home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / modules / nessus-2.2.8.mo / usr / lib / nessus / plugins / CSCds04747.nasl < prev    next >
Encoding:
Text File  |  2005-01-14  |  9.9 KB  |  360 lines
  1. #
  2. # This script was written by Renaud Deraison <deraison@cvs.nessus.org>
  3. #
  4. # See the Nessus Script License for details
  5. #
  6. # Script audit and contributions from Carmichael Security <http://www.carmichaelsecurity.com>
  7. #      Erik Anderson <eanders@carmichaelsecurity.com>
  8. #      Added BugtraqID and CAN
  9. #
  10.  
  11.  
  12. if(description)
  13. {
  14.  script_id(10976);
  15.  script_bugtraq_id(2682);
  16.  script_version("$Revision: 1.5 $");
  17.  script_cve_id("CAN-2001-0328");
  18.  
  19.  name["english"] = "CSCds04747";
  20.  
  21.  script_name(english:name["english"]);
  22.  
  23.  desc["english"] = "
  24.  
  25. Cisco IOS Software contains a flaw that permits the successful 
  26. prediction of TCP Initial Sequence Numbers.
  27.  
  28. This vulnerability is present in all released versions of Cisco IOS 
  29. software running on Cisco routers and switches. It only affects the 
  30. security of TCP connections that originate or terminate on the 
  31. affected Cisco device itself; it does not apply to TCP traffic 
  32. forwarded through the affected device in transit between two other 
  33. hosts.
  34.  
  35.  
  36. This vulnerability is documented as Cisco bug ID CSCds04747.
  37.  
  38. Solution : 
  39. http://www.cisco.com/warp/public/707/ios-tcp-isn-random-pub.shtml
  40. Risk factor : Medium
  41.  
  42. *** As Nessus solely relied on the banner of the remote host
  43. *** this might be a false positive
  44. ";
  45.  script_description(english:desc["english"]);
  46.  
  47.  summary["english"] = "Uses SNMP to determine if a flaw is present";
  48.  script_summary(english:summary["english"]);
  49.  
  50.  script_category(ACT_GATHER_INFO);
  51.  
  52.  script_copyright(english:"This script is (C) 2002 Renaud Deraison");
  53.  
  54.  script_family(english:"CISCO");
  55.  
  56.  script_dependencie("snmp_sysDesc.nasl",
  57.              "snmp_cisco_type.nasl");
  58.  script_require_keys("SNMP/community",
  59.               "SNMP/sysDesc",
  60.               "CISCO/model");
  61.  exit(0);
  62. }
  63.  
  64.  
  65. # The code starts here
  66. ok=0;
  67. os = get_kb_item("SNMP/sysDesc"); if(!os)exit(0);
  68. hardware = get_kb_item("CISCO/model"); if(!hardware)exit(0);
  69.  
  70.  
  71.  
  72.  
  73. # Check for the required operating system...
  74. #----------------------------------------------------------------
  75. # Is this IOS ?
  76. if(!egrep(pattern:".*(Internetwork Operating|IOS).*", string:os))exit(0);
  77. # 11.0
  78. if(egrep(string:os, pattern:"(11\.0\(([0-9]|[1-1][0-9]|2[0-1])\)|11\.0),"))ok=1;
  79.  
  80. # 11.1
  81. if(egrep(string:os, pattern:"(11\.1\(([0-9]|[1-1][0-9]|2[0-3])\)|11\.1),"))ok=1;
  82.  
  83. # 11.1AA
  84. if(egrep(string:os, pattern:"(11\.1\([0-9]*\)|11\.1)AA[0-9]*,"))ok=1;
  85.  
  86. # 11.1CA
  87. if(egrep(string:os, pattern:"((11\.1\(([0-9]|[1-2][0-9]|3[0-5])\)|11\.1)CA[0-9]*|11\.1\(36\)CA[0-0]),"))ok=1;
  88.  
  89. # 11.1CC
  90. if(egrep(string:os, pattern:"((11\.1\(([0-9]|[1-2][0-9]|3[0-5])\)|11\.1)CC[0-9]*|11\.1\(36\)CC[0-0]),"))ok=1;
  91.  
  92. # 11.1CT
  93. if(egrep(string:os, pattern:"(11\.1\([0-9]*\)|11\.1)CT[0-9]*,"))ok=1;
  94.  
  95. # 11.1IA
  96. if(egrep(string:os, pattern:"((11\.1\(([0-9]|[1-1][0-9]|2[0-7])\)|11\.1)IA[0-9]*|11\.1\(28\)IA[0-0]),"))ok=1;
  97.  
  98. # 11.2
  99. if(egrep(string:os, pattern:"(11\.2\(([0-9]|[1-1][0-9]|2[0-4])\)|11\.2),"))ok=1;
  100.  
  101. # 11.2BC
  102. if(egrep(string:os, pattern:"(11\.2\([0-9]*\)|11\.2)BC[0-9]*,"))ok=1;
  103.  
  104. # 11.2F
  105. if(egrep(string:os, pattern:"(11\.2\([0-9]*\)|11\.2)F[0-9]*,"))ok=1;
  106.  
  107. # 11.2GS
  108. if(egrep(string:os, pattern:"(11\.2\([0-9]*\)|11\.2)GS[0-9]*,"))ok=1;
  109.  
  110. # 11.2P
  111. if(egrep(string:os, pattern:"(11\.2\(([0-9]|[1-1][0-9]|2[0-4])\)|11\.2)P[0-9]*,"))ok=1;
  112.  
  113. # 11.2SA
  114. if(egrep(string:os, pattern:"(11\.2\([0-9]*\)|11\.2)SA[0-9]*,"))ok=1;
  115.  
  116. # 11.2WA3
  117. if(egrep(string:os, pattern:"(11\.2\([0-9]*\)|11\.2)WA3[0-9]*,"))ok=1;
  118.  
  119. # 11.2XA
  120. if(egrep(string:os, pattern:"(11\.2\([0-9]*\)|11\.2)XA[0-9]*,"))ok=1;
  121.  
  122. # 11.3
  123. if(egrep(string:os, pattern:"(11\.3\(([0-9]|1[0-0])\)|11\.3),"))ok=1;
  124.  
  125. # 11.3AA
  126. if(egrep(string:os, pattern:"(11\.3\(([0-9]|1[0-0])\)|11\.3)AA[0-9]*,"))ok=1;
  127.  
  128. # 11.3DA
  129. if(egrep(string:os, pattern:"(11\.3\([0-9]*\)|11\.3)DA[0-9]*,"))ok=1;
  130.  
  131. # 11.3DB
  132. if(egrep(string:os, pattern:"(11\.3\([0-9]*\)|11\.3)DB[0-9]*,"))ok=1;
  133.  
  134. # 11.3HA
  135. if(egrep(string:os, pattern:"(11\.3\([0-9]*\)|11\.3)HA[0-9]*,"))ok=1;
  136.  
  137. # 11.3MA
  138. if(egrep(string:os, pattern:"((11\.3\([0-0]\)|11\.3)MA[0-9]*|11\.3\(1\)MA[0-7]),"))ok=1;
  139.  
  140. # 11.3NA
  141. if(egrep(string:os, pattern:"(11\.3\([0-9]*\)|11\.3)NA[0-9]*,"))ok=1;
  142.  
  143. # 11.3T
  144. if(egrep(string:os, pattern:"((11\.3\(([0-9]|1[0-0])\)|11\.3)T[0-9]*|11\.3\(11\)T[0-0]),"))ok=1;
  145.  
  146. # 11.3WA4
  147. if(egrep(string:os, pattern:"(11\.3\([0-9]*\)|11\.3)WA4[0-9]*,"))ok=1;
  148.  
  149. # 11.3XA
  150. if(egrep(string:os, pattern:"(11\.3\([0-9]*\)|11\.3)XA[0-9]*,"))ok=1;
  151.  
  152. # 12.0
  153. if(egrep(string:os, pattern:"(12\.0\(([0-9]|1[0-4])\)|12\.0),"))ok=1;
  154.  
  155. # 12.0DA
  156. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)DA[0-9]*,"))ok=1;
  157.  
  158. # 12.0DB
  159. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)DB[0-9]*,"))ok=1;
  160.  
  161. # 12.0DC
  162. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)DC[0-9]*,"))ok=1;
  163.  
  164. # 12.0S
  165. if(egrep(string:os, pattern:"((12\.0\(([0-9]|1[0-3])\)|12\.0)S[0-9]*|12\.0\(14\)S[0-0]),"))ok=1;
  166.  
  167. # 12.0SC
  168. if(egrep(string:os, pattern:"((12\.0\(([0-9]|1[0-4])\)|12\.0)SC[0-9]*|12\.0\(15\)SC[0-0]),"))ok=1;
  169.  
  170. # 12.0SL
  171. if(egrep(string:os, pattern:"((12\.0\(([0-9]|1[0-3])\)|12\.0)SL[0-9]*|12\.0\(14\)SL[0-0]),"))ok=1;
  172.  
  173. # 12.0ST
  174. if(egrep(string:os, pattern:"((12\.0\(([0-9]|1[0-0])\)|12\.0)ST[0-9]*|12\.0\(11\)ST[0-1]),"))ok=1;
  175.  
  176. # 12.0SX
  177. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)SX[0-9]*,"))ok=1;
  178.  
  179. # 12.0T
  180. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)T[0-9]*,"))ok=1;
  181.  
  182. # 12.0W5
  183. if(egrep(string:os, pattern:"(12\.0\(([0-9]|1[0-2])\)|12\.0)W5[0-9]*,"))ok=1;
  184.  
  185. # 12.0WT
  186. if(egrep(string:os, pattern:"((12\.0\(([0-9]|1[0-2])\)|12\.0)WT[0-9]*|12\.0\(13\)WT[0-5]),"))ok=1;
  187.  
  188. # 12.0XA
  189. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XA[0-9]*,"))ok=1;
  190.  
  191. # 12.0XB
  192. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XB[0-9]*,"))ok=1;
  193.  
  194. # 12.0XC
  195. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XC[0-9]*,"))ok=1;
  196.  
  197. # 12.0XD
  198. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XD[0-9]*,"))ok=1;
  199.  
  200. # 12.0XE
  201. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XE[0-9]*,"))ok=1;
  202.  
  203. # 12.0XF
  204. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XF[0-9]*,"))ok=1;
  205.  
  206. # 12.0XG
  207. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XG[0-9]*,"))ok=1;
  208.  
  209. # 12.0XH
  210. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XH[0-9]*,"))ok=1;
  211.  
  212. # 12.0XI
  213. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XI[0-9]*,"))ok=1;
  214.  
  215. # 12.0XJ
  216. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XJ[0-9]*,"))ok=1;
  217.  
  218. # 12.0XK
  219. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XK[0-9]*,"))ok=1;
  220.  
  221. # 12.0XL
  222. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XL[0-9]*,"))ok=1;
  223.  
  224. # 12.0XM
  225. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XM[0-9]*,"))ok=1;
  226.  
  227. # 12.0XN
  228. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XN[0-9]*,"))ok=1;
  229.  
  230. # 12.0XP
  231. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XP[0-9]*,"))ok=1;
  232.  
  233. # 12.0XQ
  234. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XQ[0-9]*,"))ok=1;
  235.  
  236. # 12.0QR
  237. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)QR[0-9]*,"))ok=1;
  238.  
  239. # 12.0XS
  240. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XS[0-9]*,"))ok=1;
  241.  
  242. # 12.0XU
  243. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XU[0-9]*,"))ok=1;
  244.  
  245. # 12.0XV
  246. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XV[0-9]*,"))ok=1;
  247.  
  248. # 12.1
  249. if(egrep(string:os, pattern:"(12\.1\([0-6]\)|12\.1),"))ok=1;
  250.  
  251. # 12.1AA
  252. if(egrep(string:os, pattern:"(12\.1\([0-6]\)|12\.1)AA[0-9]*,"))ok=1;
  253.  
  254. # 12.1DA
  255. if(egrep(string:os, pattern:"(12\.1\([0-5]\)|12\.1)DA[0-9]*,"))ok=1;
  256.  
  257. # 12.1CD
  258. if(egrep(string:os, pattern:"(12\.1\([0-3]\)|12\.1)CD[0-9]*,"))ok=1;
  259.  
  260. # 12.DB
  261. if(egrep(string:os, pattern:"(12\.\([0-4]\)|12\.)DB[0-9]*,"))ok=1;
  262.  
  263. # 12.1DC
  264. if(egrep(string:os, pattern:"(12\.1\([0-4]\)|12\.1)DC[0-9]*,"))ok=1;
  265.  
  266. # 12.1E
  267. if(egrep(string:os, pattern:"(12\.1\([0-5]\)|12\.1)E[0-9]*,"))ok=1;
  268.  
  269. # 12.1EC
  270. if(egrep(string:os, pattern:"(12\.1\([0-5]\)|12\.1)EC[0-9]*,"))ok=1;
  271.  
  272. # 12.1EX
  273. if(egrep(string:os, pattern:"(12\.1\([0-4]\)|12\.1)EX[0-9]*,"))ok=1;
  274.  
  275. # 12.1T
  276. if(egrep(string:os, pattern:"((12\.1\([0-4]\)|12\.1)T[0-9]*|12\.1\(5\)T[0-4]),"))ok=1;
  277.  
  278. # 12.1XA
  279. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XA[0-9]*,"))ok=1;
  280.  
  281. # 12.1XB
  282. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XB[0-9]*,"))ok=1;
  283.  
  284. # 12.1XC
  285. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XC[0-9]*,"))ok=1;
  286.  
  287. # 12.1XD
  288. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XD[0-9]*,"))ok=1;
  289.  
  290. # 12.1XE
  291. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XE[0-9]*,"))ok=1;
  292.  
  293. # 12.1XF
  294. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XF[0-9]*,"))ok=1;
  295.  
  296. # 12.1XG
  297. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XG[0-9]*,"))ok=1;
  298.  
  299. # 12.1XH
  300. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XH[0-9]*,"))ok=1;
  301.  
  302. # 12.1XI
  303. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XI[0-9]*,"))ok=1;
  304.  
  305. # 12.1XJ
  306. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XJ[0-9]*,"))ok=1;
  307.  
  308. # 12.1XK
  309. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XK[0-9]*,"))ok=1;
  310.  
  311. # 12.1XL
  312. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XL[0-9]*,"))ok=1;
  313.  
  314. # 12.1XM
  315. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XM[0-9]*,"))ok=1;
  316.  
  317. # 12.1XP
  318. if(egrep(string:os, pattern:"((12\.1\([0-2]\)|12\.1)XP[0-9]*|12\.1\(3\)XP[0-2]),"))ok=1;
  319.  
  320. # 12.1XQ
  321. if(egrep(string:os, pattern:"((12\.1\([0-2]\)|12\.1)XQ[0-9]*|12\.1\(3\)XQ[0-2]),"))ok=1;
  322.  
  323. # 12.1XR
  324. if(egrep(string:os, pattern:"((12\.1\([0-4]\)|12\.1)XR[0-9]*|12\.1\(5\)XR[0-0]),"))ok=1;
  325.  
  326. # 12.1XT
  327. if(egrep(string:os, pattern:"((12\.1\([0-2]\)|12\.1)XT[0-9]*|12\.1\(3\)XT[0-0]),"))ok=1;
  328.  
  329. # 12.1XU
  330. if(egrep(string:os, pattern:"((12\.1\([0-4]\)|12\.1)XU[0-9]*|12\.1\(5\)XU[0-0]),"))ok=1;
  331.  
  332. # 12.1XV
  333. if(egrep(string:os, pattern:"((12\.1\([0-4]\)|12\.1)XV[0-9]*|12\.1\(5\)XV[0-0]),"))ok=1;
  334.  
  335. # 12.1XW
  336. if(egrep(string:os, pattern:"((12\.1\([0-4]\)|12\.1)XW[0-9]*|12\.1\(5\)XW[0-1]),"))ok=1;
  337.  
  338. # 12.1XY
  339. if(egrep(string:os, pattern:"((12\.1\([0-4]\)|12\.1)XY[0-9]*|12\.1\(5\)XY[0-3]),"))ok=1;
  340.  
  341. # 12.1XZ
  342. if(egrep(string:os, pattern:"((12\.1\([0-4]\)|12\.1)XZ[0-9]*|12\.1\(5\)XZ[0-1]),"))ok=1;
  343.  
  344. # 12.1YA
  345. if(egrep(string:os, pattern:"((12\.1\([0-4]\)|12\.1)YA[0-9]*|12\.1\(5\)YA[0-0]),"))ok=1;
  346.  
  347. # 12.1YB
  348. if(egrep(string:os, pattern:"(12\.1\([0-4]\)|12\.1)YB[0-9]*,"))ok=1;
  349.  
  350. # 12.1YC
  351. if(egrep(string:os, pattern:"((12\.1\([0-4]\)|12\.1)YC[0-9]*|12\.1\(5\)YC[0-0]),"))ok=1;
  352.  
  353. # 12.1YD
  354. if(egrep(string:os, pattern:"(12\.1\([0-4]\)|12\.1)YD[0-9]*,"))ok=1;
  355.  
  356.  
  357. #----------------------------------------------
  358.  
  359. if(ok)security_warning(port:161, proto:"udp");
  360.