On Thu, 22 Jul 2004, Renaud Deraison wrote:
> That's wrong. First, from a security point of view, a plugin which
> calls pread() is not more or less insecure than a plugin which can
> call ssh_cmd_exec() - they both execute arbitrary commands, and
> therefore you want to audit them both.
pread() is a threat to the local computer (esp. when nessusd runs under
root), and consequently to any computer this instance of Nessus talks to.
ssh_cmd_exec() is a threat to computers it has been granted access to (as
far as I can tell from existing checks, privileged access is not stricly
necessary). Ergo I think it is justified to say pread() is more dangerous
than ssh_cmd_exec().
But it does not matter. How many scripts using ssh_cmd_exec() do we have
now? One? How much is this number going to increase? I think it is safe to
assume there will never be more than, say, 10 scripts using this function
(or providing arbitrary input to it). After all, it is desirable to keep
the number of SSH connections per target as low as possible.
Unfortunately, there is a can of ugly worms opening there: plugins
getting Administrator access to Windows machines. They are as dangerous
as ssh_cmd_exec(). In fact, even unrestricted registry access alone is
everything you need to own the machine in most cases. If ssh_cmd_exec()
needs special handling because it is considered dangerous then these
plugins need it too. The good news is that a vast majority of Admin
access is use to read registry. The bad news is it is probably infeasible
to fetch all relevant parts of registry a priori a let other scripts
examine it (ala ssh_get_info.nasl).
Perhaps some kind of "multipass" plugins could be used: during the 1st
pass, they'd register registry keys they are interested in, a trusted
script would fetch their values and store them in kb (bonus: the number of
SMB connections would be reduced dramatically), and during the 2nd pass,
the plugins would look at kb and report their findings.
> This means that you can very easily check a sensitive plugin just by
> doing a :
> grep -l '^#TRUSTED' *.nasl
So this is the official way to distinguish trusted scripts from intrusted
ones, right?
BTW: script_version ("1.4") in ssh_get_info.nasl is out of date ;)
--Pavel Kankovsky aka Peak [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."
_______________________________________________
Nessus mailing list
[EMAIL PROTECTED]
http://mail.nessus.org/mailman/listinfo/nessus
