| code | #
# (C) Tenable Network Security, Inc.
#
#
# Ref:
# From: "Matthew Murphy" <[email protected]>
# To: "BugTraq" <[email protected]>,
# Subject: Mod_gzip Debug Mode Vulnerabilities
# Date: Sun, 1 Jun 2003 15:10:13 -0500
include("compat.inc");
if(description)
{
script_id(11686);
script_version("1.21");
script_cvs_date("Date: 2018/11/15 20:50:25");
script_cve_id("CVE-2003-0843");
script_name(english:"mod_gzip Debug Mode mod_gzip_printf Remote Format String");
script_set_attribute(attribute:"synopsis", value:
"The remote web server is prone to a format string attack." );
script_set_attribute(attribute:"description", value:
"The remote host is running mod_gzip with debug symbols compiled in.
The debug code includes vulnerabilities that can be exploited by an
attacker to gain a shell on this host." );
script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2003/Jun/24" );
script_set_attribute(attribute:"solution", value:
"If you do not use this module, disable it completely, or recompile it
without the debug symbols." );
script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P");
script_set_attribute(attribute:"plugin_publication_date", value: "2003/06/02");
script_set_attribute(attribute:"vuln_publication_date", value: "2003/06/01");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_end_attributes();
script_summary(english:"mod_gzip detection");
script_category(ACT_MIXED_ATTACK);
script_copyright(english:"This script is Copyright (C) 2003-2018 Tenable Network Security, Inc.");
script_family(english:"Web Servers");
script_dependencie("http_version.nasl", "find_service1.nasl", "httpver.nasl", "no404.nasl");
script_require_ports("Services/www", 80);
exit(0);
}
#
# The script code starts here
#
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
port = get_http_port(default:80);
rq = http_mk_get_req(item:"/index.html", port:port,
add_headers: make_array("Accept-Encoding", "gzip, deflate"));
# The original script removed the User-Agent field, for whatever reason...
rq['User-Agent'] = NULL;
w = http_send_recv_req(port: port, req: rq);
if (isnull(w)) exit(1, "the web server did not answer");
if ("Content-Encoding: gzip" >!< w[1]) exit(0);
if(safe_checks())
{
# Avoid FP...
res = w[1];
if ("Apache" >!< res || "mod_gzip" >!< res)exit(0);
report = string(
"\n",
"Note that Nessus could not verify whether mod_gzip has the debug\n",
"symbols enabled because safe checks were enabled. As a result,\n",
"this may be a false-positive.\n"
);
security_warning(port:port, extra:report);
exit(0);
}
if (report_paranoia < 2) exit(0);
rq = http_mk_get_req(item:"/nessus.html?nn", port:port,
add_headers: make_array("Accept-Encoding", "gzip, deflate"));
rq['User-Agent'] = NULL;
w = http_send_recv_req(port: port, req: rq);
if (isnull(w)) exit(1, "the web server did not answer");
rq = http_mk_get_req(item:"/nessus.html?%n", port:port,
add_headers: make_array("Accept-Encoding", "gzip, deflate"));
rq['User-Agent'] = NULL;
w = http_send_recv_req(port: port, req: rq);
# Even more unreliable than the old version!
if (isnull(w)) security_warning(port);
|