[Openvas-commits] r13224 - in trunk/openvas-plugins: . scripts
scm-commit at wald.intevation.org
scm-commit at wald.intevation.org
Thu Apr 12 13:33:21 CEST 2012
Author: mime
Date: 2012-04-12 13:33:20 +0200 (Thu, 12 Apr 2012)
New Revision: 13224
Added:
trunk/openvas-plugins/scripts/gb_php_51806.nasl
trunk/openvas-plugins/scripts/gb_wago_758_870_52940.nasl
trunk/openvas-plugins/scripts/gb_wordpress_52986.nasl
Modified:
trunk/openvas-plugins/ChangeLog
trunk/openvas-plugins/scripts/default_ssh_credentials.nasl
Log:
Added new plugins. Added script_timeout(600).
Modified: trunk/openvas-plugins/ChangeLog
===================================================================
--- trunk/openvas-plugins/ChangeLog 2012-04-12 10:40:28 UTC (rev 13223)
+++ trunk/openvas-plugins/ChangeLog 2012-04-12 11:33:20 UTC (rev 13224)
@@ -1,3 +1,13 @@
+2012-04-12 Michael Meyer <michael.meyer at greenbone.net>
+
+ * scripts/gb_wordpress_52986.nasl,
+ scripts/gb_wago_758_870_52940.nasl,
+ scripts/gb_php_51806.nasl:
+ Added new plugins.
+
+ * scripts/default_ssh_credentials.nasl:
+ Added script_timeout(600).
+
2012-04-11 Antu Sanadi <santu at secpod.com>
* scripts/gb_distinct_tftp_server_dir_trav_vuln.nasl,
Modified: trunk/openvas-plugins/scripts/default_ssh_credentials.nasl
===================================================================
--- trunk/openvas-plugins/scripts/default_ssh_credentials.nasl 2012-04-12 10:40:28 UTC (rev 13223)
+++ trunk/openvas-plugins/scripts/default_ssh_credentials.nasl 2012-04-12 11:33:20 UTC (rev 13224)
@@ -47,6 +47,9 @@
script_copyright("This script is Copyright (C) 2011 Greenbone Networks GmbH");
script_dependencies("ssh_detect.nasl");
script_require_ports("Services/ssh", 22);
+
+ script_timeout(600);
+
exit(0);
}
Added: trunk/openvas-plugins/scripts/gb_php_51806.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_php_51806.nasl (rev 0)
+++ trunk/openvas-plugins/scripts/gb_php_51806.nasl 2012-04-12 11:33:20 UTC (rev 13224)
@@ -0,0 +1,94 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id$
+#
+# PHP Security Bypass Vulnerability
+#
+# Authors:
+# Michael Meyer <michael.meyer at greenbone.net>
+#
+# Copyright:
+# Copyright (c) 2012 Greenbone Networks GmbH
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if (description)
+{
+ script_id(103464);
+ script_bugtraq_id(51806);
+ script_cve_id("CVE-2012-0057");
+ script_tag(name:"cvss_base", value:"6.4");
+ script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:P/I:P/A:N");
+ script_version ("$Revision$");
+
+ script_name("PHP Security Bypass Vulnerability");
+
+desc = "Overview:
+PHP is prone to a security-bypass vulnerability.
+
+Remote attackers can exploit this issue to bypass certain security
+restrictions and create arbitrary files in the context of the
+application.
+
+Versions prior to PHP 5.3.9 are vulnerable.
+
+Solution:
+Updates are available. Please see the references for more information.
+
+References:
+http://www.securityfocus.com/bid/51806
+https://bugs.php.net/bug.php?id=54446
+https://bugzilla.redhat.com/show_bug.cgi?id=782657
+http://www.php.net/ChangeLog-5.php
+http://www.php.net/";
+
+ script_tag(name:"risk_factor", value:"High");
+ script_tag(name:"last_modification", value:"$Date$");
+ script_tag(name:"creation_date", value:"2012-04-12 10:58:35 +0200 (Thu, 12 Apr 2012)");
+ script_description(desc);
+ script_summary("Determine if installed php version is vulnerable");
+ script_category(ACT_GATHER_INFO);
+ script_family("General");
+ script_copyright("This script is Copyright (C) 2012 Greenbone Networks GmbH");
+ script_dependencies("gb_php_detect.nasl");
+ script_require_ports("Services/www", 80);
+ exit(0);
+}
+
+include("http_func.inc");
+include("version_func.inc");
+include("global_settings.inc");
+
+## This nvt is prone to FP
+if(report_paranoia < 2){
+ exit(0);
+}
+
+port = get_http_port(default:80);
+if(!get_port_state(port))exit(0);
+
+if (!can_host_php(port:port)) exit(0);
+
+if(!vers = get_kb_item(string("www/", port, "/PHP")))exit(0);
+
+if(!isnull(vers)) {
+
+ if(version_in_range(version: vers, test_version:"5.3",test_version2:"5.3.8")) {
+ security_hole(port:port);
+ exit(0);
+ }
+
+}
Property changes on: trunk/openvas-plugins/scripts/gb_php_51806.nasl
___________________________________________________________________
Added: svn:keywords
+ Id Revision Date
Added: trunk/openvas-plugins/scripts/gb_wago_758_870_52940.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_wago_758_870_52940.nasl (rev 0)
+++ trunk/openvas-plugins/scripts/gb_wago_758_870_52940.nasl 2012-04-12 11:33:20 UTC (rev 13224)
@@ -0,0 +1,159 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id$
+#
+# WAGO IPC 758-870 Hardcoded Password Security Bypass Vulnerability
+#
+# Authors:
+# Michael Meyer <michael.meyer at greenbone.net>
+#
+# Copyright:
+# Copyright (c) 2012 Greenbone Networks GmbH
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+desc = "Overview:
+The WAGO IPC 758-870 is prone to a security-bypass vulnerability
+caused by a hard-coded password.
+
+Successful attacks can allow a remote attacker to gain unauthorized
+access to the vulnerable device.
+
+References:
+http://www.securityfocus.com/bid/52940
+http://www.wago.com/
+http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-097-01.pdf";
+
+if (description)
+{
+ script_id(103465);
+ script_bugtraq_id(52940);
+ script_version ("$Revision$");
+
+ script_name("WAGO IPC 758-870 Hardcoded Password Security Bypass Vulnerability");
+
+ script_tag(name:"risk_factor", value:"Critical");
+ script_tag(name:"last_modification", value:"$Date$");
+ script_tag(name:"creation_date", value:"2012-04-12 11:29:33 +0200 (Thu, 12 Apr 2012)");
+ script_description(desc);
+ script_summary("Determine if it is possible to login into the remote wago");
+ script_category(ACT_ATTACK);
+ script_family("Default Accounts");
+ script_copyright("This script is Copyright (C) 2012 Greenbone Networks GmbH");
+ script_dependencies("find_service.nes");
+ script_require_ports("Services/www", 80, "Services/telnet", 23);
+ exit(0);
+}
+
+include("telnet_func.inc");
+include("http_func.inc");
+include("http_keepalive.inc");
+include("misc_func.inc");
+
+credentials = make_list("user:user00","guest:guest");
+
+http_port = get_kb_item("Services/www");
+telnet_port = get_kb_item("Services/telnet");
+
+http_port = 80;
+telnet_port = 23;
+
+if(!http_port && !telnet_port)exit(0);
+
+url = '/cgi-bin/ssi.cgi/title.ssi';
+req = http_get(item:url, port:http_port);
+buf = http_keepalive_send_recv(port:http_port, data:req, bodyonly:FALSE);
+
+if("Wago IO-IPC 758-870" >< buf) {
+
+ url = '/security.htm';
+ req = http_get(item:url, port:http_port);
+ buf = http_keepalive_send_recv(port:http_port, data:req, bodyonly:FALSE);
+
+ if("Unauthorized" >< buf) {
+
+ foreach credential (credentials) {
+
+ userpass64 = base64(str:credential);
+
+ req = string("GET ", url," HTTP/1.1\r\n",
+ "Host: ", get_host_name(),"\r\n",
+ "Authorization: Basic ",userpass64,"\r\n",
+ "\r\n");
+
+ resp = http_keepalive_send_recv(port:http_port, data:req);
+
+ if("<title>Configuration side for the web security" >< resp && "Webserver security functions" >< resp) {
+ httpdesc = desc + '\n\nIt was possible to login using the following credentials:\nUsername:Password\n' + credential + '\n';
+ security_hole(port:http_port,data:httpdesc);
+ break;
+ }
+
+
+ }
+
+ } else {
+ desc = desc + '\n\nThe Wago Web Configuration Page is not protected by any credentials\n';
+ security_hole(port:http_port,data:desc);
+ }
+
+}
+
+soc = open_sock_tcp(telnet_port);
+if(!soc)exit(0);
+
+r = telnet_negotiate(socket:soc);
+if("WagoIPC1 login" >< r) {
+
+ foreach credential (credentials) {
+
+ cred = split(credential, sep:":", keep:FALSE);
+ user = cred[0];
+ pass = cred[1];
+
+ send(socket:soc, data:user + '\n');
+ recv = recv(socket:soc, length:512);
+
+ if("Password" >!< recv)continue;
+
+ send(socket:soc, data:pass + '\n');
+ recv = recv(socket:soc, length:512);
+
+ if("-sh" >!< recv)continue;
+
+ desc1 = desc + '\n\nIt was possible to login using the following credentials:\nUsername:Password\n' + credential + '\n';
+ security_hole(port:telnet_port,data:desc1);
+
+ send(socket:soc, data:'su\n');
+ recv = recv(socket:soc, length:512);
+
+ if("Password" >!< recv)continue;
+
+ send(socket:soc, data:'ko2003wa\n');
+ recv = recv(socket:soc, length:512);
+
+ close(soc);
+
+ if("this is the super user account" >< recv) {
+ desc2 = desc + '\n\nAfter it was possible to login using default credentials it was\nalso possible to "su" to the super user account using "ko2003wa" as password\n';
+ security_hole(port:telnet_port,data:desc2);
+ }
+
+ }
+
+}
+
+exit(0);
Property changes on: trunk/openvas-plugins/scripts/gb_wago_758_870_52940.nasl
___________________________________________________________________
Added: svn:keywords
+ Id Revision Date
Added: trunk/openvas-plugins/scripts/gb_wordpress_52986.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_wordpress_52986.nasl (rev 0)
+++ trunk/openvas-plugins/scripts/gb_wordpress_52986.nasl 2012-04-12 11:33:20 UTC (rev 13224)
@@ -0,0 +1,94 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id$
+#
+# WordPress All-in-One Event Calendar Plugin Multiple Cross Site Scripting Vulnerabilities
+#
+# Authors:
+# Michael Meyer <michael.meyer at greenbone.net>
+#
+# Copyright:
+# Copyright (c) 2012 Greenbone Networks GmbH
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if (description)
+{
+ script_id(103463);
+ script_bugtraq_id(52986);
+ script_cve_id("CVE-2012-1835");
+ script_version ("$Revision$");
+
+ script_name("WordPress All-in-One Event Calendar Plugin Multiple Cross Site Scripting Vulnerabilities");
+
+desc = "Overview:
+All-in-One Event Calendar plugin for WordPress is prone to multiple
+cross-site scripting vulnerabilities because it fails to properly
+sanitize user-supplied input.
+
+An attacker may leverage these issues to execute arbitrary script code
+in the browser of an unsuspecting user in the context of the affected
+site. This may let the attacker steal cookie-based authentication
+credentials and launch other attacks.
+
+All-in-One Event Calendar 1.4 is vulnerable; other prior versions may
+also be affected.
+
+References:
+http://www.securityfocus.com/bid/52986
+http://theseednetwork.com/services/websites-and-software/software/all-in-one-event-calendar-wordpress/
+https://www.htbridge.com/advisory/HTB23082
+http://www.wordpress.org/
+http://www.securityfocus.com/archive/1/522292";
+
+ script_tag(name:"risk_factor", value:"Medium");
+ script_tag(name:"last_modification", value:"$Date$");
+ script_tag(name:"creation_date", value:"2012-04-12 10:32:26 +0200 (Thu, 12 Apr 2012)");
+ script_description(desc);
+ script_summary("Determine if All-in-One Event Calendar plugin for WordPress is vulnerable");
+ script_category(ACT_ATTACK);
+ script_family("Web application abuses");
+ script_copyright("This script is Copyright (C) 2012 Greenbone Networks GmbH");
+ script_dependencies("secpod_wordpress_detect_900182.nasl");
+ script_require_ports("Services/www", 80);
+ script_exclude_keys("Settings/disable_cgi_scanning");
+ script_require_keys("wordpress/installed");
+ exit(0);
+}
+
+include("http_func.inc");
+include("host_details.inc");
+include("version_func.inc");
+include("http_keepalive.inc");
+
+port = get_http_port(default:80);
+if(!get_port_state(port))exit(0);
+
+if(!can_host_php(port:port))exit(0);
+
+if(!dir = get_dir_from_kb(port:port, app:"WordPress"))exit(0);
+
+url = string(dir, "/wp-content/plugins/all-in-one-event-calendar/app/view/save_successful.php?msg=<script>alert(/openvas-xss-test/);</script>");
+
+if(http_vuln_check(port:port, url:url,pattern:"<script>alert\(/openvas-xss-test/\);</script>",check_header:TRUE)) {
+
+ security_warning(port:port);
+ exit(0);
+
+}
+
+exit(0);
+
Property changes on: trunk/openvas-plugins/scripts/gb_wordpress_52986.nasl
___________________________________________________________________
Added: svn:keywords
+ Id Revision Date
More information about the Openvas-commits
mailing list