Re: [Plugins-writers] ssltest.nasl + ssl_func.inc + false positives againsst IIS ?

Previous message: Uri Gilad: "[Plugins-writers] Checking NAV"
In reply to: Haroon Meer: "[Plugins-writers] ssltest.nasl + ssl_func.inc + false positives againsst IIS ?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

jwlampe@private

Haroon Meer wrote:

> Hi guys..
> 
> We recently started picking up false positives with the ssltest.nasl
> (OpenSSL overflow via invalid certificate passing) (script_id(11875))
> against IIS servers.
> 
> The nasl _does_ do a check for IIS, Netware etc prior to testing by
> sending a client_hello(mymlen:0, mymtype:0, myversion:15) and checking
> for a response.
> 
> A response (according to the script) indicates an
> IIS/Netware/Non-OpenSSL implementation and the test exits there..
> 
> This used to work ferpectly : (ssltest.nasl renamed ssltest2 with more
> displays()'s)
> 

I committed some changes last night.  Can you please check the latest 
rev (1.23) of ssltest.nasl (with newest ssl_funcs.inc as well)?  The IIS 
servers should now be weeded out prior to the meaty portion of the check 
running.

John

_______________________________________________
Plugins-writers mailing list
Plugins-writers@private
http://mail.nessus.org/mailman/listinfo/plugins-writers