[2.0.3] ftp_root.nasl - still buggy plus other 2.0.3 weirdness

Brian Costello <[email protected]>
Newsgroups gmane.comp.security.nessus.devel
Message-ID <[email protected]>
Hello,

[ftp_root.nasl]

ftp_root.nasl still has the same problem in 2.0.3 as the previous ones did. 
Specifically, the  line:

pasv = ftp_get_pasv_port(socket:soc);

causes a false negative.  When I comment this out, the script works against
wu-ftpd 2.6.2(2) - the one ftp daemon version I have handy.  This would
suggest that there's a problem with the ftp_get_pasv_port command, or that
this command is used incorrectly in the script, OR there's a pecularity with
wu-ftpd 2.6.2 that causes this.


[default_account.inc]

I noticed that one of the changes I suggested for default_account.inc got
implemented.  Thank you!  I am still concerned that systems this won't work
with systems that prompt you for a password even if the password is blank,
but this new version works for me in all of my test machines.  I'll post how
to configure solaris so that it prompts you for a password even if it's
blank once I remember how I did it in the first place :)

I also noticed that this gives false positives whenever an account has a
blank password and the script looks for logins based on that account. 
Obviously not a huge problem, but definitely solvable.

[oracle9iAS_slashdot_DoS.nasl]

This script (oracle9iAS_slashdot_DoS.nasl) seems to do nothing!  Shouldn't
it set a security hole or a kb item or SOMETHING when http_is_dead() is
true?

TIA,
Brian Costello
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.