/scripts/secpod_ms09-050-remote.nasl
===================================================================
--- trunk/openvas-plugins/scripts/secpod_ms09-050-remote.nasl 2009-10-15 18:06:59 UTC (rev 5566)
+++ trunk/openvas-plugins/scripts/secpod_ms09-050-remote.nasl 2009-10-15 18:14:59 UTC (rev 5567)
@@ -100,7 +100,11 @@
send(socket: soc, data: data);
resp = smb_recv(socket:soc, length:1024);
-if(ord(resp[5]) == 83 && ord(resp[6]) == 77 && ord(resp[7]) == 66 && ord(resp[8]) == 114)
+# '0xff' -> SMBv1 - Windows XP Profesional, Version 202, SP3
+# '0xff' -> SMBv1 - Samba 3.0.33
+# '0xfe' -> SMBv2 - Windows Server at enterprise (2008), SP
+
+if(ord(resp[4]) == 254 && ord(resp[5]) == 83 && ord(resp[6]) == 77 && ord(resp[7]) == 66 && ord(resp[8]) == 114)
{
security_hole(port);
}
More information about the Openvas-commits
mailing list