home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / modules / nessus-2.2.8.mo / usr / lib / nessus / plugins / CSCec16481.nasl < prev    next >
Text File  |  2005-01-14  |  5KB  |  187 lines
  1. #
  2. # (C) Tenable Network Security / Description (C) George Theall
  3. #
  4.  
  5.  
  6. if(description)
  7. {
  8.  script_id(14337);
  9.  script_bugtraq_id(10971);
  10.  if (defined_func("script_xref")) script_xref(name:"OSVDB", value:"9009");
  11.  
  12.  script_version("$Revision: 1.3 $");
  13.  name["english"] = "CSCec16481";
  14.  
  15.  script_name(english:name["english"]);
  16.  
  17.  desc["english"] = "
  18. The target is a Cisco device running a version of IOS that is vulnerable
  19. to a DoS attack from a malformed OSPF packet.  Given knowledge of OSPF
  20. area number, netmask, hello, and dead timers that are configured on the
  21. targeted interface, a remote attacker can send a malformed OSPF packet and
  22. cause the device to be reset, which may take several minutes. Note,
  23. though, that the OSPF protocol is not enabled by default.
  24.  
  25. This vulnerability is documented as Cisco Bug ID CSCec16481.
  26.  
  27.  
  28. Solution : http://www.cisco.com/warp/public/707/cisco-sa-20040818-ospf.shtml
  29. Risk factor : High
  30.  
  31. *** As Nessus solely relied on the banner of the remote host
  32. *** this might be a false positive
  33. ";
  34.  script_description(english:desc["english"]);
  35.  
  36.  summary["english"] = "Uses SNMP to determine if a flaw is present";
  37.  script_summary(english:summary["english"]);
  38.  
  39.  script_category(ACT_GATHER_INFO);
  40.  
  41.  script_copyright(english:"This script is (C) 2004 Tenable Network Security and George Theall");
  42.  
  43.  script_family(english:"CISCO");
  44.  
  45.  script_dependencie("snmp_sysDesc.nasl",
  46.              "snmp_cisco_type.nasl");
  47.  script_require_keys("SNMP/community",
  48.               "SNMP/sysDesc",
  49.               "CISCO/model");
  50.  exit(0);
  51. }
  52.  
  53.  
  54. # The code starts here
  55. ok=0;
  56. os = get_kb_item("SNMP/sysDesc"); if(!os)exit(0);
  57. hardware = get_kb_item("CISCO/model"); if(!hardware)exit(0);
  58.  
  59.  
  60.  
  61.  
  62. # Check for the required operating system...
  63. #----------------------------------------------------------------
  64. # Is this IOS ?
  65. if(!egrep(pattern:".*(Internetwork Operating|IOS).*", string:os))exit(0);
  66. # 12.0S
  67. if(egrep(string:os, pattern:"((12\.0\(([0-9]|[1-1][0-9]|2[0-5])\)|12\.0)S[0-9]*|12\.0\(26\)S[0-0]),"))ok=1;
  68.  
  69. # 12.0SX
  70. if(egrep(string:os, pattern:"((12\.0\(([0-9]|[1-1][0-9]|2[0-4])\)|12\.0)SX[0-9]*|12\.0\(25\)SX[0-1]),"))ok=1;
  71.  
  72. # 12.0SY
  73. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)SY[0-9]*,"))ok=1;
  74.  
  75. # 12.0SZ
  76. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)SZ[0-9]*,"))ok=1;
  77.  
  78. # 12.2B
  79. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)B[0-9]*,"))ok=1;
  80.  
  81. # 12.2BC
  82. if(egrep(string:os, pattern:"((12\.2\(([0-9]|1[0-4])\)|12\.2)BC[0-9]*|12\.2\(15\)BC[0-1]),"))ok=1;
  83.  
  84. # 12.2BX
  85. if(egrep(string:os, pattern:"(12\.2\(([0-9]|1[0-5])\)|12\.2)BX[0-9]*,"))ok=1;
  86.  
  87. # 12.2BZ
  88. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)BZ[0-9]*,"))ok=1;
  89.  
  90. # 12.2CX
  91. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)CX[0-9]*,"))ok=1;
  92.  
  93. # 12.2EW
  94. if(egrep(string:os, pattern:"((12\.2\(([0-9]|1[0-7])\)|12\.2)EW[0-9]*|12\.2\(18\)EW[0-0]),"))ok=1;
  95.  
  96. # 12.2MC
  97. if(egrep(string:os, pattern:"((12\.2\(([0-9]|1[0-4])\)|12\.2)MC[0-9]*|12\.2\(15\)MC[0-1]),"))ok=1;
  98.  
  99. # 12.2S
  100. if(egrep(string:os, pattern:"(12\.2\(([0-9]|1[0-9])\)|12\.2)S[0-9]*,"))ok=1;
  101.  
  102. # 12.2SE
  103. if(egrep(string:os, pattern:"(12\.2\(([0-9]|1[0-9])\)|12\.2)SE[0-9]*,"))ok=1;
  104.  
  105. # 12.2SV
  106. if(egrep(string:os, pattern:"(12\.2\(([0-9]|[1-1][0-9]|2[0-1])\)|12\.2)SV[0-9]*,"))ok=1;
  107.  
  108. # 12.2SW
  109. if(egrep(string:os, pattern:"(12\.2\(([0-9]|1[0-9])\)|12\.2)SW[0-9]*,"))ok=1;
  110.  
  111. # 12.2SZ
  112. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)SZ[0-9]*,"))ok=1;
  113.  
  114. # 12.2T
  115. if(egrep(string:os, pattern:"((12\.2\(([0-9]|1[0-4])\)|12\.2)T[0-9]*|12\.2\(15\)T[0-7]),"))ok=1;
  116.  
  117. # 12.2YU
  118. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)YU[0-9]*,"))ok=1;
  119.  
  120. # 12.2YV
  121. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)YV[0-9]*,"))ok=1;
  122.  
  123. # 12.2ZD
  124. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)ZD[0-9]*,"))ok=1;
  125.  
  126. # 12.2ZE
  127. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)ZE[0-9]*,"))ok=1;
  128.  
  129. # 12.2ZF
  130. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)ZF[0-9]*,"))ok=1;
  131.  
  132. # 12.2ZE
  133. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)ZE[0-9]*,"))ok=1;
  134.  
  135. # 12.2ZF
  136. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)ZF[0-9]*,"))ok=1;
  137.  
  138. # 12.2ZG
  139. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)ZG[0-9]*,"))ok=1;
  140.  
  141. # 12.2ZH
  142. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)ZH[0-9]*,"))ok=1;
  143.  
  144. # 12.2ZJ
  145. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)ZJ[0-9]*,"))ok=1;
  146.  
  147. # 12.2ZK
  148. if(egrep(string:os, pattern:"((12\.2\(([0-9]|1[0-4])\)|12\.2)ZK[0-9]*|12\.2\(15\)ZK[0-1]),"))ok=1;
  149.  
  150. # 12.2ZL
  151. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)ZL[0-9]*,"))ok=1;
  152.  
  153. # 12.2ZN
  154. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)ZN[0-9]*,"))ok=1;
  155.  
  156. # 12.2ZO
  157. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)ZO[0-9]*,"))ok=1;
  158.  
  159. # 12.3
  160. if(egrep(string:os, pattern:"(12\.3\([0-4]\)|12\.3),"))ok=1;
  161.  
  162. # 12.3B
  163. if(egrep(string:os, pattern:"(12\.3\([0-4]\)|12\.3)B[0-9]*,"))ok=1;
  164.  
  165. # 12.3BW
  166. if(egrep(string:os, pattern:"(12\.3\([0-9]*\)|12\.3)BW[0-9]*,"))ok=1;
  167.  
  168. # 12.3T
  169. if(egrep(string:os, pattern:"((12\.3\([0-1]\)|12\.3)T[0-9]*|12\.3\(2\)T[0-3]),"))ok=1;
  170.  
  171. # 12.3XA
  172. if(egrep(string:os, pattern:"(12\.3\([0-9]*\)|12\.3)XA[0-9]*,"))ok=1;
  173.  
  174. # 12.3XB
  175. if(egrep(string:os, pattern:"((12\.3\([0-1]\)|12\.3)XB[0-9]*|12\.3\(2\)XB[0-2]),"))ok=1;
  176.  
  177. # 12.3XC
  178. if(egrep(string:os, pattern:"(12\.3\([0-9]*\)|12\.3)XC[0-9]*,"))ok=1;
  179.  
  180. # 12.3XE
  181. if(egrep(string:os, pattern:"(12\.3\([0-9]*\)|12\.3)XE[0-9]*,"))ok=1;
  182.  
  183.  
  184. #----------------------------------------------
  185.  
  186. if(ok)security_hole(port:161, proto:"udp");
  187.