[Openvas-commits] r9382 - in trunk/openvas-plugins: . scripts
scm-commit@wald.intevation.org
scm-commit at wald.intevation.org
Wed Nov 10 14:58:31 CET 2010
Author: chandra
Date: 2010-11-10 14:58:25 +0100 (Wed, 10 Nov 2010)
New Revision: 9382
Added:
trunk/openvas-plugins/scripts/gb_adobe_prdts_arbitrary_code_exec_vuln_nov10_lin.nasl
trunk/openvas-plugins/scripts/gb_adobe_prdts_arbitrary_code_exec_vuln_nov10_win.nasl
trunk/openvas-plugins/scripts/secpod_ms10-087.nasl
trunk/openvas-plugins/scripts/secpod_ms10-088.nasl
Modified:
trunk/openvas-plugins/ChangeLog
Log:
Added MS bulletins Nov-10 plugins
Modified: trunk/openvas-plugins/ChangeLog
===================================================================
--- trunk/openvas-plugins/ChangeLog 2010-11-10 12:49:20 UTC (rev 9381)
+++ trunk/openvas-plugins/ChangeLog 2010-11-10 13:58:25 UTC (rev 9382)
@@ -1,3 +1,13 @@
+2010-11-10 Chandrashekhar B <bchandra at secpod.com>
+
+ * scripts/secpod_ms10-087.nasl,
+ scripts/secpod_ms10-088.nasl:
+ Added MS bulletin plugins for Nov-10.
+
+ * scripts/gb_adobe_prdts_arbitrary_code_exec_vuln_nov10_lin.nasl,
+ scripts/gb_adobe_prdts_arbitrary_code_exec_vuln_nov10_win.nasl:
+ Added new plugins.
+
2010-11-10 Michael Meyer <michael.meyer at greenbone.net>
* scripts/gb_mysql_43676.nasl,
Added: trunk/openvas-plugins/scripts/gb_adobe_prdts_arbitrary_code_exec_vuln_nov10_lin.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_adobe_prdts_arbitrary_code_exec_vuln_nov10_lin.nasl 2010-11-10 12:49:20 UTC (rev 9381)
+++ trunk/openvas-plugins/scripts/gb_adobe_prdts_arbitrary_code_exec_vuln_nov10_lin.nasl 2010-11-10 13:58:25 UTC (rev 9382)
@@ -0,0 +1,101 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: gb_adobe_prdts_arbitrary_code_exec_vuln_nov10_lin.nasl 11992 2010-11-08 14:13:26Z nov $
+#
+# Adobe Products Arbitrary Code Execution Vulnerability (Linux)
+#
+# Authors:
+# Madhuri D <dmadhuri at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+ script_id(801478);
+ script_version("$Revision$:1.0");
+ script_cve_id("CVE-2010-3654");
+ script_bugtraq_id(44504);
+ script_tag(name:"cvss_base", value:"9.3");
+ script_tag(name:"risk_factor", value:"Critical");
+ script_name("Adobe Products Content Code Execution Vulnerability (Linux)");
+ desc = "
+ Overview: This host has Adobe Acrobat or Adobe Reader or Adobe flash Player
+ installed, and is prone to arbitrary code execution vulnerability.
+
+ Vulnerability Insight:
+ The flaw is caused by an unspecified error which can be exploited to execute
+ arbitrary code.
+
+ Impact:
+ Successful exploitation will let attackers to execute arbitrary code in the
+ context of the user running the affected application.
+
+ Impact Level: Application/System
+
+ Affected Software/OS:
+ Adobe Reader/Acrobat version 9.x to 9.4 on Linux
+ Adobe Flash Player version 10.1.85.3 and prior on Linux
+
+ Fix:
+ Adobe Flash Player:
+ Upgrade to Adobe Flash Player version 10.1.102.64 or later
+ For details refer, http://www.adobe.com/downloads/
+
+ Adobe Reader/Acrobat:
+ No solution or patch is available as on 08th November, 2010. Information
+ regarding this issue will be updated once the solution details are available.
+ For updates refer, http://www.adobe.com/downloads/
+
+ References:
+ http://secunia.com/advisories/41917
+ http://www.kb.cert.org/vuls/id/298081
+ http://contagiodump.blogspot.com/2010/10/potential-new-adobe-flash-player-zero.html ";
+
+ script_description(desc);
+ script_summary("Check for the version of Adobe Acrobat and Reader and Adobe Flash Player");
+ script_category(ACT_GATHER_INFO);
+ script_copyright("Copyright (c) 2010 Greenbone Networks GmbH");
+ script_family("General");
+ script_dependencies("gb_adobe_prdts_detect_lin.nasl", "gb_adobe_flash_player_detect_lin.nasl");
+ script_require_keys("Adobe/Reader/Linux/Version", "AdobeFlashPlayer/Linux/Ver");
+ exit(0);
+}
+
+
+include("version_func.inc");
+
+# Check for Adobe Reader version <= 9.4
+readerVer = get_kb_item("Adobe/Reader/Linux/Version");
+if(readerVer)
+{
+ if(version_in_range(version:readerVer, test_version:"9.0.0", test_version2:"9.4"))
+ {
+ security_hole(0);
+ exit(0);
+ }
+}
+
+# Check for Adobe Flash Player version <= 10.1.85.3
+flashVer = get_kb_item("AdobeFlashPlayer/Linux/Ver");
+flashVer = ereg_replace(pattern:",", string:flashVer, replace: ".");
+if(flashVer)
+{
+ if(version_is_less_equal(version:flashVer, test_version:"10.1.85.3")){
+ security_hole(0);
+ }
+}
Property changes on: trunk/openvas-plugins/scripts/gb_adobe_prdts_arbitrary_code_exec_vuln_nov10_lin.nasl
___________________________________________________________________
Name: svn:executable
+ *
Name: svn:keywords
+ Revision
Added: trunk/openvas-plugins/scripts/gb_adobe_prdts_arbitrary_code_exec_vuln_nov10_win.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_adobe_prdts_arbitrary_code_exec_vuln_nov10_win.nasl 2010-11-10 12:49:20 UTC (rev 9381)
+++ trunk/openvas-plugins/scripts/gb_adobe_prdts_arbitrary_code_exec_vuln_nov10_win.nasl 2010-11-10 13:58:25 UTC (rev 9382)
@@ -0,0 +1,110 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: gb_adobe_prdts_arbitrary_code_exec_vuln_nov10_win.nasl 11992 2010-11-08 14:25:26Z nov $
+#
+# Adobe Products Arbitrary Code Execution Vulnerability (Windows)
+#
+# Authors:
+# Madhuri D <dmadhuri at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+ script_id(801477);
+ script_version("$Revision$: 1.0");
+ script_cve_id("CVE-2010-3654");
+ script_bugtraq_id(44504);
+ script_tag(name:"cvss_base", value:"9.3");
+ script_tag(name:"risk_factor", value:"Critical");
+ script_name("Adobe Products Content Code Execution Vulnerability (Windows)");
+ desc = "
+ Overview: This host has Adobe Acrobat or Adobe Reader or Adobe flash Player
+ installed, and is prone to arbitrary code execution vulnerability.
+
+ Vulnerability Insight:
+ The flaw is caused by an unspecified error which can be exploited to execute
+ arbitrary code.
+
+ Impact:
+ Successful exploitation will let attackers to execute arbitrary code in the
+ context of the user running the affected application.
+
+ Impact Level: Application/System
+
+ Affected Software/OS:
+ Adobe Reader/Acrobat version 9.x to 9.4 on Windows
+ Adobe Flash Player version 10.1.85.3 and prior on Windows
+
+ Fix:
+ Adobe Flash Player:
+ Upgrade to Adobe Flash Player version 10.1.102.64 or later
+ For details refer, http://www.adobe.com/downloads/
+
+ Adobe Reader/Acrobat:
+ No solution or patch is available as on 08th November, 2010. Information
+ regarding this issue will be updated once the solution details are available.
+ For updates refer, http://www.adobe.com/downloads/
+
+ References:
+ http://secunia.com/advisories/41917
+ http://www.kb.cert.org/vuls/id/298081
+ http://contagiodump.blogspot.com/2010/10/potential-new-adobe-flash-player-zero.html ";
+
+ script_description(desc);
+ script_summary("Check for the version of Adobe Acrobat and Reader and Adobe Flash Player");
+ script_category(ACT_GATHER_INFO);
+ script_copyright("Copyright (c) 2010 Greenbone Networks GmbH");
+ script_family("General");
+ script_dependencies("secpod_adobe_prdts_detect_win.nasl", "gb_adobe_flash_player_detect_win.nasl");
+ script_require_keys("Adobe/Reader/Win/Ver", "Adobe/Acrobat/Win/Ver",
+ "AdobeFlashPlayer/Win/Ver");
+ exit(0);
+}
+
+
+include("version_func.inc");
+
+# Check for Adobe Reader version <= 9.4
+readerVer = get_kb_item("Adobe/Reader/Win/Ver");
+if(readerVer)
+{
+ if(version_in_range(version:readerVer, test_version:"9.0.0", test_version2:"9.4"))
+ {
+ security_hole(0);
+ exit(0);
+ }
+}
+
+# Check for Adobe Acrobat version <= 9.4
+acrobatVer = get_kb_item("Adobe/Acrobat/Win/Ver");
+if(acrobatVer)
+{
+ if(version_in_range(version:acrobatVer, test_version:"9.0.0", test_version2:"9.4")){
+ security_hole(0);
+ }
+}
+
+# Check for Adobe Flash Player version <= 10.1.85.3
+flashVer = get_kb_item("AdobeFlashPlayer/Win/Ver");
+if(flashVer)
+{
+ if(version_is_less_equal(version:flashVer, test_version:"10.1.85.3")){
+ security_hole(0);
+ }
+}
Property changes on: trunk/openvas-plugins/scripts/gb_adobe_prdts_arbitrary_code_exec_vuln_nov10_win.nasl
___________________________________________________________________
Name: svn:executable
+ *
Name: svn:keywords
+ Revision
Added: trunk/openvas-plugins/scripts/secpod_ms10-087.nasl
===================================================================
--- trunk/openvas-plugins/scripts/secpod_ms10-087.nasl 2010-11-10 12:49:20 UTC (rev 9381)
+++ trunk/openvas-plugins/scripts/secpod_ms10-087.nasl 2010-11-10 13:58:25 UTC (rev 9382)
@@ -0,0 +1,125 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: secpod_ms10-087.nasl 12117 2010-11-10 11:11:11Z nov $
+#
+# Microsoft Office Remote Code Execution Vulnerabilites (2423930)
+#
+# Authors:
+# Sooraj KS <kssooraj at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2010 SecPod, http://www.secpod.com
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+ script_id(901166);
+ script_version("$Revision$: 1.0");
+ script_tag(name:"cvss_base", value:"9.3");
+ script_tag(name:"risk_factor", value:"Critical");
+ script_cve_id("CVE-2010-3333", "CVE-2010-3334", "CVE-2010-3335",
+ "CVE-2010-3336", "CVE-2010-3337");
+ script_bugtraq_id(44652, 44656, 44659, 44660, 42628);
+ script_name("Microsoft Office Remote Code Execution Vulnerabilites (2423930)");
+ desc = "
+ Overview: This host has critical security update missing according to
+ Microsoft Bulletin MS10-087.
+
+ Vulnerability Insight:
+ Multiple flaws are caused by,
+ - a stack overflow error when processing malformed Rich Text Format data.
+ - a memory corruption error when processing Office Art Drawing records in
+ Office files.
+ - a memory corruption error when handling drawing exceptions.
+ - a memory corruption error when handling SPID data in Office documents.
+ - an error when loading certain librairies from the current working directory.
+
+ Impact:
+ Successful exploitation could allow attackers to execute arbitrary code.
+
+ Impact Level: System
+
+ Affected Software/OS:
+ Microsoft Office XP Service Pack 3
+ Microsoft Office 2003 Service Pack 3
+ Microsoft Office 2007 Service Pack 2
+ Microsoft Office 2010.
+
+ Fix:
+ Run Windows Update and update the listed hotfixes or download and
+ update mentioned hotfixes in the advisory from the below link,
+ http://www.microsoft.com/technet/security/bulletin/MS10-087.mspx
+
+ References:
+ http://secunia.com/advisories/38521
+ http://www.vupen.com/english/advisories/2010/2923
+ http://www.microsoft.com/technet/security/bulletin/MS10-087.mspx ";
+
+ script_description(desc);
+ script_summary("Check for the version of Mso.dll file");
+ script_category(ACT_GATHER_INFO);
+ script_copyright("Copyright (C) 2010 SecPod");
+ script_family("Windows : Microsoft Bulletins");
+ script_dependencies("secpod_office_products_version_900032.nasl");
+ script_require_ports(139, 445);
+ exit(0);
+}
+
+
+include("smb_nt.inc");
+include("secpod_reg.inc");
+include("version_func.inc");
+include("secpod_smb_func.inc");
+
+## Get File Version
+function FileVer (file, path)
+{
+ share = ereg_replace(pattern:"([A-Za-z]):.*", replace:"\1$", string:path);
+ if(share =~ "[a-z]\$")
+ share = toupper(share);
+ file = ereg_replace(pattern:"[A-Za-z]:(.*)", replace:"\1", string:path + file);
+ ver = GetVer(file:file, share:share);
+ return ver;
+}
+
+## MS Office XP, 2003, 2007, 2010
+if(get_kb_item("MS/Office/Ver") =~ "^[10|11|12|14].*")
+{
+ ## Get Office File Path
+ path = registry_get_sz(key:"SOFTWARE\Microsoft\Windows\CurrentVersion",
+ item:"CommonFilesDir");
+ if(! path) {
+ exit(0);
+ }
+
+ foreach ver (make_list("OFFICE10", "OFFICE11", "OFFICE12", "OFFICE14"))
+ {
+ offPath = path + "\Microsoft Shared\" + ver;
+ dllVer = FileVer(file:"\Mso.dll", path:offPath);
+ if(dllVer)
+ {
+ ## Grep for Mso.dll versions
+ if(version_in_range(version:dllVer, test_version:"10.0", test_version2:"10.0.6866.9") ||
+ version_in_range(version:dllVer, test_version:"11.0", test_version2:"11.0.8328.9") ||
+ version_in_range(version:dllVer, test_version:"12.0", test_version2:"12.0.6545.5003")||
+ version_in_range(version:dllVer, test_version:"14.0", test_version2:"14.0.5128.4999"))
+ {
+ security_hole(0);
+ exit(0);
+ }
+ }
+ }
+}
Property changes on: trunk/openvas-plugins/scripts/secpod_ms10-087.nasl
___________________________________________________________________
Name: svn:executable
+ *
Name: svn:keywords
+ Revision
Added: trunk/openvas-plugins/scripts/secpod_ms10-088.nasl
===================================================================
--- trunk/openvas-plugins/scripts/secpod_ms10-088.nasl 2010-11-10 12:49:20 UTC (rev 9381)
+++ trunk/openvas-plugins/scripts/secpod_ms10-088.nasl 2010-11-10 13:58:25 UTC (rev 9382)
@@ -0,0 +1,104 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: secpod_ms10-088.nasl 12118 2010-11-10 04:46:09Z nov $
+#
+# Microsoft Office PowerPoint Remote Code Execution Vulnerabilities (2293386)
+#
+# Authors:
+# Veerendra G.G <veerendragg at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2010 SecPod, http://www.secpod.com
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+ script_id(900261);
+ script_version("$Revision$:1.0");
+ script_tag(name:"cvss_base", value:"9.4");
+ script_tag(name:"risk_factor", value:"Critical");
+ script_cve_id("CVE-2010-2572", "CVE-2010-2573");
+ script_bugtraq_id(44626, 44628);
+ script_name("Microsoft Office PowerPoint Remote Code Execution Vulnerabilities (2293386)");
+ desc = "
+ Overview: This host has critical security update missing according to
+ Microsoft Bulletin MS10-088.
+
+ Vulnerability Insight:
+ The flaw is caused due to the way that Microsoft PowerPoint parses the
+ PPT file format when opening a specially crafted files.
+
+ Impact:
+ Successful exploitation could allow attackers to execute arbitrary code by
+ tricking a user into opening a malicious PPT file.
+
+ Impact Level: System
+
+ Affected Software/OS:
+ Microsoft PowerPoint 2002 Service Pack 3 and prior
+ Microsoft PowerPoint 2003 Service Pack 3 and prior
+ Microsoft PowerPoint Viewer 2007 Service Pack 2 and prior
+
+ Fix:
+ Run Windows Update and update the listed hotfixes or download and
+ update mentioned hotfixes in the advisory from the below link,
+ http://www.microsoft.com/technet/security/bulletin/ms10-088.mspx
+
+ References:
+ http://support.microsoft.com/kb/2413272
+ http://support.microsoft.com/kb/2413304
+ http://support.microsoft.com/kb/2413381
+ http://www.microsoft.com/technet/security/bulletin/ms10-088.mspx
+ ";
+
+ script_description(desc);
+ script_summary("Check for the version of Powerpnt.exe and Pptview.exe file");
+ script_category(ACT_GATHER_INFO);
+ script_copyright("Copyright (C) 2010 SecPod");
+ script_family("Windows : Microsoft Bulletins");
+ script_dependencies("secpod_office_products_version_900032.nasl");
+ script_require_keys("MS/Office/Ver", "SMB/Office/PowerPnt/Version");
+ exit(0);
+}
+
+
+include("version_func.inc");
+
+if(egrep(pattern:"^(|10|11|12)\..*", string:get_kb_item("MS/Office/Ver")))
+{
+ pptVer = get_kb_item("SMB/Office/PowerPnt/Version");
+ ppviewVer = get_kb_item("SMB/Office/PPView/Version");
+
+ ## PowerPoint Check
+ if(!isnull(pptVer))
+ {
+ ## Check for Powerpnt.exe < 10.0.6858.0 for PowerPoint 2002
+ ## Check for Powerpnt.exe < 11.0.8324.0 for PowerPoint 2003
+ if(version_in_range(version:pptVer, test_version:"10.0", test_version2:"10.0.6857") ||
+ version_in_range(version:pptVer, test_version:"11.0", test_version2:"11.0.8323")){
+ security_hole(0);
+ }
+ }
+
+ ## PowerPoint Viewer Check
+ if (!isnull(ppviewVer))
+ {
+ ## Check for Pptview.exe < 12.0.6545.5004 for PowerPoint Viewer 2007
+ if(version_in_range(version:ppviewVer, test_version:"12.0", test_version2:"12.0.6545.5003")){
+ security_hole(0);
+ }
+ }
+}
Property changes on: trunk/openvas-plugins/scripts/secpod_ms10-088.nasl
___________________________________________________________________
Name: svn:keywords
+ Revision
More information about the Openvas-commits
mailing list