home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / modules / nessus-2.2.8.mo / usr / lib / nessus / plugins / CSCdt93866.nasl < prev    next >
Text File  |  2005-01-14  |  11KB  |  410 lines
  1. #
  2. # This script was written by Renaud Deraison <deraison@cvs.nessus.org>
  3. #
  4. # See the Nessus Script License for details
  5. #
  6. # Script audit and contributions from Carmichael Security <http://www.carmichaelsecurity.com>
  7. #      Erik Anderson <eanders@carmichaelsecurity.com>
  8. #      Added BugtraqID and CVE
  9. #
  10.  
  11.  
  12. if(description)
  13. {
  14.  script_id(10982);
  15.  script_bugtraq_id(2540);
  16.  script_version("$Revision: 1.4 $");
  17.  script_cve_id("CVE-2001-0414");
  18.  
  19.  name["english"] = "CSCdt93866";
  20.  
  21.  script_name(english:name["english"]);
  22.  
  23.  desc["english"] = "
  24.  
  25. By sending a crafted NTP control packet, it is possible to trigger a 
  26. buffer overflow in the NTP daemon. This vulnerability can be 
  27. exploited remotely. The successful exploitation may cause arbitrary 
  28. code to be executed on the target machine.
  29.  
  30. This vulnerability is documented as Cisco Bug ID CSCdt93866.
  31.  
  32.  
  33. An attacker may use this flaw to execute arbitrary code on
  34. the remote host (although it's believed to not be doable)
  35. Solution : http://www.cisco.com/warp/public/707/NTP-pub.shtml
  36. Risk factor : High
  37.  
  38. *** As Nessus solely relied on the banner of the remote host
  39. *** this might be a false positive
  40. ";
  41.  script_description(english:desc["english"]);
  42.  
  43.  summary["english"] = "Uses SNMP to determine if a flaw is present";
  44.  script_summary(english:summary["english"]);
  45.  
  46.  script_category(ACT_GATHER_INFO);
  47.  
  48.  script_copyright(english:"This script is (C) 2002 Renaud Deraison");
  49.  
  50.  script_family(english:"CISCO");
  51.  
  52.  script_dependencie("snmp_sysDesc.nasl",
  53.              "snmp_cisco_type.nasl");
  54.  script_require_keys("SNMP/community",
  55.               "SNMP/sysDesc",
  56.               "CISCO/model");
  57.  exit(0);
  58. }
  59.  
  60.  
  61. # The code starts here
  62. ok=0;
  63. os = get_kb_item("SNMP/sysDesc"); if(!os)exit(0);
  64. hardware = get_kb_item("CISCO/model"); if(!hardware)exit(0);
  65.  
  66.  
  67.  
  68.  
  69. # Check for the required operating system...
  70. #----------------------------------------------------------------
  71. # Is this IOS ?
  72. if(!egrep(pattern:".*(Internetwork Operating|IOS).*", string:os))exit(0);
  73. # 10.3
  74. if(egrep(string:os, pattern:"(10\.3\([0-9]*\)|10\.3),"))ok=1;
  75.  
  76. # 11.0
  77. if(egrep(string:os, pattern:"(11\.0\([0-9]*\)|11\.0),"))ok=1;
  78.  
  79. # 11.1
  80. if(egrep(string:os, pattern:"(11\.1\([0-9]*\)|11\.1),"))ok=1;
  81.  
  82. # 11.1AA
  83. if(egrep(string:os, pattern:"(11\.1\([0-9]*\)|11\.1)AA[0-9]*,"))ok=1;
  84.  
  85. # 11.1CA
  86. if(egrep(string:os, pattern:"(11\.1\([0-9]*\)|11\.1)CA[0-9]*,"))ok=1;
  87.  
  88. # 11.1CC
  89. if(egrep(string:os, pattern:"((11\.1\(([0-9]|[1-2][0-9]|3[0-5])\)|11\.1)CC[0-9]*|11\.1\(36\)CC[0-1]),"))ok=1;
  90.  
  91. # 11.1CT
  92. if(egrep(string:os, pattern:"(11\.1\([0-9]*\)|11\.1)CT[0-9]*,"))ok=1;
  93.  
  94. # 11.1IA
  95. if(egrep(string:os, pattern:"(11\.1\([0-9]*\)|11\.1)IA[0-9]*,"))ok=1;
  96.  
  97. # 11.2
  98. if(egrep(string:os, pattern:"(11\.2\(([0-9]|[1-1][0-9]|2[0-5])\)|11\.2),"))ok=1;
  99.  
  100. # 11.2BC
  101. if(egrep(string:os, pattern:"(11\.2\([0-9]*\)|11\.2)BC[0-9]*,"))ok=1;
  102.  
  103. # 11.2F
  104. if(egrep(string:os, pattern:"(11\.2\([0-9]*\)|11\.2)F[0-9]*,"))ok=1;
  105.  
  106. # 11.2GS
  107. if(egrep(string:os, pattern:"(11\.2\([0-9]*\)|11\.2)GS[0-9]*,"))ok=1;
  108.  
  109. # 11.2P
  110. if(egrep(string:os, pattern:"(11\.2\([0-9]*\)|11\.2)P[0-9]*,"))ok=1;
  111.  
  112. # 11.2SA
  113. if(egrep(string:os, pattern:"(11\.2\([0-9]*\)|11\.2)SA[0-9]*,"))ok=1;
  114.  
  115. # 11.2WA4
  116. if(egrep(string:os, pattern:"(11\.2\([0-9]*\)|11\.2)WA4[0-9]*,"))ok=1;
  117.  
  118. # 11.2XA
  119. if(egrep(string:os, pattern:"(11\.2\([0-9]*\)|11\.2)XA[0-9]*,"))ok=1;
  120.  
  121. # 11.3
  122. if(egrep(string:os, pattern:"(11\.3\([0-9]*\)|11\.3),"))ok=1;
  123.  
  124. # 11.3AA
  125. if(egrep(string:os, pattern:"(11\.3\([0-9]*\)|11\.3)AA[0-9]*,"))ok=1;
  126.  
  127. # 11.3DA
  128. if(egrep(string:os, pattern:"(11\.3\([0-9]*\)|11\.3)DA[0-9]*,"))ok=1;
  129.  
  130. # 11.3DB
  131. if(egrep(string:os, pattern:"(11\.3\([0-9]*\)|11\.3)DB[0-9]*,"))ok=1;
  132.  
  133. # 11.3HA
  134. if(egrep(string:os, pattern:"(11\.3\([0-9]*\)|11\.3)HA[0-9]*,"))ok=1;
  135.  
  136. # 11.3MA
  137. if(egrep(string:os, pattern:"(11\.3\([0-9]*\)|11\.3)MA[0-9]*,"))ok=1;
  138.  
  139. # 11.3NA
  140. if(egrep(string:os, pattern:"(11\.3\([0-9]*\)|11\.3)NA[0-9]*,"))ok=1;
  141.  
  142. # 11.3T
  143. if(egrep(string:os, pattern:"(11\.3\([0-9]*\)|11\.3)T[0-9]*,"))ok=1;
  144.  
  145. # 11.3XA
  146. if(egrep(string:os, pattern:"(11\.3\([0-9]*\)|11\.3)XA[0-9]*,"))ok=1;
  147.  
  148. # 11.3WA4
  149. if(egrep(string:os, pattern:"(11\.3\([0-9]*\)|11\.3)WA4[0-9]*,"))ok=1;
  150.  
  151. # 12.0
  152. if(egrep(string:os, pattern:"(12\.0\(([0-9]|1[0-7])\)|12\.0),"))ok=1;
  153.  
  154. # 12.0DA
  155. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)DA[0-9]*,"))ok=1;
  156.  
  157. # 12.0DB
  158. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)DB[0-9]*,"))ok=1;
  159.  
  160. # 12.0DC
  161. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)DC[0-9]*,"))ok=1;
  162.  
  163. # 12.0S
  164. if(egrep(string:os, pattern:"(12\.0\(([0-9]|1[0-7])\)|12\.0)S[0-9]*,"))ok=1;
  165.  
  166. # 12.0SC
  167. if(egrep(string:os, pattern:"(12\.0\(([0-9]|1[0-5])\)|12\.0)SC[0-9]*,"))ok=1;
  168.  
  169. # 12.0SL
  170. if(egrep(string:os, pattern:"((12\.0\(([0-9]|1[0-6])\)|12\.0)SL[0-9]*|12\.0\(17\)SL[0-1]),"))ok=1;
  171.  
  172. # 12.0ST
  173. if(egrep(string:os, pattern:"((12\.0\(([0-9]|1[0-6])\)|12\.0)ST[0-9]*|12\.0\(17\)ST[0-0]),"))ok=1;
  174.  
  175. # 12.0T
  176. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)T[0-9]*,"))ok=1;
  177.  
  178. # 12.0W5
  179. if(egrep(string:os, pattern:"(12\.0\(([0-9]|1[0-5])\)|12\.0)W5[0-9]*,"))ok=1;
  180.  
  181. # 12.0WC
  182. if(egrep(string:os, pattern:"((12\.0\([0-4]\)|12\.0)WC[0-9]*|12\.0\(5\)WC[0-1]),"))ok=1;
  183.  
  184. # 12.0WT
  185. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)WT[0-9]*,"))ok=1;
  186.  
  187. # 12.0XA
  188. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XA[0-9]*,"))ok=1;
  189.  
  190. # 12.0XB
  191. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XB[0-9]*,"))ok=1;
  192.  
  193. # 12.0XC
  194. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XC[0-9]*,"))ok=1;
  195.  
  196. # 12.0XD
  197. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XD[0-9]*,"))ok=1;
  198.  
  199. # 12.0XE
  200. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XE[0-9]*,"))ok=1;
  201.  
  202. # 12.0XF
  203. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XF[0-9]*,"))ok=1;
  204.  
  205. # 12.0XG
  206. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XG[0-9]*,"))ok=1;
  207.  
  208. # 12.0XH
  209. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XH[0-9]*,"))ok=1;
  210.  
  211. # 12.0XI
  212. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XI[0-9]*,"))ok=1;
  213.  
  214. # 12.0XJ
  215. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XJ[0-9]*,"))ok=1;
  216.  
  217. # 12.0XJ
  218. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XJ[0-9]*,"))ok=1;
  219.  
  220. # 12.0XK
  221. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XK[0-9]*,"))ok=1;
  222.  
  223. # 12.0XL
  224. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XL[0-9]*,"))ok=1;
  225.  
  226. # 12.0XM
  227. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XM[0-9]*,"))ok=1;
  228.  
  229. # 12.0XN
  230. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XN[0-9]*,"))ok=1;
  231.  
  232. # 12.0XP
  233. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XP[0-9]*,"))ok=1;
  234.  
  235. # 12.0XQ
  236. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XQ[0-9]*,"))ok=1;
  237.  
  238. # 12.0XR
  239. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XR[0-9]*,"))ok=1;
  240.  
  241. # 12.0XS
  242. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XS[0-9]*,"))ok=1;
  243.  
  244. # 12.0XU
  245. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XU[0-9]*,"))ok=1;
  246.  
  247. # 12.0XV
  248. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XV[0-9]*,"))ok=1;
  249.  
  250. # 12.1
  251. if(egrep(string:os, pattern:"(12\.1\([0-8]\)|12\.1),"))ok=1;
  252.  
  253. # 12.1AA
  254. if(egrep(string:os, pattern:"(12\.1\([0-8]\)|12\.1)AA[0-9]*,"))ok=1;
  255.  
  256. # 12.1CX
  257. if(egrep(string:os, pattern:"(12\.1\([0-6]\)|12\.1)CX[0-9]*,"))ok=1;
  258.  
  259. # 12.1DA
  260. if(egrep(string:os, pattern:"((12\.1\([0-6]\)|12\.1)DA[0-9]*|12\.1\(7\)DA[0-1]),"))ok=1;
  261.  
  262. # 12.1DB
  263. if(egrep(string:os, pattern:"(12\.1\([0-1]\)|12\.1)DB[0-9]*,"))ok=1;
  264.  
  265. # 12.1DC
  266. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)DC[0-9]*,"))ok=1;
  267.  
  268. # 12.1E
  269. if(egrep(string:os, pattern:"(12\.1\([0-8]\)|12\.1)E[0-9]*,"))ok=1;
  270.  
  271. # 12.1EC
  272. if(egrep(string:os, pattern:"(12\.1\([0-6]\)|12\.1)EC[0-9]*,"))ok=1;
  273.  
  274. # 12.1EX
  275. if(egrep(string:os, pattern:"(12\.1\([0-8]\)|12\.1)EX[0-9]*,"))ok=1;
  276.  
  277. # 12.1EY
  278. if(egrep(string:os, pattern:"(12\.1\([0-5]\)|12\.1)EY[0-9]*,"))ok=1;
  279.  
  280. # 12.1EZ
  281. if(egrep(string:os, pattern:"((12\.1\([0-5]\)|12\.1)EZ[0-9]*|12\.1\(6\)EZ[0-1]),"))ok=1;
  282.  
  283. # 12.1T
  284. if(egrep(string:os, pattern:"((12\.1\([0-4]\)|12\.1)T[0-9]*|12\.1\(5\)T[0-8]),"))ok=1;
  285.  
  286. # 12.1XA
  287. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XA[0-9]*,"))ok=1;
  288.  
  289. # 12.1XB
  290. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XB[0-9]*,"))ok=1;
  291.  
  292. # 12.1XC
  293. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XC[0-9]*,"))ok=1;
  294.  
  295. # 12.1XD
  296. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XD[0-9]*,"))ok=1;
  297.  
  298. # 12.1XE
  299. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XE[0-9]*,"))ok=1;
  300.  
  301. # 12.1XF
  302. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XF[0-9]*,"))ok=1;
  303.  
  304. # 12.1XG
  305. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XG[0-9]*,"))ok=1;
  306.  
  307. # 12.1XH
  308. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XH[0-9]*,"))ok=1;
  309.  
  310. # 12.1XI
  311. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XI[0-9]*,"))ok=1;
  312.  
  313. # 12.1XJ
  314. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XJ[0-9]*,"))ok=1;
  315.  
  316. # 12.1XK
  317. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XK[0-9]*,"))ok=1;
  318.  
  319. # 12.1XL
  320. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XL[0-9]*,"))ok=1;
  321.  
  322. # 12.1XM
  323. if(egrep(string:os, pattern:"((12\.1\([0-4]\)|12\.1)XM[0-9]*|12\.1\(5\)XM[0-3]),"))ok=1;
  324.  
  325. # 12.1XP
  326. if(egrep(string:os, pattern:"((12\.1\([0-4]\)|12\.1)XP[0-9]*|12\.1\(5\)XP[0-3]),"))ok=1;
  327.  
  328. # 12.1XQ
  329. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XQ[0-9]*,"))ok=1;
  330.  
  331. # 12.1XR
  332. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XR[0-9]*,"))ok=1;
  333.  
  334. # 12.1XS
  335. if(egrep(string:os, pattern:"((12\.1\([0-4]\)|12\.1)XS[0-9]*|12\.1\(5\)XS[0-1]),"))ok=1;
  336.  
  337. # 12.1XT
  338. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XT[0-9]*,"))ok=1;
  339.  
  340. # 12.1XU
  341. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XU[0-9]*,"))ok=1;
  342.  
  343. # 12.1XV
  344. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XV[0-9]*,"))ok=1;
  345.  
  346. # 12.1XW
  347. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XW[0-9]*,"))ok=1;
  348.  
  349. # 12.1XX
  350. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XX[0-9]*,"))ok=1;
  351.  
  352. # 12.1XY
  353. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XY[0-9]*,"))ok=1;
  354.  
  355. # 12.1XZ
  356. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XZ[0-9]*,"))ok=1;
  357.  
  358. # 12.1YA
  359. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)YA[0-9]*,"))ok=1;
  360.  
  361. # 12.1YB
  362. if(egrep(string:os, pattern:"((12\.1\([0-4]\)|12\.1)YB[0-9]*|12\.1\(5\)YB[0-3]),"))ok=1;
  363.  
  364. # 12.1YC
  365. if(egrep(string:os, pattern:"((12\.1\([0-4]\)|12\.1)YC[0-9]*|12\.1\(5\)YC[0-0]),"))ok=1;
  366.  
  367. # 12.1YD
  368. if(egrep(string:os, pattern:"((12\.1\([0-4]\)|12\.1)YD[0-9]*|12\.1\(5\)YD[0-1]),"))ok=1;
  369.  
  370. # 12.1YF
  371. if(egrep(string:os, pattern:"((12\.1\([0-4]\)|12\.1)YF[0-9]*|12\.1\(5\)YF[0-1]),"))ok=1;
  372.  
  373. # 12.2
  374. if(egrep(string:os, pattern:"(12\.2\([0-2]\)|12\.2),"))ok=1;
  375.  
  376. # 12.2B
  377. if(egrep(string:os, pattern:"(12\.2\([0-1]\)|12\.2)B[0-9]*,"))ok=1;
  378.  
  379. # 12.2PB
  380. if(egrep(string:os, pattern:"(12\.2\([0-3]\)|12\.2)PB[0-9]*,"))ok=1;
  381.  
  382. # 12.2PI
  383. if(egrep(string:os, pattern:"(12\.2\([0-1]\)|12\.2)PI[0-9]*,"))ok=1;
  384.  
  385. # 12.2S
  386. if(egrep(string:os, pattern:"(12\.2\([0-1]\)|12\.2)S[0-9]*,"))ok=1;
  387.  
  388. # 12.2T
  389. if(egrep(string:os, pattern:"(12\.2\([0-3]\)|12\.2)T[0-9]*,"))ok=1;
  390.  
  391. # 12.2XA
  392. if(egrep(string:os, pattern:"((12\.2\([0-1]\)|12\.2)XA[0-9]*|12\.2\(2\)XA[0-0]),"))ok=1;
  393.  
  394. # 12.2XD
  395. if(egrep(string:os, pattern:"((12\.2\([0-0]\)|12\.2)XD[0-9]*|12\.2\(1\)XD[0-0]),"))ok=1;
  396.  
  397. # 12.2XE
  398. if(egrep(string:os, pattern:"(12\.2\([0-0]\)|12\.2)XE[0-9]*,"))ok=1;
  399.  
  400. # 12.2XH
  401. if(egrep(string:os, pattern:"(12\.2\([0-0]\)|12\.2)XH[0-9]*,"))ok=1;
  402.  
  403. # 12.2XQ
  404. if(egrep(string:os, pattern:"(12\.2\([0-0]\)|12\.2)XQ[0-9]*,"))ok=1;
  405.  
  406.  
  407. #----------------------------------------------
  408.  
  409. if(ok)security_hole(port:161, proto:"udp");
  410.