On Tuesday 21 July 2009 18:28:43 Chandrashekhar B wrote:
> -----Original Message-----
> From: Tim Brown [mailto:[email protected]]
> Sent: Tuesday, July 21, 2009 9:46 PM
> To: Chandrashekhar B
> Cc: [email protected]; [email protected]
> Subject: Re: [Openvas-plugins] [Openvas-commits] r4091 -
> intrunk/openvas-plugins: . scripts
>
> On Tuesday 21 July 2009 15:54:26 Chandrashekhar B wrote:
> >> I had actually asked your help for the remote POC, we went ahead with
> >> the local check meanwhile.
> >
> > I know, this was my first chance to review the check. I did try to catch
> > you
> > on IRC to discuss it but we seem to have missed each other since you
> > first
> >
> > asked. I have a virtual machine running the vulnerable code, so if
> > you're
> >
> > cool with it, I'd like to run the checks on it and make changes as >
>
> necessary?
>
> I am definitely cool with that :) please do.
The NullLogic Groupware server returns a header such as "Server: NullLogic
Groupware 1.2.6" on vulnerable versions.
My proposal would be to remove the script_require_keys() and change the logic
as follows:
banner = get_http_banner(port:nullgrpPort);
nullgrpVer = get_kb_item("NullLogic-Groupware/Win/Ver");
if(nullgrpVer == NULL){
bannerVer = eregmatch(pattern:"NullLogic Groupware ([0-9.]+)",
string:banner);
if(version_is_less_equal(version:bannerVer, test_version:"1.2.7")){
security_warning(nullgrpPort);
}
} else {
if("NullLogic Groupware" >< banner){
if(version_is_less_equal(version:nullgrpVer, test_version:"1.2.7")){
security_warning(nullgrpPort);
}
}
}
exit(0);
Does something like that make sense? The only problem I can see is if local
check is carried out and finds an old version, but the version running is
actually patched up to date which may lead to a false positive. It may be
better to split the two checks entirely but then, would the issue be reported
twice?
Also, what family shall we move the script to? It will handle both the local
and remote cases...
Tim
--
Tim Brown
<mailto:[email protected]>
<http://www.nth-dimension.org.uk/>
_______________________________________________
Openvas-plugins mailing list
[email protected]
http://lists.wald.intevation.org/mailman/listinfo/openvas-plugins
