[Openvas-commits] r8272 - in trunk/openvas-plugins: . scripts
scm-commit@wald.intevation.org
scm-commit at wald.intevation.org
Fri Jul 2 08:02:17 CEST 2010
Author: chandra
Date: 2010-07-02 08:02:13 +0200 (Fri, 02 Jul 2010)
New Revision: 8272
Added:
trunk/openvas-plugins/scripts/secpod_ibm_was_xss_vuln.nasl
trunk/openvas-plugins/scripts/secpod_mozilla_firefox_spoofing_vuln_win_jun10.nasl
trunk/openvas-plugins/scripts/secpod_opera_spoofing_vuln_win.nasl
trunk/openvas-plugins/scripts/secpod_sascam_webcam_server_dos_vuln.nasl
trunk/openvas-plugins/scripts/secpod_titan_ftp_server_dir_trav_vuln.nasl
Modified:
trunk/openvas-plugins/ChangeLog
Log:
Added new plugins
Modified: trunk/openvas-plugins/ChangeLog
===================================================================
--- trunk/openvas-plugins/ChangeLog 2010-07-01 20:07:08 UTC (rev 8271)
+++ trunk/openvas-plugins/ChangeLog 2010-07-02 06:02:13 UTC (rev 8272)
@@ -1,5 +1,14 @@
2010-07-01 Chandrashekhar B <bchandra at secpod.com>
+ * scripts/secpod_opera_spoofing_vuln_win.nasl,
+ scripts/secpod_ibm_was_xss_vuln.nasl,
+ scripts/secpod_mozilla_firefox_spoofing_vuln_win_jun10.nasl,
+ scripts/secpod_titan_ftp_server_dir_trav_vuln.nasl,
+ scripts/secpod_sascam_webcam_server_dos_vuln.nasl:
+ Added new plugins.
+
+2010-07-01 Chandrashekhar B <bchandra at secpod.com>
+
* scripts/secpod_mozilla_prdts_iframe_dos_vuln_win.nasl,
scripts/secpod_mozilla_prdts_mult_vuln_win_jun10.nasl,
scripts/secpod_ms_ie_iframe_info_disc_vuln_june10.nasl,
Added: trunk/openvas-plugins/scripts/secpod_ibm_was_xss_vuln.nasl
===================================================================
--- trunk/openvas-plugins/scripts/secpod_ibm_was_xss_vuln.nasl 2010-07-01 20:07:08 UTC (rev 8271)
+++ trunk/openvas-plugins/scripts/secpod_ibm_was_xss_vuln.nasl 2010-07-02 06:02:13 UTC (rev 8272)
@@ -0,0 +1,92 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: secpod_ibm_was_xss_vuln.nasl 9883 2010-06-29 22:35:33Z jun $
+#
+# IBM WebSphere Application Server (WAS) Cross-site Scripting Vulnerability
+#
+# Authors:
+# Antu Sanadi <santu at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2010 SecPod, http://www.secpod.com
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+ script_id(902213);
+ script_version("$Revision$: 1.0");
+ script_cve_id("CVE-2010-0778","CVE-2010-0779");
+ script_tag(name:"cvss_base", value:"4.3");
+ script_tag(name:"risk_factor", value:"Medium");
+ script_name("IBM WebSphere Application Server (WAS) Cross-site Scripting Vulnerability");
+ desc = "
+ Overview:
+ The host is running IBM WebSphere Application Server and is prone to Cross-site
+ Scripting vulnerability.
+
+ Vulnerability Insight:
+ The flaw is caused due to an error in the Administration Console, which
+ allows remote attackers to inject arbitrary web script or HTML via
+ unspecified vectors.
+
+ Impact:
+ Successful exploitation will let attackers to conduct Cross-site scripting
+ attacks.
+
+ Impact Level: Application
+
+ Affected Software/OS:
+ IBM WAS Version 6.0 before 6.0.2.43, 6.1 before 6.1.0.33 and 7.0 before 7.0.0.11
+
+ Fix: Upgrade to IBM WAS version 6.0.2.43, 6.1.0.33 or 7.0.0.11,
+ For updates refer, http://www.ibm.com/developerworks/downloads/ws/was/
+
+ References:
+ http://vul.hackerjournals.com/?p=10207
+ http://en.securitylab.ru/nvd/395192.php
+ http://xforce.iss.net/xforce/xfdb/59646
+ http://xforce.iss.net/xforce/xfdb/59647
+ ";
+
+ script_description(desc);
+ script_summary("Check for the version of IBM WebSphere Application Server");
+ script_category(ACT_GATHER_INFO);
+ script_copyright("Copyright (c) 2010 SecPod");
+ script_family("Web Servers");
+ script_dependencies("gb_ibm_websphere_detect.nasl");
+ script_require_ports("Services/www", 80);
+ exit(0);
+}
+
+
+include("http_func.inc");
+include("version_func.inc");
+
+port = get_http_port(default:80);
+if(!get_port_state(port)){
+ exit(0);
+}
+
+vers = get_kb_item(string("www/", port, "/websphere_application_server"));
+if(isnull(vers)){
+ exit(0);
+}
+
+if(version_in_range(version: vers, test_version: "7.0", test_version2:"7.0.0.10") ||
+ version_in_range(version: vers, test_version: "6.0", test_version2:"6.0.2.42") ||
+ version_in_range(version: vers, test_version: "6.1", test_version2:"6.1.0.32")){
+ security_warning(port:port);
+}
Property changes on: trunk/openvas-plugins/scripts/secpod_ibm_was_xss_vuln.nasl
___________________________________________________________________
Name: svn:executable
+ *
Name: svn:keywords
+ Revision
Added: trunk/openvas-plugins/scripts/secpod_mozilla_firefox_spoofing_vuln_win_jun10.nasl
===================================================================
--- trunk/openvas-plugins/scripts/secpod_mozilla_firefox_spoofing_vuln_win_jun10.nasl 2010-07-01 20:07:08 UTC (rev 8271)
+++ trunk/openvas-plugins/scripts/secpod_mozilla_firefox_spoofing_vuln_win_jun10.nasl 2010-07-02 06:02:13 UTC (rev 8272)
@@ -0,0 +1,84 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: secpod_mozilla_firefox_spoofing_vuln_win_jun10.nasl 2010-06-29 22:35:33Z jun $
+#
+# Mozilla Firefox Address Bar Spoofing Vulnerability june-10 (Win)
+#
+# Authors:
+# Antu Sanadi <santu at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2010 SecPod, http://www.secpod.com
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+ script_id(902209);
+ script_version("$Revision$: 1.0");
+ script_cve_id("CVE-2010-1206");
+ script_tag(name:"cvss_base", value:"4.3");
+ script_tag(name:"risk_factor", value:"Medium");
+ script_name("Mozilla Firefox Address Bar Spoofing Vulnerability june-10 (Win)");
+ desc = "
+ Overview:
+ The host is installed with Mozilla Firefox and is prone to spoofing
+ vulnerability.
+
+ Vulnerability Insight:
+ The flaw is caused due to error in the 'startDocumentLoad()' function in
+ 'browser/base/content/browser.js', fails to implement Same Origin Policy.
+ This can be exploited to display arbitrary content in the blank document
+ while showing the URL of a trusted web site in the address bar.
+
+ Impact:
+ Successful exploitation will let attackers to conduct spoofing attacks.
+
+ Impact Level: Application
+
+ Affected Software/OS:
+ Firefox version before 3.6.6
+
+ Fix:
+ Upgrade to Firefox version 3.6.6 or later,
+ http://www.mozilla.com/en-US/firefox/all.html
+
+ References:
+ http://secunia.com/advisories/40283
+ http://hg.mozilla.org/mozilla-central/rev/cadddabb1178
+ http://lcamtuf.blogspot.com/2010/06/yeah-about-that-address-bar-thing.html ";
+
+ script_description(desc);
+ script_summary("Check for the version of Mozilla Firefox");
+ script_category(ACT_GATHER_INFO);
+ script_copyright("Copyright (c) 2010 SecPod");
+ script_family("General");
+ script_dependencies("gb_firefox_detect_win.nasl");
+ script_require_keys("Firefox/Win/Ver");
+ exit(0);
+}
+
+
+include("version_func.inc");
+
+# Firefox Check
+ffVer = get_kb_item("Firefox/Win/Ver");
+if(ffVer)
+{
+ # Grep for Firefox version < 3.6.6
+ if(version_is_less(version:ffVer, test_version:"3.6.6")){
+ security_hole(0);
+ }
+}
Property changes on: trunk/openvas-plugins/scripts/secpod_mozilla_firefox_spoofing_vuln_win_jun10.nasl
___________________________________________________________________
Name: svn:executable
+ *
Name: svn:keywords
+ Revision
Added: trunk/openvas-plugins/scripts/secpod_opera_spoofing_vuln_win.nasl
===================================================================
--- trunk/openvas-plugins/scripts/secpod_opera_spoofing_vuln_win.nasl 2010-07-01 20:07:08 UTC (rev 8271)
+++ trunk/openvas-plugins/scripts/secpod_opera_spoofing_vuln_win.nasl 2010-07-02 06:02:13 UTC (rev 8272)
@@ -0,0 +1,83 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: secpod_opera_spoofing_vuln_win.nasl 9922 2010-06-30 15:21:47Z jun $
+#
+# Opera Browser Address Bar Spoofing Vulnerability june-10 (Win)
+#
+# Authors:
+# Antu Sanadi <santu at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2010 SecPod, http://www.secpod.com
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+ script_id(902216);
+ script_version("$Revision$: 1.0");
+ script_cve_id("CVE-2010-2455");
+ script_tag(name:"cvss_base", value:"4.3");
+ script_tag(name:"risk_factor", value:"Medium");
+ script_name("Opera Browser Address Bar Spoofing Vulnerability june-10 (Win)");
+ desc = "
+ Overview: The host is installed with Opera Web Browser and is prone to
+ spoofing vulnerability.
+
+ Vulnerability Insight:
+ The flaw is caused due to an error in handling of address bar, which does
+ not properly manage the address bar between the request to open a URL and
+ the retrieval of the new document's content.
+
+ Impact:
+ Successful exploitation will let attackers to conduct spoofing attacks via a
+ crafted HTML document.
+
+ Impact Level: Application
+
+ Affected Software/OS:
+ Opera version 10.54 and prior on Windows.
+
+ Fix: No solution or patch is available as on 30th June 2010, Information
+ regarding this issue will be updated once the solution details are available.
+ For updates refer, http://www.opera.com/download/?os=windows&list=all
+
+ References:
+ https://bugzilla.mozilla.org/show_bug.cgi?id=556957
+ http://lcamtuf.blogspot.com/2010/06/yeah-about-that-address-bar-thing.html ";
+
+ script_description(desc);
+ script_summary("Check for the version of Opera Web Browser");
+ script_category(ACT_GATHER_INFO);
+ script_copyright("Copyright (c) 2010 SecPod");
+ script_family("General");
+ script_dependencies("secpod_opera_detection_win_900036.nasl");
+ script_require_keys("Opera/Win/Version");
+ exit(0);
+}
+
+
+include("version_func.inc");
+
+## Get Opera version from from KB list
+operaVer = get_kb_item("Opera/Win/Version");
+if(!operaVer){
+ exit(0);
+}
+
+## Check if version is lesser than 10.54
+if(version_is_less_equal(version:operaVer, test_version:"10.54")){
+ security_warning(0);
+}
Property changes on: trunk/openvas-plugins/scripts/secpod_opera_spoofing_vuln_win.nasl
___________________________________________________________________
Name: svn:executable
+ *
Name: svn:keywords
+ Revision
Added: trunk/openvas-plugins/scripts/secpod_sascam_webcam_server_dos_vuln.nasl
===================================================================
--- trunk/openvas-plugins/scripts/secpod_sascam_webcam_server_dos_vuln.nasl 2010-07-01 20:07:08 UTC (rev 8271)
+++ trunk/openvas-plugins/scripts/secpod_sascam_webcam_server_dos_vuln.nasl 2010-07-02 06:02:13 UTC (rev 8272)
@@ -0,0 +1,104 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: secpod_sascam_webcam_server_dos_vuln.nasl 9952 2010-06-30 12:12:12Z jun $
+#
+# SasCAM Request Processing Denial of Service Vulnerability
+#
+# Authors:
+# Sooraj KS <kssooraj at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2010 SecPod, http://www.secpod.com
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+ script_id(901132);
+ script_version("$Revision$: 1.0");
+ script_cve_id("CVE-2010-2505");
+ script_tag(name:"cvss_base", value:"5.0");
+ script_tag(name:"risk_factor", value:"Medium");
+ script_name("SasCAM Request Processing Denial of Service Vulnerability");
+ desc = "
+ Overview: This host is running SasCam Webcam Server and is prone to denial
+ of service vulnerability.
+
+ Vulnerability Insight:
+ The flaw is caused due to an error when handling certain requests, which
+ can be exploited to block processing of further requests and terminate the
+ application by sending specially crafted requests.
+
+ Impact:
+ Successful exploitation will let the attacker to crash the server process,
+ resulting in a denial-of-service condition.
+
+ Impact Level: Application
+
+ Affected Software/OS:
+ Soft SaschArt SasCAM Webcam Server 2.7 and prior
+
+ Fix: No solution or patch is available as on 30th June, 2010. Information
+ regarding this issue will be updated once the solution details are available.
+ For updates refer, http://soft.saschart.com/sascam_webcam_server.php
+
+ References:
+ http://secunia.com/advisories/40214
+ http://www.exploit-db.com/exploits/13888
+ ";
+
+ script_description(desc);
+ script_summary("Determine if SasCAM Webcam Server is prone to a denial-of-service vulnerability");
+ script_category(ACT_DENIAL);
+ script_copyright("Copyright (C) 2010 SecPod");
+ script_family("Denial of Service");
+ script_dependencies("find_service.nes");
+ script_require_ports("Services/www", 8080);
+ exit(0);
+}
+
+
+include("http_func.inc");
+
+## Get HTTP Port
+port = get_http_port(default:8080);
+if(!port) {
+ exit(0);
+}
+
+banner = get_http_banner(port:port);
+
+## Confirm Application
+if("Server: SaServer" >< banner)
+{
+ ## Open Socket
+ sock = http_open_socket(port);
+ if(!sock) {
+ exit(0);
+ }
+
+ ## Sending Crash
+ crash = http_get( item:"/"+ crap(99999), port:port);
+ send(socket:sock, data:crash);
+ http_close_socket(sock);
+
+ ## Check Port Status
+ if (http_is_dead(port: port))
+ {
+ security_warning(port);
+ exit(0);
+ }
+}
+
Property changes on: trunk/openvas-plugins/scripts/secpod_sascam_webcam_server_dos_vuln.nasl
___________________________________________________________________
Name: svn:keywords
+ Revision
Added: trunk/openvas-plugins/scripts/secpod_titan_ftp_server_dir_trav_vuln.nasl
===================================================================
--- trunk/openvas-plugins/scripts/secpod_titan_ftp_server_dir_trav_vuln.nasl 2010-07-01 20:07:08 UTC (rev 8271)
+++ trunk/openvas-plugins/scripts/secpod_titan_ftp_server_dir_trav_vuln.nasl 2010-07-02 06:02:13 UTC (rev 8272)
@@ -0,0 +1,93 @@
+##############################################################################
+# OpenVAS Vulnerability Test
+# $Id: secpod_titan_ftp_server_dir_trav_vuln.nasl 9877 2010-06-30 12:50:29 jun $
+#
+# Titan FTP Server 'XCRC' and 'COMB' Directory Traversal Vulnerabilities
+#
+# Authors:
+# Madhuri D <dmadhuri at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2010 SecPod, http://www.secpod.com
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+ script_id(902087);
+ script_version("$Revision$: 1.0");
+ script_tag(name:"cvss_base", value:"6.5");
+ script_tag(name:"risk_factor", value:"High");
+ script_cve_id("CVE-2010-2425", "CVE-2010-2426");
+ script_bugtraq_id(40949, 40904);
+ script_name("Titan FTP Server 'XCRC' and 'COMB' Directory Traversal Vulnerabilities");
+ desc = "
+ Overview: This host is running Titan FTP Server and is prone to directory
+ traversal vulnerabilities.
+
+ Vulnerability Insight:
+ The flaws are caused due to,
+ - Input validation error when processing 'XCRC' commands, which can be
+ exploited to determine the existence of a file outside the FTP root
+ directory.
+ - Input validation error when processing 'COMB' commands, which can be
+ exploited to read and delete an arbitrary file.
+
+ Impact:
+ Successful exploitation will let the attackers to download arbitrary files
+ and deletion of arbitrary files on the server.
+
+ Impact Level: Application.
+
+ Affected Software:
+ Titan FTP Server version 8.10.1125 and prior
+
+ Fix: No solution/patch is available as on 30th June 2010. Information
+ regarding this issue will updated once the solution details are available.
+ For updates refer, http://www.titanftp.com/index.html
+
+ References:
+ http://secunia.com/advisories/40237
+ http://xforce.iss.net/xforce/xfdb/59492
+ http://www.securityfocus.com/archive/1/archive/1/511839/100/0/threaded ";
+
+ script_description(desc);
+ script_summary("Check for the version of TitanFTP Server");
+ script_category(ACT_GATHER_INFO);
+ script_copyright("Copyright (c) 2010 SecPod");
+ script_family("Web application abuses");
+ script_dependencies("gb_titan_ftp_detect.nasl", "find_service.nes");
+ script_require_keys("TitanFTP/Server/Ver");
+ script_require_ports("Services/ftp", 21);
+ exit(0);
+}
+
+include("ftp_func.inc");
+include("version_func.inc");
+
+ftpPort = get_kb_item("Services/ftp");
+if(!ftpPort){
+ exit(0);
+}
+
+titanVer = get_kb_item("TitanFTP/Server/Ver");
+if(!titanVer){
+ exit(0);
+}
+
+# Grep for TitanFTP Server version 8.10.1125 and prior.
+if(version_is_less_equal(version:titanVer, test_version:"8.10.1125")){
+ security_hole(ftpPort);
+}
Property changes on: trunk/openvas-plugins/scripts/secpod_titan_ftp_server_dir_trav_vuln.nasl
___________________________________________________________________
Name: svn:keywords
+ Revision
More information about the Openvas-commits
mailing list