Re: [2.0.3] ftp_root.nasl - still buggy plus other 2.0.3 weirdness

On Sun, Apr 13, 2003 at 09:11:03AM -0400, Brian Costello wrote:
> Hello,
> 
> [ftp_root.nasl]
> 
> ftp_root.nasl still has the same problem in 2.0.3 as the previous ones did. 
> Specifically, the  line:
> 
> pasv = ftp_get_pasv_port(socket:soc);

Some ftp server will yell at you if you send a STOR with no data
connection already open, so commenting this command out would not fix
the issue. Send me network traces please.

> [default_account.inc]
> 
> I noticed that one of the changes I suggested for default_account.inc got
> implemented.  Thank you!  I am still concerned that systems this won't work
> with systems that prompt you for a password even if the password is blank,
> but this new version works for me in all of my test machines.  I'll post how
> to configure solaris so that it prompts you for a password even if it's
> blank once I remember how I did it in the first place :)
> 
> I also noticed that this gives false positives whenever an account has a
> blank password and the script looks for logins based on that account. 
> Obviously not a huge problem, but definitely solvable.

The solution slow a lot of things down, so I prefer to let those false
positive go in at this time.


> [oracle9iAS_slashdot_DoS.nasl]
> 
> This script (oracle9iAS_slashdot_DoS.nasl) seems to do nothing!  Shouldn't
> it set a security hole or a kb item or SOMETHING when http_is_dead() is
> true?

Fixed, thanks.