Vulnerabilities > CVE-2005-3398 - Information Exposure vulnerability in SUN Solaris and Sunos

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3398
• https://www.owasp.org/index.php/Cross_Site_Tracing

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3398
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3498

#%NASL_MIN_LEVEL 80502

#
# (C) Tenable Network Security, Inc.
#
# @DEPRECATED@
#
# Disabled on 2018/03/12. Deprecated and either replaced by
# individual patch-revision plugins, or has been deemed a
# non-security advisory.
#
include("compat.inc");

if (description)
{
  script_id(20273);
  script_version("1.53");
  script_cvs_date("Date: 2019/10/25 13:36:26");

  script_cve_id("CVE-2005-3398", "CVE-2005-3498", "CVE-2007-3093", "CVE-2007-3094");

  script_name(english:"Solaris 10 (sparc) : 121308-20 (deprecated)");
  script_summary(english:"Check for patch 121308-20");

  script_set_attribute(
    attribute:"synopsis", 
    value:"This plugin has been deprecated."
  );
  script_set_attribute(
    attribute:"description",
    value:
"SunOS 5.10: Solaris Management Console Pat.
Date this patch was last updated by Sun : Apr/02/10

This plugin has been deprecated and either replaced with individual
121308 patch-revision plugins, or deemed non-security related."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://getupdates.oracle.com/readme/121308-20"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"n/a"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_cwe_id(200);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:sun:solaris");

  script_set_attribute(attribute:"patch_publication_date", value:"2010/04/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2005/12/07");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2005-2019 Tenable Network Security, Inc.");
  script_family(english:"Solaris Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Solaris/showrev");

  exit(0);
}

exit(0, "This plugin has been deprecated. Consult specific patch-revision plugins for patch 121308 instead.");

# @DEPRECATED@
#
# (C) Tenable Network Security, Inc.
#

# HTTP/1.1 is defined by RFC 2068
#
# Check for proxy on the way (transparent or reverse?!)
#


include("compat.inc");

if(description)
{
 script_id(11040);
 script_version ("1.37");
 script_cve_id("CVE-2004-2320", "CVE-2005-3398", "CVE-2005-3498", "CVE-2007-3008");

 script_name(english: "HTTP Reverse Proxy Detection (Deprecated)");
 script_set_attribute(attribute:"synopsis", value:
"A transparent or reverse HTTP proxy is running on this port." );
 script_set_attribute(attribute:"description", value:
"This web server is reachable through a reverse HTTP proxy.

Note: This plugin has been deprecated.
" );

 script_set_attribute(attribute:"solution", value:"Disable the HTTP reverse proxy.");
 script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N");
 script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N");
 script_set_attribute(attribute:"cvss_score_source", value:"CVE-2004-2320");
 script_cwe_id(79, 200);

 script_set_attribute(attribute:"plugin_publication_date", value: "2002/07/02");
 script_cvs_date("Date: 2019/09/26 12:31:13");

script_set_attribute(attribute:"plugin_type", value:"remote");
 script_end_attributes();

 script_summary(english: "Look for an HTTP proxy on the way");
 script_category(ACT_GATHER_INFO);
 script_copyright(english:"This script is Copyright (C) 2002-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
 script_family(english: "Web Servers");
 script_dependencies("http_version.nasl");
 script_require_ports("Services/www", 80);
 exit(0);
}

# Deprecated
exit(0, 'This plugin has been deprecated.');

include("global_settings.inc");
include("misc_func.inc");
include("http.inc");

port = get_http_port(default:80, embedded: 1);

r = http_send_recv3(port: port, method: 'GET', item: "/", exit_on_fail: 1);
h = parse_http_headers(status_line: r[0], headers: r[1]);
via = h["via"];
trace="";

  while(via)
  {
    # display("Via=", via, "\n");
    proxy = ereg_replace(string:via, pattern: " *([^,]*),?.*", replace: "\1");
    via = ereg_replace(string: via, pattern: "([^,]*)(, *)?(.*)", replace: "\3");
    # display(string("Proxy=", proxy, " - Via=", via, "\n"));
    proto = ereg_replace(string:proxy, 
		pattern:"^([a-zA-Z0-9_-]*/?[0-9.]+) +.*",
		replace: "\1");
    line = ereg_replace(string:proxy, 
		pattern:"^([a-zA-Z0-9_-]*/?[0-9.]+) *(.*)",
		replace: "\2");
    # display(string("Proto=", proto, "\nLine=", line, "\n"));
    if (egrep(pattern:"^[0-9]+", string: proto))
      proto = "HTTP/" + proto;
    trace = trace + proto;
    l = strlen(proto);
    for (i= l;i < 12; i=i+1) trace=trace+" ";
    trace = strcat(trace, " ", line, '\n');
  }

if (trace)
  security_warning(port: port, extra: 
strcat(
'The GET method revealed those proxies on the way to this web server :\n', trace));
else if (h["x-cache"])
{
  p = ereg_replace(pattern:'^ *[A-Z]+ +from +([^ \t\r\n]+)[ \t\r\n]+',
	string: h["x-cache"], replace: "\1");
  r = 'There might be a caching proxy on the way to this web server';
  if (p != heads) r = strcat(r, ':\n', p);
  security_warning(port: port, extra: r);
}

exit(0); # broken at this time
#
ver = get_kb_item(string("http/", port));
if (int(ver) < 11)  exit(0);	# No TRACE in HTTP/1.0

n=0;
for (i = 0; i < 99; i ++)
{
  r = http_send_recv3(port: port, method: 'TRACE', item: '/', 
  add_headers: make_array("Max-Forwards", i), exit_on_fail: 0 );
  if (isnull(r)) break;
  h = parse_http_headers(status_line: r[0], headers: r[1]);
  via = h["via"];
  if (via)
    viaL[i] = via;
  else
    viaL[i] = "?";

  if (r[0] =~ '^HTTP/[0-9.]+ +200 ')
    {
      # The proxy is supposed to send back the request it got. 
      # i.e. "TRACE / HTTP/1.1"
      # However, NetCache appliance change it to "TRACE http://srv HTTP/1.1"
      if (egrep(pattern: "^TRACE (/|http://.*) HTTP/1.1", string: r[2]))
      {
        srv = h["server"];
        if (srv)
          srvL[i+1] = srv;
        else
          srvL[i+1] = "?";
        n ++;
      }
    }
    else
      break;
}

trace="";
for (i = 1; i <= n; i = i+1)
  trace = strcat(trace, viaL[i]," - ", srvL[i], '\n');

if (n > 0)
  security_warning(port:port, protocol:"tcp",
	extra: strcat(
	'The TRACE method revealed ', n, 
	' proxy(s) between us and the web server :\n',
	trace) );

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text in this plugin was
# extracted from the Oracle SunOS Patch Updates.
#
include("compat.inc");

if (description)
{
  script_id(13576);
  script_version("1.36");
  script_cvs_date("Date: 2019/10/25 13:36:23");

  script_cve_id("CVE-2005-3398", "CVE-2005-3498");

  script_name(english:"Solaris 9 (sparc) : 116807-02");
  script_summary(english:"Check for patch 116807-02");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote host is missing Sun Security Patch number 116807-02"
  );
  script_set_attribute(
    attribute:"description", 
    value:
"SunOS 5.9: /usr/sadm/lib/smc/lib/preload/jsdk21.jar patch.
Date this patch was last updated by Sun : Sep/15/05"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://download.oracle.com/sunalerts/1000162.1.html"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"You should install this patch for your system to be up-to-date."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N");
  script_cwe_id(200);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:sun:solaris");

  script_set_attribute(attribute:"patch_publication_date", value:"2005/09/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2004/07/12");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2004-2019 Tenable Network Security, Inc.");
  script_family(english:"Solaris Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Solaris/showrev");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("solaris.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

if (solaris_check_patch(release:"5.9", arch:"sparc", patch:"116807-02", obsoleted_by:"", package:"SUNWmc", version:"11.9,REV=2002.04.14.23.49") < 0) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:solaris_get_report());
  else security_warning(0);
  exit(0);
}
audit(AUDIT_HOST_NOT, "affected");