[Openvas-commits] r11605 - in trunk/openvas-plugins: . scripts
scm-commit@wald.intevation.org
scm-commit at wald.intevation.org
Tue Sep 13 07:51:48 CEST 2011
Author: veerendragg
Date: 2011-09-13 07:51:43 +0200 (Tue, 13 Sep 2011)
New Revision: 11605
Added:
trunk/openvas-plugins/scripts/gb_sunway_force_control_webserver_bof_vuln.nasl
trunk/openvas-plugins/scripts/gb_tcptrack_detect.nasl
trunk/openvas-plugins/scripts/gb_tcptrack_long_command_bof_vuln.nasl
Modified:
trunk/openvas-plugins/ChangeLog
trunk/openvas-plugins/scripts/cpe.inc
Log:
Added new CPEs.
Modified: trunk/openvas-plugins/ChangeLog
===================================================================
--- trunk/openvas-plugins/ChangeLog 2011-09-13 05:43:30 UTC (rev 11604)
+++ trunk/openvas-plugins/ChangeLog 2011-09-13 05:51:43 UTC (rev 11605)
@@ -1,3 +1,13 @@
+2011-09-13 Veerendra G.G <veerendragg at secpod.com>
+
+ * scripts/gb_tcptrack_long_command_bof_vuln.nasl
+ scripts/gb_tcptrack_detect.nasl
+ scripts/gb_sunway_force_control_webserver_bof_vuln.nasl:
+ Added new plugins.
+
+ * scripts/cpe.inc:
+ Added new CPEs.
+
2011-09-12 Michael Meyer <michael.meyer at greenbone.net>
* scripts/gb_ubuntu_USN_672_1.nasl,
Modified: trunk/openvas-plugins/scripts/cpe.inc
===================================================================
--- trunk/openvas-plugins/scripts/cpe.inc 2011-09-13 05:43:30 UTC (rev 11604)
+++ trunk/openvas-plugins/scripts/cpe.inc 2011-09-13 05:51:43 UTC (rev 11605)
@@ -926,7 +926,8 @@
"McAfee/SaaS/Win/Ver", "^([0-9.]+)", "cpe:/a:mcafee:saas_endpoint_protection:",
"Adobe/Flash/Player/MacOSX/Version", "^([0-9.]+)", "cpe:/a:adobe:flash_player:",
"Adobe/Air/MacOSX/Version", "^([0-9.]+)", "cpe:/a:adobe:adobe_air:",
-"RealPlayer/MacOSX/Version", "^([0-9.]+)", "cpe:/a:realnetworks:realplayer:"
+"RealPlayer/MacOSX/Version", "^([0-9.]+)", "cpe:/a:realnetworks:realplayer:",
+"Tcptrack/Ver", "^([0-9.]+)", "cpe:/a:rhythm:tcptrack:"
);
Added: trunk/openvas-plugins/scripts/gb_sunway_force_control_webserver_bof_vuln.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_sunway_force_control_webserver_bof_vuln.nasl 2011-09-13 05:43:30 UTC (rev 11604)
+++ trunk/openvas-plugins/scripts/gb_sunway_force_control_webserver_bof_vuln.nasl 2011-09-13 05:51:43 UTC (rev 11605)
@@ -0,0 +1,115 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: gb_sunway_force_control_webserver_bof_vuln.nasl 16413 2011-09-08 13:25:24Z sep $
+#
+# Sunway ForceControl WebServer 'httpsvr.exe' Buffer Overflow Vulnerability
+#
+# Authors:
+# Madhuri D <dmadhuri at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+ script_id(802156);
+ script_version("$Revision: 1.0$");
+ script_cve_id("CVE-2011-2960");
+ script_bugtraq_id(48328);
+ script_tag(name:"cvss_base", value:"10.0");
+ script_tag(name:"risk_factor", value:"Critical");
+ script_name("Sunway ForceControl WebServer 'httpsvr.exe' Buffer Overflow Vulnerability");
+ desc = "
+ Overview: This host is installed with Sunway ForceControl and is prone to
+ buffer overflow vulnerability.
+
+ Vulnerability Insight:
+ The flaw exists due to an error in the WebServer component (httpsvr.exe) and
+ can be exploited to cause a heap-based buffer overflow via a specially
+ crafted URL sent in a web request.
+
+ Impact:
+ Successful exploitation will allow remote attackers to cause denial of
+ service or execute arbitrary code.
+
+ Impact Level: System/Application
+
+ Affected Software :
+ Sunway ForceControl 6.1 SP1, SP2, and SP3.
+
+ Fix: No solution or patch is available as on 9th September, 2011. Information
+ regarding this issue will be updated once the solution details are available.
+ For updates refer, http://www.sunwayland.com.cn/pro.asp
+
+ References:
+ http://osvdb.org/73124
+ http://secunia.com/advisories/45033
+ http://www.exploit-db.com/exploits/17721/
+ http://www.cnvd.org.cn/vulnerability/CNVD-2011-05347
+ http://www.sunwayland.com.cn/news_info_.asp?Nid=3593
+ http://www.us-cert.gov/control_systems/pdf/ICSA-11-167-01.pdf ";
+
+ script_description(desc);
+ script_summary("Check for the version of Sunway ForceControl httpsvr.exe");
+ script_category(ACT_GATHER_INFO);
+ script_copyright("Copyright (c) 2011 Greenbone Networks GmbH");
+ script_family("Buffer overflow");
+ script_dependencies("secpod_reg_enum.nasl");
+ script_require_keys("SMB/WindowsVersion");
+ exit(0);
+}
+
+
+include("smb_nt.inc");
+include("version_func.inc");
+include("secpod_smb_func.inc");
+
+if(!get_kb_item("SMB/WindowsVersion")){
+ exit(0);
+}
+
+key = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\";
+if(!registry_key_exists(key:key)){
+ exit(0);
+}
+
+foreach item (registry_enum_keys(key:key))
+{
+ ## Check for Sunway ForceControl DisplayName
+ sunName = registry_get_sz(key:key + item, item:"DisplayName");
+ if("Forcecontrol" >< sunName)
+ {
+ ## Get the version of Sunway ForceControl
+ sunVer = registry_get_sz(key:key + item, item:"DisplayVersion");
+ if("6.1" >< sunVer)
+ {
+ ## Get the path of httpsvr.exe
+ exePath = registry_get_sz(key:key + item, item:"InstallLocation");
+ if(!isnull(exePath))
+ {
+ httpVer = fetch_file_version(sysPath:exePath, file_name:"httpsvr.exe");
+ if(httpVer != NULL)
+ {
+ ## Check for httpsvr.exe version <= 6.0.5.3
+ if(version_is_less_equal(version:httpVer, test_version:"6.0.5.3")){
+ security_hole(0) ;
+ }
+ }
+ }
+ }
+ }
+}
Added: trunk/openvas-plugins/scripts/gb_tcptrack_detect.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_tcptrack_detect.nasl 2011-09-13 05:43:30 UTC (rev 11604)
+++ trunk/openvas-plugins/scripts/gb_tcptrack_detect.nasl 2011-09-13 05:51:43 UTC (rev 11605)
@@ -0,0 +1,82 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: gb_tcptrack_detect.nasl 16972 2011-09-12 09:32:36Z sep $
+#
+# Tcptrack Version Detection
+#
+# Authors:
+# Antu Sanadi <santu at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+ script_id(801972);
+ script_version("$Revision: 1.0$");
+ script_tag(name:"risk_factor", value:"None");
+ script_name("Tcptrack Version Detection");
+ desc = "
+ Overview: This script finds the Tcptrack installed version and saves
+ the version in KB. ";
+
+ script_description(desc);
+ script_summary("Set the Version of Tcptrack in KB");
+ script_category(ACT_GATHER_INFO);
+ script_copyright("Copyright (C) 2011 Greenbone Networks GmbH");
+ script_family("Service detection");
+ exit(0);
+}
+
+
+include("ssh_func.inc");
+include("version_func.inc");
+
+sock = ssh_login_or_reuse_connection();
+if(!sock){
+ exit(0);
+}
+
+## Confirm Linux, as SSH can be installed on Windows as well
+result = ssh_cmd(socket:sock, cmd:"uname");
+if("Linux" >!< result){
+ exit(0);
+}
+
+## Get the file location
+tcptName = find_file(file_name:"tcptrack", file_path:"/", useregex:TRUE,
+ regexpar:"$", sock:sock);
+
+## Check for the each path
+if(tcptName)
+{
+ foreach binaryName (tcptName)
+ {
+ ## Get the version
+ tcptVer = get_bin_version(full_prog_name:chomp(binaryName),
+ version_argv:"-v", ver_pattern:"tcptrack v([0-9.]+)",sock:sock);
+ if(tcptVer)
+ {
+ ## Set the version in kb
+ set_kb_item(name:"Tcptrack/Ver", value:tcptVer[1]);
+ security_note(data:"Tcptrack version " + sharkVer[1] +
+ " installed at location " + binaryName + " was detected on the host");
+ ssh_close_connection();
+ }
+ }
+ ssh_close_connection();
+}
Added: trunk/openvas-plugins/scripts/gb_tcptrack_long_command_bof_vuln.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_tcptrack_long_command_bof_vuln.nasl 2011-09-13 05:43:30 UTC (rev 11604)
+++ trunk/openvas-plugins/scripts/gb_tcptrack_long_command_bof_vuln.nasl 2011-09-13 05:51:43 UTC (rev 11605)
@@ -0,0 +1,84 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: gb_tcptrack_long_command_bof_vuln.nasl 16972 2011-09-12 12:33:29 sep $
+#
+# Tcptrack Command Line Parsing Heap Based Buffer Overflow Vulnerability
+#
+# Authors:
+# Antu Sanadi <santu at secpod.com>
+#
+# Copyright:
+# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if(description)
+{
+ script_id(801973);
+ script_version("$Revision: 1.0$");
+ script_cve_id("CVE-2011-2903");
+ script_bugtraq_id(49352);
+ script_tag(name:"cvss_base", value:"6.8");
+ script_tag(name:"risk_factor", value:"High");
+ script_name("Tcptrack Command Line Parsing Heap Based Buffer Overflow Vulnerability");
+ desc = "
+ Overview: This host is installed with Tcptrack and is prone to heap based
+ buffer overflow vulnerability.
+
+ Vulnerability Insight:
+ The flaw is caused due to error in command line parsing, it is not properly
+ handling long command line argument.
+
+ Impact:
+ Successful exploitation allows attackers to execute arbitrary code via a long
+ command line argument in the LWRES dissector when processing malformed data
+ or packets.
+
+ Impact Level: System/Application
+
+ Affected Software/OS:
+ Tcptrack version prior to 1.4.2
+
+ Fix: Upgrade to Tcptrack 1.4.2 or later,
+ For Updates Refer, http://www.rhythm.cx/~steve/devel/tcptrack/#gettingit
+
+ References:
+ http://seclists.org/oss-sec/2011/q3/293
+ https://bugs.gentoo.org/show_bug.cgi?id=377917
+ http://www.rhythm.cx/~steve/devel/tcptrack/#news ";
+
+ script_description(desc);
+ script_summary("Check for the version of Tcptrack");
+ script_category(ACT_GATHER_INFO);
+ script_copyright("Copyright (C) 2011 Greenbone Networks GmbH");
+ script_dependencies("gb_tcptrack_detect.nasl");
+ script_family("Buffer overflow");
+ script_require_keys("Tcptrack/Ver");
+ exit(0);
+}
+
+
+include("version_func.inc");
+
+## Get the version from kb
+tcpVer = get_kb_item("Tcptrack/Ver");
+if(!tcpVer){
+ exit(0);
+}
+
+## Check the version
+if(version_is_less(version:tcpVer, test_version:"1.4.2")){
+ security_hole(0);
+}
More information about the Openvas-commits
mailing list