Vulnerabilities > CVE-2010-1937 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Standards Based Linux Instrumentation Sblim-Sfcb 1.3.4/1.3.5/1.3.6

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2010-10323.
#

include("compat.inc");

if (description)
{
  script_id(49152);
  script_version("1.9");
  script_cvs_date("Date: 2019/08/02 13:32:31");

  script_cve_id("CVE-2010-1937", "CVE-2010-2054");
  script_bugtraq_id(40475);
  script_xref(name:"FEDORA", value:"2010-10323");

  script_name(english:"Fedora 13 : sblim-sfcb-1.3.8-1.fc13 (2010-10323)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This an update that fixes two security issues.

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=605342"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2010-September/047247.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?156be4e6"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected sblim-sfcb package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:sblim-sfcb");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:13");

  script_set_attribute(attribute:"patch_publication_date", value:"2010/06/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2010/09/09");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2010-2019 Tenable Network Security, Inc.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^13([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 13.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC13", reference:"sblim-sfcb-1.3.8-1.fc13")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "sblim-sfcb");
}

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if(description)
{
  script_id(46802);
  script_version("1.8");
  script_cvs_date("Date: 2018/07/27 18:38:15");

  script_cve_id("CVE-2010-1937", "CVE-2010-2054");
  script_bugtraq_id(40475);

  script_name(english:"SBLIM-SFCB Multiple Buffer Overflows");
  script_summary(english:"Detects a vulnerable sfcbd HTTP Daemon");
 
  script_set_attribute(attribute:"synopsis",value:
"The application is affected by multiple buffer overflow
vulnerabilities."
  );
  script_set_attribute(attribute:"description", value:
"The web server component of SBLIM-SFCB that is listening on the
remote host contains multiple heap-based buffer overflows that can be
triggered by sending an HTTP request with a specially crafted
Content-Length header.  Specifically :

 - There is a particular scenario where heap corruption can
   exist if httpMaxContentLength in sfcb.cfg is set to 0
   and the Content-Length of a request is 4294967290,
   getPayload() will try to memcpy() into an incorrectly
   sized buffer due to wrap around (we add 8 to
   Content-Length in the malloc). Also, sfcb.cfg states
   that the default value for httpMaxContentLength _is_ 0,
   which is untrue.

 - httpAdapter contains a heap overflow that is caused by an
   HTTP request with the Content-Length value being smaller
   than the actual size of the payload. The affect of this bug
   can cause the handling HTTP process to crash. If the
   request is specially crafted, arbitrary code execution
   could occur.

Successful exploit of these vulnerabilities may result in a server
crash or execution of arbitrary code in the context of the server."
  );
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?149a07e1");
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8729b62f");
	
  script_set_attribute(attribute:"solution", value:"Upgrade to version 1.3.8");
 script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
 script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
 script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
 script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vuln_publication_date", value: "2010/05/14");
  script_set_attribute(attribute:"patch_publication_date",value:"2010/05/25");
  script_set_attribute(attribute:"plugin_publication_date", value: "2010/06/07");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_end_attributes();

  script_category(ACT_ATTACK);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2010-2018 Tenable Network Security, Inc.");

  script_dependencie("http_version.nasl");
  script_require_ports("Services/www", 5988);

  exit(0);
}

include("global_settings.inc");
include("misc_func.inc");
include("http.inc");

port = get_service(svc:"www", default:5988, exit_on_fail:TRUE);

banner = get_http_banner(port:port);

if(isnull(banner))
{

soc = open_sock_tcp(port);
if (!soc) exit(1, "Can't open a socket on port "+port+".");

  send(socket:soc, data:'HEAD / HTTP/1.1\r\n\r\n');
  banner = recv(socket:soc, length:4096);
if(isnull(banner)) exit(1, "Can't retrieve banner from the server on port "+port+".");

  close(soc);
}

if(!egrep(pattern:"^Server:.*sfcHttpd", string:banner))
  exit (0, "The web server on port "+port+" is not SBLIM-SFCB");

soc = open_sock_tcp(port);
if (!soc) exit(1, "Can't open a socket on port "+port+".");

req = string ("POST / HTTP/1.0\r\n",
              "Content-Length: 9\r\n\r\n",
              "nessus\r\n\r\n");

w = http_send_recv_buf(port:port, data:req, exit_on_fail:TRUE);

headers = parse_http_headers(status_line:w[0], headers:w[1]);
if (isnull(headers)) exit(1, 'Error parsing HTTP headers on port '+port+'.');

code = headers['$code'];
if (isnull(code)) exit(1, 'Error parsing HTTP status code on port '+port+'.');

# patched version replies with "HTTP/1.1 400 Bad request"

if (code == 200) security_hole(port);
else exit(0, 'The SBLIM-SFCB sfcbd HTTP Daemon on port '+port+' is not affected.');

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2010-12847.
#

include("compat.inc");

if (description)
{
  script_id(49104);
  script_version("1.10");
  script_cvs_date("Date: 2019/08/02 13:32:31");

  script_cve_id("CVE-2010-1937", "CVE-2010-2054");
  script_bugtraq_id(40475);
  script_xref(name:"FEDORA", value:"2010-12847");

  script_name(english:"Fedora 12 : sblim-sfcb-1.3.8-1.fc12 (2010-12847)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Updated the sources and fixed the init script.

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=605342"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2010-September/047002.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?8b71fe37"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected sblim-sfcb package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:sblim-sfcb");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:12");

  script_set_attribute(attribute:"patch_publication_date", value:"2010/08/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2010/09/04");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^12([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 12.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC12", reference:"sblim-sfcb-1.3.8-1.fc12")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "sblim-sfcb");
}