home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / modules / nessus-2.2.8.mo / usr / lib / nessus / plugins / CSCdw33027.nasl < prev    next >
Encoding:
Text File  |  2005-01-14  |  6.8 KB  |  255 lines
  1. #
  2. # This script was written by Renaud Deraison <deraison@cvs.nessus.org>
  3. #
  4. # See the Nessus Script License for details
  5. #
  6. #
  7.  
  8.  
  9. if(description)
  10. {
  11.  script_id(11381);
  12.  script_bugtraq_id(5114);
  13.  script_cve_id("CVE-2002-1024");
  14.  if(defined_func("script_xref"))script_xref(name:"IAVA", value:"2001-A-0013");
  15.  
  16.  script_version("$Revision: 1.6 $");
  17.  
  18.  name["english"] = "CSCdw33027";
  19.  
  20.  script_name(english:name["english"]);
  21.  
  22.  desc["english"] = "
  23.  
  24. It is possible to make the remote IOS crash when sending
  25. it malformed SSH packets.
  26.  
  27. Solution : See http://www.cisco.com/warp/public/707/SSH-scanning.shtml
  28. Risk factor : High
  29.  
  30. *** As Nessus solely relied on the banner of the remote host
  31. *** this might be a false positive
  32. ";
  33.  script_description(english:desc["english"]);
  34.  
  35.  summary["english"] = "Uses SNMP to determine if a flaw is present";
  36.  script_summary(english:summary["english"]);
  37.  
  38.  script_category(ACT_GATHER_INFO);
  39.  
  40.  script_copyright(english:"This script is (C) 2003 Renaud Deraison");
  41.  
  42.  script_family(english:"CISCO");
  43.  
  44.  script_dependencie("snmp_sysDesc.nasl",
  45.              "snmp_cisco_type.nasl");
  46.  script_require_keys("SNMP/community",
  47.               "SNMP/sysDesc",
  48.               "CISCO/model");
  49.  exit(0);
  50. }
  51.  
  52.  
  53. # The code starts here
  54. ok=0;
  55. os = get_kb_item("SNMP/sysDesc"); if(!os)exit(0);
  56. hardware = get_kb_item("CISCO/model"); if(!hardware)exit(0);
  57.  
  58.  
  59.  
  60.  
  61. # Check for the required operating system...
  62. #----------------------------------------------------------------
  63. # Is this IOS ?
  64. if(!egrep(pattern:".*(Internetwork Operating|IOS).*", string:os))exit(0);
  65. # 12.0S
  66. if(egrep(string:os, pattern:"((12\.0\(([0-9]|1[0-6])\)|12\.0)S[0-9]*|12\.0\(17\)S[0-3]),"))ok=1;
  67.  
  68. # 12.0SP
  69. if(egrep(string:os, pattern:"((12\.0\(([0-9]|1[0-9])\)|12\.0)SP[0-9]*|12\.0\(20\)SP[0-1]),"))ok=1;
  70.  
  71. # 12.0ST
  72. if(egrep(string:os, pattern:"((12\.0\(([0-9]|1[0-6])\)|12\.0)ST[0-9]*|12\.0\(17\)ST[0-4]),"))ok=1;
  73.  
  74. # 12.0XB
  75. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XB[0-9]*,"))ok=1;
  76.  
  77. # 12.0XM
  78. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XM[0-9]*,"))ok=1;
  79.  
  80. # 12.0XV
  81. if(egrep(string:os, pattern:"(12\.0\([0-9]*\)|12\.0)XV[0-9]*,"))ok=1;
  82.  
  83. # 12.1E
  84. if(egrep(string:os, pattern:"(12\.1\(([0-9][^0-9]|10.[0-4])\)|12\.1)E[0-9]*,"))ok=1;
  85.  
  86. # 12.1EC
  87. if(egrep(string:os, pattern:"(12\.1\(([0-9][^0-9]|10.[0-4])\)|12\.1)EC[0-9]*,"))ok=1;
  88.  
  89. # 12.1EX
  90. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)EX[0-9]*,"))ok=1;
  91.  
  92. # 12.1T
  93. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)T[0-9]*,"))ok=1;
  94.  
  95. # 12.1XB
  96. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XB[0-9]*,"))ok=1;
  97.  
  98. # 12.1XC
  99. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XC[0-9]*,"))ok=1;
  100.  
  101. # 12.1XF
  102. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XF[0-9]*,"))ok=1;
  103.  
  104. # 12.1XG
  105. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XG[0-9]*,"))ok=1;
  106.  
  107. # 12.1XH
  108. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XH[0-9]*,"))ok=1;
  109.  
  110. # 12.1X1
  111. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)X1[0-9]*,"))ok=1;
  112.  
  113. # 12.1XJ
  114. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XJ[0-9]*,"))ok=1;
  115.  
  116. # 12.1XL
  117. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XL[0-9]*,"))ok=1;
  118.  
  119. # 12.1XM
  120. if(egrep(string:os, pattern:"((12\.1\([0-4]\)|12\.1)XM[0-9]*|12\.1\(5\)XM[0-6]),"))ok=1;
  121.  
  122. # 12.1XP
  123. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XP[0-9]*,"))ok=1;
  124.  
  125. # 12.1XQ
  126. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XQ[0-9]*,"))ok=1;
  127.  
  128. # 12.1XT
  129. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XT[0-9]*,"))ok=1;
  130.  
  131. # 12.1XU
  132. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)XU[0-9]*,"))ok=1;
  133.  
  134. # 12.1YB
  135. if(egrep(string:os, pattern:"((12\.1\([0-4]\)|12\.1)YB[0-9]*|12\.1\(5\)YB[0-5]),"))ok=1;
  136.  
  137. # 12.1YC
  138. if(egrep(string:os, pattern:"((12\.1\([0-4]\)|12\.1)YC[0-9]*|12\.1\(5\)YC[0-2]),"))ok=1;
  139.  
  140. # 12.1YD
  141. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)YD[0-9]*,"))ok=1;
  142.  
  143. # 12.1YE
  144. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)YE[0-9]*,"))ok=1;
  145.  
  146. # 12.1YF
  147. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)YF[0-9]*,"))ok=1;
  148.  
  149. # 12.1YI
  150. if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)YI[0-9]*,"))ok=1;
  151.  
  152. # 12.2
  153. if(egrep(string:os, pattern:"(12\.2\([0-6]\)|12\.2),"))ok=1;
  154.  
  155. # 12.B
  156. if(egrep(string:os, pattern:"((12\.\([0-3]\)|12\.)B[0-9]*|12\.\(4\)B[0-2]),"))ok=1;
  157.  
  158. # 12.2BC
  159. if(egrep(string:os, pattern:"((12\.2\([0-7]\)|12\.2)BC[0-9]*|12\.2\(8\)BC[0-0]),"))ok=1;
  160.  
  161. # 12.2DA
  162. if(egrep(string:os, pattern:"(12\.2\([0-6]\)|12\.2)DA[0-9]*,"))ok=1;
  163.  
  164. # 12.2DD
  165. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)DD[0-9]*,"))ok=1;
  166.  
  167. # 12.2S
  168. if(egrep(string:os, pattern:"(12\.2\(([0-6][^0-9]|7.[0-3])\)|12\.2)S[0-9]*,"))ok=1;
  169.  
  170. # 12.2T
  171. if(egrep(string:os, pattern:"(12\.2\([0-7]\)|12\.2)T[0-9]*,"))ok=1;
  172.  
  173. # 12.2XA
  174. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)XA[0-9]*,"))ok=1;
  175.  
  176. # 12.2XB
  177. if(egrep(string:os, pattern:"((12\.2\([0-1]\)|12\.2)XB[0-9]*|12\.2\(2\)XB[0-3]),"))ok=1;
  178.  
  179. # 12.2XD
  180. if(egrep(string:os, pattern:"((12\.2\([0-0]\)|12\.2)XD[0-9]*|12\.2\(1\)XD[0-3]),"))ok=1;
  181.  
  182. # 12.2XE
  183. if(egrep(string:os, pattern:"((12\.2\([0-0]\)|12\.2)XE[0-9]*|12\.2\(1\)XE[0-2]),"))ok=1;
  184.  
  185. # 12.2XF
  186. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)XF[0-9]*,"))ok=1;
  187.  
  188. # 12.2XG
  189. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)XG[0-9]*,"))ok=1;
  190.  
  191. # 12.2XH
  192. if(egrep(string:os, pattern:"((12\.2\([0-1]\)|12\.2)XH[0-9]*|12\.2\(2\)XH[0-2]),"))ok=1;
  193.  
  194. # 12.2XI
  195. if(egrep(string:os, pattern:"((12\.2\([0-1]\)|12\.2)XI[0-9]*|12\.2\(2\)XI[0-1]),"))ok=1;
  196.  
  197. # 12.2XJ
  198. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)XJ[0-9]*,"))ok=1;
  199.  
  200. # 12.2XK
  201. if(egrep(string:os, pattern:"((12\.2\([0-1]\)|12\.2)XK[0-9]*|12\.2\(2\)XK[0-2]),"))ok=1;
  202.  
  203. # 12.2XL
  204. if(egrep(string:os, pattern:"((12\.2\([0-3]\)|12\.2)XL[0-9]*|12\.2\(4\)XL[0-4]),"))ok=1;
  205.  
  206. # 12.2XM
  207. if(egrep(string:os, pattern:"((12\.2\([0-3]\)|12\.2)XM[0-9]*|12\.2\(4\)XM[0-3]),"))ok=1;
  208.  
  209. # 12.2XN
  210. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)XN[0-9]*,"))ok=1;
  211.  
  212. # 12.2XQ
  213. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)XQ[0-9]*,"))ok=1;
  214.  
  215. # 12.2XR
  216. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)XR[0-9]*,"))ok=1;
  217.  
  218. # 12.2XS
  219. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)XS[0-9]*,"))ok=1;
  220.  
  221. # 12.2XT
  222. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)XT[0-9]*,"))ok=1;
  223.  
  224. # 12.2XW
  225. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)XW[0-9]*,"))ok=1;
  226.  
  227. # 12.2XW
  228. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)XW[0-9]*,"))ok=1;
  229.  
  230. # 12.2YA
  231. if(egrep(string:os, pattern:"((12\.2\([0-3]\)|12\.2)YA[0-9]*|12\.2\(4\)YA[0-1]),"))ok=1;
  232.  
  233. # 12.2YB
  234. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)YB[0-9]*,"))ok=1;
  235.  
  236. # 12.2YC
  237. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)YC[0-9]*,"))ok=1;
  238.  
  239. # 12.2YD
  240. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)YD[0-9]*,"))ok=1;
  241.  
  242. # 12.2YF
  243. if(egrep(string:os, pattern:"(12\.2\([0-9]*\)|12\.2)YF[0-9]*,"))ok=1;
  244.  
  245. # 12.2YG
  246. if(egrep(string:os, pattern:"(12\.2\([0-3]\)|12\.2)YG[0-9]*,"))ok=1;
  247.  
  248. # 12.2YH
  249. if(egrep(string:os, pattern:"(12\.2\([0-3]\)|12\.2)YH[0-9]*,"))ok=1;
  250.  
  251.  
  252. #----------------------------------------------
  253.  
  254. if(ok)security_hole(port:161, proto:"udp");
  255.