nessus-plugins/scripts cvs_file_existence_info_weak.nasl,NONE,1.1

[jwlampe_at_nessus.org]

Update of /usr/local/cvs/nessus-plugins/scripts
In directory raccoon.nessus.org:/tmp/cvs-serv34435

Added Files:
	cvs_file_existence_info_weak.nasl 
Log Message:
new cvs check from David Maciejak


--- NEW FILE: cvs_file_existence_info_weak.nasl ---
#  This script was written by David Maciejak <david dot maciejak at kyxar dot fr>
#  based on work from
# (C) Tenable Network Security
#
# Ref: Sebastian Krahmer


if(description)
{
 script_id(14313);
 script_bugtraq_id(10955);
 script_cve_id("CAN-2004-0778");
 script_version ("$Revision: 1.1 $");
 
 
 name["english"] = "CVS file existence information disclosure weakness";
 script_name(english:name["english"]);
 
 desc["english"] = "
The remote CVS server, according to its version number,
can be exploited by malicious users to gain knowledge of 
certain system information.

This behaviour can be exploited to determine the existence 
and permissions of arbitrary files and directories on a 
vulnerable system.


Solution : Upgrade to CVS 1.11.17 and 1.12.9, or newer

Risk Factor : Low";


 script_description(english:desc["english"]);
 
 summary["english"] = "Logs into the remote CVS server and asks the version";
 script_summary(english:summary["english"]);
 
 script_category(ACT_GATHER_INFO);
 
 script_copyright(english:"This script is Copyright (C) 2004 David Maciejak");
 family["english"] = "General";
 script_family(english:family["english"]);
 script_require_ports("Services/cvspserver", port);
 script_dependencies("find_service.nes", "cvs_public_pserver.nasl");
 exit(0);
}

port = get_kb_item("Services/cvspserver");
if(!port)
	port = 2401;
if(!get_port_state(port))
	exit(0);

login = get_kb_item(string("cvs/", port, "/login"));
pass  = get_kb_item(string("cvs/", port, "/pass"));
dir   = get_kb_item(string("cvs/", port, "/dir"));

if(!login || !dir) {
	soc = open_sock_tcp(port);
	if(!soc)
		exit(0);

	req = string("BEGIN AUTH REQUEST\n",
	"\n",
	"\n",
	"A\n",
	"END AUTH REQUEST\n");
	send(socket:soc, data:req);
	r = recv_line(socket:soc, length:4096);
	if("repository" >< r || "I HATE" >< r)
		exit(0);
}

soc = open_sock_tcp(port);
if(!soc)
	exit(0);

req = string("BEGIN AUTH REQUEST\n",
dir, "\n",
login,"\n",
"A", pass,"\n",
"END AUTH REQUEST\n");

send(socket:soc, data:req);
r = recv_line(socket:soc, length:4096);
if("I LOVE YOU" >< r)
{
    send(socket:soc, data:string("version\n"));
    r = recv_line(socket:soc, length:4096);
    if("Concurrent" >< r)
    {
     	set_kb_item(name:string("cvs/", port, "/version"), value:r);
     	if(ereg(pattern:".* 1\.([0-9]\.|10\.|11\.([0-9][^0-9]|1[0-6])|12\.[0-8][^0-9]).*", string:r))
     		security_warning(port);
    }
}

close(soc);