Hi, Some minor changes to reduce false positives: 11169, 10965 - added explicit check for f-secure ssh, to stop false positives against this server 11365 - added bodyonly:1 option to http_keepalive_send_recv to stop some false positives Regards, Paul -- Paul Johnston Internet Security Specialist Westpoint Limited Albion Wharf, 19 Albion Street, Manchester, M1 5LN England Tel: +44 (0)161 237 1028 Fax: +44 (0)161 237 1031 email: paulat_private web: www.westpoint.ltd.uk # # This script was written by Renaud Deraison <deraisonat_private> # # See the Nessus Scripts License for details # if(description) { script_id(11365); script_cve_id("CAN-2002-0257"); script_bugtraq_id(4069); script_version ("$Revision: 1.3 $"); name["english"] = "Auction Deluxe XSS"; script_name(english:name["english"]); desc["english"] = " The remote Auction Deluxe server is vulnerable to a cross site scripting attack. As a result, a user could easily steal the cookies of your legitimate users and impersonate them. Solution : Upgrade to Auction Deluxe 3.30 or newer Risk factor : Medium"; script_description(english:desc["english"]); summary["english"] = "Checks for auction.pl"; script_summary(english:summary["english"]); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2003 Renaud Deraison", francais:"Ce script est Copyright (C) 2003 Renaud Deraison"); family["english"] = "CGI abuses"; family["francais"] = "Abus de CGI"; script_family(english:family["english"], francais:family["francais"]); script_dependencie("find_service.nes", "no404.nasl"); script_require_ports("Services/www", 80); exit(0); } include("http_func.inc"); include("http_keepalive.inc"); port = get_kb_item("Services/www"); if(!port) port = 80; if(!get_port_state(port))exit(0); dir = make_list(cgi_dirs()); foreach d (dir) { if(isnull(dirs))dirs = make_list(string(d, "/auctiondeluxe")); else dirs = make_list(dirs, string(d, "/auctiondeluxe")); } foreach dir (make_list(dirs, "")) { req = http_get(item:string(dir, "/auction.pl?searchstring=<script>foo</script>"), port:port); res = http_keepalive_send_recv(port:port, data:req, bodyonly:1); if(res == NULL) exit(0); if(!ereg(pattern:"^HTTP/[0-9]\.[0-9] 200 ", string:res))exit(0); str = egrep(pattern:"<script>foo</script>", string:res, icase:TRUE); if(str) { security_warning(port); exit(0); } } # # This script was written by Renaud Deraison <deraisonat_private> # # Script audit and contributions from Carmichael Security <http://www.carmichaelsecurity.com> # Erik Anderson <eandersat_private> # Added BugtraqID # # See the Nessus Scripts License for details # if(description) { script_id(10965); script_version ("$Revision: 1.5 $"); script_bugtraq_id(4810); name["english"] = "SSH 3 AllowedAuthentication"; name["francais"] = "SSH 3 AllowedAuthentication"; script_name(english:name["english"], francais:name["francais"]); desc["english"] = " You are running a version of SSH which is older than 3.1.2 and newer or equal to 3.0.0. There is a vulnerability in this release that may, under some circumstances, allow users to authenticate using a password whereas it is not explicitly listed as a valid authentication mechanism. An attacker may use this flaw to attempt to brute force a password using a dictionary attack (if the passwords used are weak). Solution : Upgrade to version 3.1.2 of SSH which solves this problem. Risk factor : Low"; script_description(english:desc["english"]); summary["english"] = "Checks for the remote SSH version"; summary["francais"] = "Vérifie la version de SSH"; script_summary(english:summary["english"], francais:summary["francais"]); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2002 Renaud Deraison", francais:"Ce script est Copyright (C) 2002 Renaud Deraison"); family["english"] = "Gain a shell remotely"; family["francais"] = "Obtenir un shell ŕ distance"; script_family(english:family["english"], francais:family["francais"]); script_dependencie("find_service.nes", "ssh_detect.nasl"); script_require_ports("Services/ssh", 22); script_exclude_keys("ssh/openssh"); exit(0); } # # The script code starts here # port = get_kb_item("Services/ssh"); if(!port)port = 22; key = string("ssh/banner/", port); banner = get_kb_item(key); if(!banner) { if(get_port_state(port)) { soc = open_sock_tcp(port); if(!soc)exit(0); banner = recv_line(socket:soc, length:1024); close(soc); } } if(!banner)exit(0); banner = tolower(banner); if("openssh" >< banner)exit(0); if("f-secure" >< banner)exit(0); if(ereg(pattern:"3\.(0\.[0-9]+)|(1\.[01])[^0-9]*$", string:banner))security_warning(port); # # This script was written by Renaud Deraison <deraisonat_private> # # See the Nessus Scripts License for details # # Ref: http://www.ssh.com/company/newsroom/article/286/ # # Note: This is about SSH.com's SSH, not OpenSSH !! # if(description) { script_id(11169); script_version ("$Revision: 1.3 $"); name["english"] = "SSH setsid() vulnerability"; script_name(english:name["english"]); desc["english"] = " You are running a version of SSH which is older than version 3.1.5 or 3.2.2. There is a bug in that version which may allow a user to obtain higher privileges due to a flaw in the way setsid() is used. Solution : Upgrade to the latest version of SSH See also : http://www.ssh.com/company/newsroom/article/286/ Risk factor : High"; script_description(english:desc["english"]); summary["english"] = "Checks for the remote SSH version"; summary["francais"] = "Vérifie la version de SSH"; script_summary(english:summary["english"], francais:summary["francais"]); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2002 Renaud Deraison", francais:"Ce script est Copyright (C) 2002 Renaud Deraison"); family["english"] = "Gain root remotely"; family["francais"] = "Passer root ŕ distance"; script_family(english:family["english"], francais:family["francais"]); script_dependencie("find_service.nes"); script_require_ports("Services/ssh", 22); exit(0); } # # The script code starts here # port = get_kb_item("Services/ssh"); if(!port)port = 22; key = string("ssh/banner/", port); banner = get_kb_item(key); if(!banner) { if(get_port_state(port)) { soc = open_sock_tcp(port); if(!soc)exit(0); banner = recv_line(socket:soc, length:1024); close(soc); } } if(!banner)exit(0); banner = tolower(banner); if("f-secure" >< banner) exit(0); if(ereg(pattern:"^ssh-.*-2\.0\.1[0-3][^0-9].*$", string:banner)) security_hole(port); if(ereg(pattern:"^ssh-.*-3\.1\.[0-4][^0-9].*$", string:banner)) security_hole(port); if(ereg(pattern:"^ssh-.*-3\.2\.[0-1][^0-9].*$", string:banner)) security_hole(port);
This archive was generated by hypermail 2b30 : Mon Sep 15 2003 - 09:19:15 PDT