Patch for find_in_path (plugutils.c)

Hi,

nmap.nasl was not launching nmap on one of our systems, even though it was 
installed as /usr/bin/nmap. The cause was this (strace output):

strace.log.21456:access("/home/scanner/nmap", X_OK) = 0
...
strace.log.21457:execve("/home/scanner/nmap", ["nmap", "-n", "-P0", "-oG", 
"/usr/local/nessus/var/nessus/tmp"..., "-sT"
, "-p", "1-65535", "--min_rtt_timeout", "71", "--max_rtt_timeout", "213",
...

It found, and tried to launch /home/scanner/nmap, but this is a directory and 
not the nmap binary. Looking at the code for find_in_path in plugutils.c, it 
only checks for execute permission, but doesn't check if it's actually a file, 
so it will match on +x subdirectories called "nmap" within the path.

This bug would also stop the hydra, snmpwalk etc. scanner plugins working if you 
happen to have directories with the names of the binaries in your path.

I've attached a patch which adds an S_ISREG test to see if it's a regular file, 
which works fine for me (I only tested nmap.nasl).

-- 
Hubert Seiwert

Internet Security Specialist, Westpoint Ltd
Albion Wharf, 19 Albion Street, Manchester M1 5LN, United Kingdom

Web: www.westpoint.ltd.uk
Tel: +44-161-2371028

_______________________________________________
Nessus-devel mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus-devel

--- plugutils.c	2005-07-06 21:48:11.000000000 +0100
+++ plugutils.c	2005-08-23 13:03:39.000000000 +0100
@@ -1954,6 +1954,7 @@
   char		*buf = getenv("PATH"), *pbuf, *p1, *p2;
   static char	cmd[MAXPATHLEN];
   int		len = strlen(name);
+  struct 	stat stat_p;
   
   if (len >= MAXPATHLEN)
     return NULL;
@@ -1989,11 +1990,18 @@
       sprintf(p2, "/%s", name);
       if (access(cmd, X_OK) == 0)
 	{
-	  *p2 = '\0';
+	  if ( -1 ==  stat (cmd, &stat_p))
+	  {
+	    fprintf(stderr, "find_in_path: error occoured attempting to stat %s\n", cmd);
+	  }
+	  else if (S_ISREG(stat_p.st_mode))
+	  {
+  	  *p2 = '\0';
 #if 0
 	  fprintf(stderr, "find_in_path: %s found in %s\n", name, cmd);
 #endif
 	  return cmd;
+	 }
 	}
 #if 0
       else