home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / modules / nessus-2.2.8.mo / usr / lib / nessus / plugins / mandrake_MDKSA-2003-010.nasl < prev    next >
Encoding:
Text File  |  2005-01-14  |  7.3 KB  |  263 lines
  1. #
  2. # (C) Tenable Network Security
  3. #
  4. # This plugin text was extracted from Mandrake Linux Security Advisory MDKSA-2003:010
  5. #
  6.  
  7.  
  8. if ( ! defined_func("bn_random") ) exit(0);
  9. if(description)
  10. {
  11.  script_id(13995);
  12.  script_version ("$Revision: 1.2 $");
  13.  script_cve_id("CAN-2003-0034", "CAN-2003-0035", "CAN-2003-0036");
  14.  
  15.  name["english"] = "MDKSA-2003:010: printer-drivers";
  16.  
  17.  script_name(english:name["english"]);
  18.  
  19.  desc["english"] = "
  20. The remote host is missing the patch for the advisory MDKSA-2003:010 (printer-drivers).
  21.  
  22.  
  23. Karol Wiesek and iDefense disovered three vulnerabilities in the printer-drivers
  24. package and tools it installs. These vulnerabilities allow a local attacker to
  25. empty or create any file on the filesystem.
  26. The first vulnerability is in the mtink binary, which has a buffer overflow in
  27. its handling of the HOME environment variable.
  28. The second vulnerability is in the escputil binary, which has a buffer overflow
  29. in the parsing of the --printer-name command line argument. This is only
  30. possible when esputil is suid or sgid; in Mandrake Linux 9.0 it was sgid 'sys'.
  31. Successful exploitation will provide the attacker with the privilege of the
  32. group 'sys'.
  33. The third vulnerability is in the ml85p binary which contains a race condition
  34. in the opening of a temporary file. By default this file is installed suid root
  35. so it can be used to gain root privilege. The only caveat is that this file is
  36. not executable by other, only by root or group 'sys'. Using either of the two
  37. previous vulnerabilities, an attacker can exploit one of them to obtain 'sys'
  38. privilege' and then use that to exploit this vulnerability to gain root
  39. privilege.
  40. MandrakeSoft encourages all users to upgrade immediately.
  41. Aside from the security vulnerabilities, a number of bugfixes are included in
  42. this update, for Mandrake Linux 9.0 users. GIMP-Print 4.2.5pre1, HPIJS 1.3,
  43. pnm2ppa 1.12, mtink 0.9.53, and a new foomatic snapshot are included. For a list
  44. of the many bugfixes, please refer to the RPM changelog.
  45.  
  46.  
  47. Solution : http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:010
  48. Risk factor : High";
  49.  
  50.  
  51.  
  52.  script_description(english:desc["english"]);
  53.  
  54.  summary["english"] = "Check for the version of the printer-drivers package";
  55.  script_summary(english:summary["english"]);
  56.  
  57.  script_category(ACT_GATHER_INFO);
  58.  
  59.  script_copyright(english:"This script is Copyright (C) 2004 Tenable Network Security");
  60.  family["english"] = "Mandrake Local Security Checks";
  61.  script_family(english:family["english"]);
  62.  
  63.  script_dependencies("ssh_get_info.nasl");
  64.  script_require_keys("Host/Mandrake/rpm-list");
  65.  exit(0);
  66. }
  67.  
  68. include("rpm.inc");
  69. if ( rpm_check( reference:"ghostscript-5.50-67.1mdk", release:"MDK8.0", yank:"mdk") )
  70. {
  71.  security_hole(0);
  72.  exit(0);
  73. }
  74. if ( rpm_check( reference:"ghostscript-module-X-5.50-67.1mdk", release:"MDK8.0", yank:"mdk") )
  75. {
  76.  security_hole(0);
  77.  exit(0);
  78. }
  79. if ( rpm_check( reference:"ghostscript-utils-5.50-67.1mdk", release:"MDK8.0", yank:"mdk") )
  80. {
  81.  security_hole(0);
  82.  exit(0);
  83. }
  84. if ( rpm_check( reference:"cups-drivers-1.1-15.1mdk", release:"MDK8.1", yank:"mdk") )
  85. {
  86.  security_hole(0);
  87.  exit(0);
  88. }
  89. if ( rpm_check( reference:"foomatic-1.1-0.20010923.1mdk", release:"MDK8.1", yank:"mdk") )
  90. {
  91.  security_hole(0);
  92.  exit(0);
  93. }
  94. if ( rpm_check( reference:"ghostscript-6.51-24.1mdk", release:"MDK8.1", yank:"mdk") )
  95. {
  96.  security_hole(0);
  97.  exit(0);
  98. }
  99. if ( rpm_check( reference:"ghostscript-module-X-6.51-24.1mdk", release:"MDK8.1", yank:"mdk") )
  100. {
  101.  security_hole(0);
  102.  exit(0);
  103. }
  104. if ( rpm_check( reference:"libgimpprint1-4.1.99-16.1mdk", release:"MDK8.1", yank:"mdk") )
  105. {
  106.  security_hole(0);
  107.  exit(0);
  108. }
  109. if ( rpm_check( reference:"libgimpprint1-devel-4.1.99-16.1mdk", release:"MDK8.1", yank:"mdk") )
  110. {
  111.  security_hole(0);
  112.  exit(0);
  113. }
  114. if ( rpm_check( reference:"omni-0.4-11.1mdk", release:"MDK8.1", yank:"mdk") )
  115. {
  116.  security_hole(0);
  117.  exit(0);
  118. }
  119. if ( rpm_check( reference:"printer-filters-1.0-15.1mdk", release:"MDK8.1", yank:"mdk") )
  120. {
  121.  security_hole(0);
  122.  exit(0);
  123. }
  124. if ( rpm_check( reference:"printer-testpages-1.0-15.1mdk", release:"MDK8.1", yank:"mdk") )
  125. {
  126.  security_hole(0);
  127.  exit(0);
  128. }
  129. if ( rpm_check( reference:"printer-utils-1.0-15.1mdk", release:"MDK8.1", yank:"mdk") )
  130. {
  131.  security_hole(0);
  132.  exit(0);
  133. }
  134. if ( rpm_check( reference:"cups-drivers-1.1-48.2mdk", release:"MDK8.2", yank:"mdk") )
  135. {
  136.  security_hole(0);
  137.  exit(0);
  138. }
  139. if ( rpm_check( reference:"foomatic-1.1-0.20020323mdk", release:"MDK8.2", yank:"mdk") )
  140. {
  141.  security_hole(0);
  142.  exit(0);
  143. }
  144. if ( rpm_check( reference:"ghostscript-6.53-13.2mdk", release:"MDK8.2", yank:"mdk") )
  145. {
  146.  security_hole(0);
  147.  exit(0);
  148. }
  149. if ( rpm_check( reference:"ghostscript-module-X-6.53-13.2mdk", release:"MDK8.2", yank:"mdk") )
  150. {
  151.  security_hole(0);
  152.  exit(0);
  153. }
  154. if ( rpm_check( reference:"gimpprint-4.2.1-0.pre5.2mdk", release:"MDK8.2", yank:"mdk") )
  155. {
  156.  security_hole(0);
  157.  exit(0);
  158. }
  159. if ( rpm_check( reference:"libgimpprint1-4.2.1-0.pre5.2mdk", release:"MDK8.2", yank:"mdk") )
  160. {
  161.  security_hole(0);
  162.  exit(0);
  163. }
  164. if ( rpm_check( reference:"libgimpprint1-devel-4.2.1-0.pre5.2mdk", release:"MDK8.2", yank:"mdk") )
  165. {
  166.  security_hole(0);
  167.  exit(0);
  168. }
  169. if ( rpm_check( reference:"omni-0.6.0-2.2mdk", release:"MDK8.2", yank:"mdk") )
  170. {
  171.  security_hole(0);
  172.  exit(0);
  173. }
  174. if ( rpm_check( reference:"printer-filters-1.0-48.2mdk", release:"MDK8.2", yank:"mdk") )
  175. {
  176.  security_hole(0);
  177.  exit(0);
  178. }
  179. if ( rpm_check( reference:"printer-testpages-1.0-48.2mdk", release:"MDK8.2", yank:"mdk") )
  180. {
  181.  security_hole(0);
  182.  exit(0);
  183. }
  184. if ( rpm_check( reference:"printer-utils-1.0-48.2mdk", release:"MDK8.2", yank:"mdk") )
  185. {
  186.  security_hole(0);
  187.  exit(0);
  188. }
  189. if ( rpm_check( reference:"cups-drivers-1.1-84.2mdk", release:"MDK9.0", yank:"mdk") )
  190. {
  191.  security_hole(0);
  192.  exit(0);
  193. }
  194. if ( rpm_check( reference:"foomatic-2.0.2-20021220.2.2mdk", release:"MDK9.0", yank:"mdk") )
  195. {
  196.  security_hole(0);
  197.  exit(0);
  198. }
  199. if ( rpm_check( reference:"ghostscript-7.05-33.2mdk", release:"MDK9.0", yank:"mdk") )
  200. {
  201.  security_hole(0);
  202.  exit(0);
  203. }
  204. if ( rpm_check( reference:"ghostscript-module-X-7.05-33.2mdk", release:"MDK9.0", yank:"mdk") )
  205. {
  206.  security_hole(0);
  207.  exit(0);
  208. }
  209. if ( rpm_check( reference:"gimpprint-4.2.5-0.2.2mdk", release:"MDK9.0", yank:"mdk") )
  210. {
  211.  security_hole(0);
  212.  exit(0);
  213. }
  214. if ( rpm_check( reference:"libgimpprint1-4.2.5-0.2.2mdk", release:"MDK9.0", yank:"mdk") )
  215. {
  216.  security_hole(0);
  217.  exit(0);
  218. }
  219. if ( rpm_check( reference:"libgimpprint1-devel-4.2.5-0.2.2mdk", release:"MDK9.0", yank:"mdk") )
  220. {
  221.  security_hole(0);
  222.  exit(0);
  223. }
  224. if ( rpm_check( reference:"libijs0-0.34-24.2mdk", release:"MDK9.0", yank:"mdk") )
  225. {
  226.  security_hole(0);
  227.  exit(0);
  228. }
  229. if ( rpm_check( reference:"libijs0-devel-0.34-24.2mdk", release:"MDK9.0", yank:"mdk") )
  230. {
  231.  security_hole(0);
  232.  exit(0);
  233. }
  234. if ( rpm_check( reference:"omni-0.7.1-11.2mdk", release:"MDK9.0", yank:"mdk") )
  235. {
  236.  security_hole(0);
  237.  exit(0);
  238. }
  239. if ( rpm_check( reference:"printer-filters-1.0-84.2mdk", release:"MDK9.0", yank:"mdk") )
  240. {
  241.  security_hole(0);
  242.  exit(0);
  243. }
  244. if ( rpm_check( reference:"printer-testpages-1.0-84.2mdk", release:"MDK9.0", yank:"mdk") )
  245. {
  246.  security_hole(0);
  247.  exit(0);
  248. }
  249. if ( rpm_check( reference:"printer-utils-1.0-84.2mdk", release:"MDK9.0", yank:"mdk") )
  250. {
  251.  security_hole(0);
  252.  exit(0);
  253. }
  254. if (rpm_exists(rpm:"printer-drivers-", release:"MDK8.0")
  255.  || rpm_exists(rpm:"printer-drivers-", release:"MDK8.1")
  256.  || rpm_exists(rpm:"printer-drivers-", release:"MDK8.2")
  257.  || rpm_exists(rpm:"printer-drivers-", release:"MDK9.0") )
  258. {
  259.  set_kb_item(name:"CAN-2003-0034", value:TRUE);
  260.  set_kb_item(name:"CAN-2003-0035", value:TRUE);
  261.  set_kb_item(name:"CAN-2003-0036", value:TRUE);
  262. }
  263.