Vulnerabilities > CVE-2008-7220 - Unspecified vulnerability in Prototypejs Prototype Javascript Framework 1.5.0/1.5.1/1.6.0.1

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
prototypejs
nessus

Summary

Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows attackers to make "cross-site ajax requests" via unknown vectors.

Nessus

  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2009-11070.NASL
    description - Wed Nov 4 2009 Jeffrey C. Ollie <jeff at ocjtech.us> - 1.6.1.9-1 - Update to 1.6.1.9 to fix AST-2009-009/CVE-2008-7220 and AST-2009-008 - Fix obsoletes for firmware subpackage Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id42883
    published2009-11-25
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/42883
    titleFedora 11 : asterisk-1.6.1.9-1.fc11 (2009-11070)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2009-11070.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(42883);
      script_version("1.11");
      script_cvs_date("Date: 2019/08/02 13:32:29");
    
      script_cve_id("CVE-2008-7220", "CVE-2009-3727");
      script_bugtraq_id(36926);
      script_xref(name:"FEDORA", value:"2009-11070");
    
      script_name(english:"Fedora 11 : asterisk-1.6.1.9-1.fc11 (2009-11070)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "  - Wed Nov 4 2009 Jeffrey C. Ollie <jeff at ocjtech.us> -
        1.6.1.9-1 - Update to 1.6.1.9 to fix
        AST-2009-009/CVE-2008-7220 and AST-2009-008 - Fix
        obsoletes for firmware subpackage
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=523277"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=533137"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2009-November/031285.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?46de86d5"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected asterisk package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(200);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:asterisk");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:11");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2009/11/06");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/11/25");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^11([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 11.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC11", reference:"asterisk-1.6.1.9-1.fc11")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "asterisk");
    }
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-1952.NASL
    descriptionSeveral vulnerabilities have been discovered in asterisk, an Open Source PBX and telephony toolkit. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-0041 It is possible to determine valid login names via probing, due to the IAX2 response from asterisk (AST-2009-001). - CVE-2008-3903 It is possible to determine a valid SIP username, when Digest authentication and authalwaysreject are enabled (AST-2009-003). - CVE-2009-3727 It is possible to determine a valid SIP username via multiple crafted REGISTER messages (AST-2009-008). - CVE-2008-7220 CVE-2007-2383 It was discovered that asterisk contains an obsolete copy of the Prototype JavaScript framework, which is vulnerable to several security issues. This copy is unused and now removed from asterisk (AST-2009-009). - CVE-2009-4055 It was discovered that it is possible to perform a denial of service attack via RTP comfort noise payload with a long data length (AST-2009-010). The current version in oldstable is not supported by upstream anymore and is affected by several security issues. Backporting fixes for these and any future issues has become unfeasible and therefore we need to drop our security support for the version in oldstable. We recommend that all asterisk users upgrade to the stable distribution (lenny).
    last seen2020-06-01
    modified2020-06-02
    plugin id44817
    published2010-02-24
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/44817
    titleDebian DSA-1952-1 : asterisk - several vulnerabilities, end-of-life announcement in oldstable
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-1952. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(44817);
      script_version("1.17");
      script_cvs_date("Date: 2019/08/02 13:32:22");
    
      script_cve_id("CVE-2007-2383", "CVE-2008-3903", "CVE-2008-7220", "CVE-2009-0041", "CVE-2009-3727", "CVE-2009-4055");
      script_bugtraq_id(36926, 37153);
      script_xref(name:"DSA", value:"1952");
    
      script_name(english:"Debian DSA-1952-1 : asterisk - several vulnerabilities, end-of-life announcement in oldstable");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Several vulnerabilities have been discovered in asterisk, an Open
    Source PBX and telephony toolkit. The Common Vulnerabilities and
    Exposures project identifies the following problems :
    
      - CVE-2009-0041
        It is possible to determine valid login names via
        probing, due to the IAX2 response from asterisk
        (AST-2009-001).
    
      - CVE-2008-3903
        It is possible to determine a valid SIP username, when
        Digest authentication and authalwaysreject are enabled
        (AST-2009-003).
    
      - CVE-2009-3727
        It is possible to determine a valid SIP username via
        multiple crafted REGISTER messages (AST-2009-008).
    
      - CVE-2008-7220 CVE-2007-2383
        It was discovered that asterisk contains an obsolete
        copy of the Prototype JavaScript framework, which is
        vulnerable to several security issues. This copy is
        unused and now removed from asterisk (AST-2009-009).
    
      - CVE-2009-4055
        It was discovered that it is possible to perform a
        denial of service attack via RTP comfort noise payload
        with a long data length (AST-2009-010).
    
    The current version in oldstable is not supported by upstream anymore
    and is affected by several security issues. Backporting fixes for
    these and any future issues has become unfeasible and therefore we
    need to drop our security support for the version in oldstable. We
    recommend that all asterisk users upgrade to the stable distribution
    (lenny)."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=513413"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=522528"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=554487"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=554486"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=559103"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2009-0041"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2008-3903"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2009-3727"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2008-7220"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2007-2383"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2009-4055"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2009/dsa-1952"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the asterisk packages.
    
    For the stable distribution (lenny), these problems have been fixed in
    version 1:1.4.21.2~dfsg-3+lenny1."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(200);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:asterisk");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:5.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2009/12/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2010/02/24");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"5.0", prefix:"asterisk", reference:"1:1.4.21.2~dfsg-3+lenny1")) flag++;
    if (deb_check(release:"5.0", prefix:"asterisk-config", reference:"1:1.4.21.2~dfsg-3+lenny1")) flag++;
    if (deb_check(release:"5.0", prefix:"asterisk-dbg", reference:"1:1.4.21.2~dfsg-3+lenny1")) flag++;
    if (deb_check(release:"5.0", prefix:"asterisk-dev", reference:"1:1.4.21.2~dfsg-3+lenny1")) flag++;
    if (deb_check(release:"5.0", prefix:"asterisk-doc", reference:"1:1.4.21.2~dfsg-3+lenny1")) flag++;
    if (deb_check(release:"5.0", prefix:"asterisk-h323", reference:"1:1.4.21.2~dfsg-3+lenny1")) flag++;
    if (deb_check(release:"5.0", prefix:"asterisk-sounds-main", reference:"1:1.4.21.2~dfsg-3+lenny1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201006-20.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201006-20 (Asterisk: Multiple vulnerabilities) Multiple vulnerabilities have been reported in Asterisk: Nick Baggott reported that Asterisk does not properly process overly long ASCII strings in various packets (CVE-2009-2726). Noam Rathaus and Blake Cornell reported a flaw in the IAX2 protocol implementation (CVE-2009-2346). amorsen reported an input processing error in the RTP protocol implementation (CVE-2009-4055). Patrik Karlsson reported an information disclosure flaw related to the REGISTER message (CVE-2009-3727). A vulnerability was found in the bundled Prototype JavaScript library, related to AJAX calls (CVE-2008-7220). Impact : A remote attacker could exploit these vulnerabilities by sending a specially crafted package, possibly causing a Denial of Service condition, or resulting in information disclosure. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id46809
    published2010-06-04
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/46809
    titleGLSA-201006-20 : Asterisk: Multiple vulnerabilities
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 201006-20.
    #
    # The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(46809);
      script_version("1.14");
      script_cvs_date("Date: 2019/08/02 13:32:45");
    
      script_cve_id("CVE-2008-7220", "CVE-2009-2346", "CVE-2009-2726", "CVE-2009-3727", "CVE-2009-4055");
      script_bugtraq_id(36015, 36275, 36926, 37153);
      script_xref(name:"GLSA", value:"201006-20");
    
      script_name(english:"GLSA-201006-20 : Asterisk: Multiple vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-201006-20
    (Asterisk: Multiple vulnerabilities)
    
        Multiple vulnerabilities have been reported in Asterisk:
        Nick Baggott reported that Asterisk does not properly process
        overly long ASCII strings in various packets (CVE-2009-2726).
        Noam Rathaus and Blake Cornell reported a flaw in the IAX2 protocol
        implementation (CVE-2009-2346).
        amorsen reported an input
        processing error in the RTP protocol implementation
        (CVE-2009-4055).
        Patrik Karlsson reported an information
        disclosure flaw related to the REGISTER message (CVE-2009-3727).
        A vulnerability was found in the bundled Prototype JavaScript
        library, related to AJAX calls (CVE-2008-7220).
      
    Impact :
    
        A remote attacker could exploit these vulnerabilities by sending a
        specially crafted package, possibly causing a Denial of Service
        condition, or resulting in information disclosure.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/201006-20"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All Asterisk users should upgrade to the latest version:
        # emerge --sync
        # emerge --ask --oneshot --verbose '>=net-misc/asterisk-1.2.37'
        NOTE: This is a legacy GLSA. Updates for all affected architectures are
        available since January 5, 2010. It is likely that your system is
        already no longer affected by this issue."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(119, 200, 399);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:asterisk");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2010/06/04");
      script_set_attribute(attribute:"plugin_publication_date", value:"2010/06/04");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2010-2019 Tenable Network Security, Inc.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"net-misc/asterisk", unaffected:make_list("ge 1.2.37"), vulnerable:make_list("lt 1.2.37"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Asterisk");
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2009-11126.NASL
    description - Thu Nov 5 2009 Jeffrey C. Ollie <jeff at ocjtech.us> - 1.6.0.17-2 - Fix firmware path * Wed Nov 4 2009 Jeffrey C. Ollie <jeff at ocjtech.us> - 1.6.0.17-1 - Update to 1.6.0.17 to fix AST-2009-009/CVE-2008-7220 - Merge the firmware subpackage back into the main package. - Don
    last seen2020-06-01
    modified2020-06-02
    plugin id42884
    published2009-11-25
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/42884
    titleFedora 10 : asterisk-1.6.0.17-2.fc10 (2009-11126)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2009-11126.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(42884);
      script_version("1.12");
      script_cvs_date("Date: 2019/08/02 13:32:29");
    
      script_cve_id("CVE-2008-7220", "CVE-2009-3727");
      script_bugtraq_id(36926);
      script_xref(name:"FEDORA", value:"2009-11126");
    
      script_name(english:"Fedora 10 : asterisk-1.6.0.17-2.fc10 (2009-11126)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "  - Thu Nov 5 2009 Jeffrey C. Ollie <jeff at ocjtech.us> -
        1.6.0.17-2 - Fix firmware path * Wed Nov 4 2009 Jeffrey
        C. Ollie <jeff at ocjtech.us> - 1.6.0.17-1 - Update to
        1.6.0.17 to fix AST-2009-009/CVE-2008-7220 - Merge the
        firmware subpackage back into the main package. - Don't
        package the iaxy firmware anymore.
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=523277"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=533137"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2009-November/031334.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?7dfc7a8d"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected asterisk package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(200);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:asterisk");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:10");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2009/11/06");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/11/25");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^10([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 10.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC10", reference:"asterisk-1.6.0.17-2.fc10")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "asterisk");
    }
    

Seebug

bulletinFamilyexploit
descriptionBugraq ID: 36926 CVE ID:CVE-2008-7220 Prototype JavaScript Framework是一款由Sam Stephenson开发的JavaScript开发函数库及框架。它提供了完整的Ajax框架及其它的工具。 Prototype JavaScript Framework存在一个未明错误,远程攻击者可以利用漏洞进行一个跨站ajax请求攻击,可以以受影响浏览器安全上下文执行任意代码。 Asterisk包含一个基于AJAX的演示管理接口,ajamdemo.html使用prototype.js框架,受此漏洞影响允许攻击者执行跨站AJAX请求攻击。 Sam Stephenson prototype javascript framework 1.4 Sam Stephenson prototype javascript framework 1.6.0.2 Asterisk Asterisk Business Edition C.3.1.0 Asterisk Asterisk Business Edition C.3.1 1 Asterisk Asterisk Business Edition C.2.4.3 Asterisk Asterisk Business Edition C.2.4.2 Asterisk Asterisk Business Edition C.2.3.3 Asterisk Asterisk Business Edition C.2.3 .2 Asterisk Asterisk Business Edition C.2.3 Asterisk Asterisk Business Edition C.2.1.2.1 Asterisk Asterisk Business Edition B.2.5.9 Asterisk Asterisk Business Edition B.2.5.8 Asterisk Asterisk Business Edition B.2.5.7 Asterisk Asterisk Business Edition B.2.5.6 Asterisk Asterisk Business Edition B.2.5.5 Asterisk Asterisk Business Edition B.2.5.4 Asterisk Asterisk Business Edition B.2.5.3 Asterisk Asterisk Business Edition B.2.5.2 Asterisk Asterisk Business Edition B.2.5.10 Asterisk Asterisk Business Edition B.2.5.1 Asterisk Asterisk 1.6.1 6 Asterisk Asterisk 1.6.1 5 Asterisk Asterisk 1.6.1 0-rc2 Asterisk Asterisk 1.6.1 0-rc1 Asterisk Asterisk 1.6.1 Asterisk Asterisk 1.6 beta6 Asterisk Asterisk 1.6 6 Asterisk Asterisk 1.6 14 Asterisk Asterisk 1.4.26 2 Asterisk Asterisk 1.4.26 1 Asterisk Asterisk 1.4.26 Asterisk Asterisk 1.4.24 .1 Asterisk Asterisk 1.4.24 Asterisk Asterisk 1.4.9 Asterisk Asterisk 1.4.8 Asterisk Asterisk 1.4.7 Asterisk Asterisk 1.4.6 Asterisk Asterisk 1.4.5 Asterisk Asterisk 1.4.4 Asterisk Asterisk 1.4.3 Asterisk Asterisk 1.6.1.8 Asterisk Asterisk 1.6.1.7 Asterisk Asterisk 1.6 厂商解决方案 用户可参考如下安全公告获得补丁信息: http://github.com/sstephenson/prototype/blob/master/CHANGELOG
idSSV:12589
last seen2017-11-19
modified2009-11-07
published2009-11-07
reporterRoot
titlePrototype JavaScript Framework跨站Ajax请求漏洞