Nessus scanner_add_port() buffer overflow
| nessus-scanneraddport-bo (12058) |  Low Risk |
Description:
Nessus is vulnerable to a denial of service, caused by a buffer overflow in the scanner_add_port() function. If the plugins_upload option is enabled (the default setting is disabled) and a local attacker has a valid Nessus account, the attacker can pass an overly long proto argument to the scanner_add_port() function to cause the Nessus Attack Scripting Language (NASL) script to crash.
Platforms Affected:
- Gentoo, Linux
- Tenable Network Security, Nessus prior to 2.0.6
Remedy:
Upgrade to the latest version of Nessus (2.0.6 or later), available from the Nessus FTP site. See References.
For Gentoo Linux:
Upgrade to the latest version of nessus (2.0.6a or later), as listed in Gentoo Linux Security Announcement 200305-10. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Denial of Service
References:
- BugTraq Mailing List, Thu May 22 2003 - 15:44:59 CDT , Potential security vulnerability in Nessus at http://archives.neohapsis.com/archives/bugtraq/2003-05/0243.html.
- BugTraq Mailing List, Thu May 22 2003 - 21:43:01 CDT , nessus NASL scripting engine security issues at http://archives.neohapsis.com/archives/bugtraq/2003-05/0250.html.
- Gentoo Linux Security Announcement 200305-10, nessus - problems in scripting engine at http://www.linuxsecurity.com/content/view/105032/104/.
- Nessus FTP site, Index of /nessus at http://ftp.nessus.org/nessus/.
- BID-7664: Nessus LibNASL Arbitrary Code Execution Vulnerability
- CVE-2003-0373: Multiple buffer overflows in libnasl in Nessus before 2.0.6 allow local users with plugin upload privileges to cause a denial of service (core dump) and possibly execute arbitrary code via (1) a long proto argument to the scanner_add_port function, (2) a long user argument to the ftp_log_in function, (3) a long pass argument to the ftp_log_in function.
Reported:
May 22, 2003
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net