old user rules are not cleared in nessusd

Thomas Arendsen Hein <[email protected]> Wed, 24 Nov 2004 17:49:10 +0100

Newsgroups	gmane.comp.security.nessus.devel
Message-ID	<[email protected]>

Hi!

Attached is a patch which makes a backup copy of the server rules
while being connected by a client, before user rules are added.

If the client uses comm_send_rules to add new user rules, they are
appended to all existing rules, so they get duplicated with every
attack run. Even worse, they don't get cleared in the current
connection if they are removed from the client.

Renaud, may I apply this to HEAD?

Thomas

-- 
Email: [email protected]
http://intevation.de/~thomas/

_______________________________________________
Nessus-devel mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus-devel

nessusd-clear_user_rules.patch (text/plain, 560 B)

RCS file: /usr/local/cvs/nessus-core/nessusd/ntp_11.c,v
retrieving revision 1.75
diff -u -r1.75 ntp_11.c
--- nessusd/ntp_11.c	27 Oct 2004 13:00:39 -0000	1.75
+++ nessusd/ntp_11.c	24 Nov 2004 16:43:47 -0000
@@ -390,6 +390,14 @@
  char * buffer;
  int finished = 0;
  struct sockaddr_in * soca;
+
+ if(arg_get_type(globals, "saved_rules")<0)
+  arg_add_value(globals, "saved_rules", ARG_PTR, -1, rules_dup(rules));
+ else
+ {
+  rules_free(rules);
+  rules = rules_dup(arg_get_value(globals, "saved_rules"));
+ }
  
  buffer = emalloc(4096); 
  while(!finished)

signature.asc (application/pgp-signature, 189 B)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)

iD8DBQFBpLuGW7P1GVgWeRoRAhaoAKCI51Fov47YaYg2vzIPQabdBEZ5oQCeO2bG
yU5hP82MSb9UTzpuJSYqQ5s=
=l8BQ
-----END PGP SIGNATURE-----