false positive?
"Deepak J. Mathew" <[email protected]> Thu, 5 Feb 2009 14:54:46 -0600
| Newsgroups | gmane.comp.security.nessus.general |
|---|---|
| Message-ID | <15e301c987d3$fa7bb3f0$ef731bd0$@edu> |
This is a multipart message in MIME format.
--===============1824671216==
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_15E4_01C987A1.AFE143F0"
Content-Language: en-us
This is a multipart message in MIME format.
------=_NextPart_000_15E4_01C987A1.AFE143F0
Content-Type: text/plain;
charset="US-ASCII"
Content-Transfer-Encoding: 7bit
Question..
Vulnerability Nessus ID 34820 shows that a server has the vulnerability:
Symantec Backup Exec Authentication Bypass and Potential Buffer Overflow
ID: 34820
<https://128.42.174.70/sc3/console.php?psid=8000&ctxid=8001%5enewscan%5eplug
inid:34820> Family: Gain root remotely NASL: PLUGIN.nasl
<https://128.42.174.70/sc3/console.php?view_nasl=PLUGIN.nasl>
Synopsis :
It is possible to bypass the backup agent authentication.
Description :
The remote host is running a version of VERITAS Backup Exec Agent which is
vulnerable to multiple authentication bypass issues.
An attacker may exploit this flaw to manage the backup agent and/or to
execute commands with high privileges.
Solution :
http://www.symantec.com/avcenter/security/Content/2008.11.19.html
Risk factor :
Critical / CVSS Base Score : 10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
But, this fix was to install the latest and greatest version of BES, which
it already has the newest version/the fix for this vulnerability.
So, why does the vulnerability still show positive? I was not able to open
the .nasl to see what the scan is doing:
But, I was not able to open the "PLUGIN.nasl"
Please advise. Thanks!
Dee
------=_NextPart_000_15E4_01C987A1.AFE143F0
Content-Type: text/html;
charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable
<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:x=3D"urn:schemas-microsoft-com:office:excel" =
xmlns:p=3D"urn:schemas-microsoft-com:office:powerpoint" =
xmlns:a=3D"urn:schemas-microsoft-com:office:access" =
xmlns:dt=3D"uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" =
xmlns:s=3D"uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" =
xmlns:rs=3D"urn:schemas-microsoft-com:rowset" xmlns:z=3D"#RowsetSchema" =
xmlns:b=3D"urn:schemas-microsoft-com:office:publisher" =
xmlns:ss=3D"urn:schemas-microsoft-com:office:spreadsheet" =
xmlns:c=3D"urn:schemas-microsoft-com:office:component:spreadsheet" =
xmlns:odc=3D"urn:schemas-microsoft-com:office:odc" =
xmlns:oa=3D"urn:schemas-microsoft-com:office:activation" =
xmlns:html=3D"http://www.w3.org/TR/REC-html40" =
xmlns:q=3D"http://schemas.xmlsoap.org/soap/envelope/" xmlns:D=3D"DAV:" =
xmlns:x2=3D"http://schemas.microsoft.com/office/excel/2003/xml" =
xmlns:ois=3D"http://schemas.microsoft.com/sharepoint/soap/ois/" =
xmlns:dir=3D"http://schemas.microsoft.com/sharepoint/soap/directory/" =
xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#" =
xmlns:dsp=3D"http://schemas.microsoft.com/sharepoint/dsp" =
xmlns:udc=3D"http://schemas.microsoft.com/data/udc" =
xmlns:xsd=3D"http://www.w3.org/2001/XMLSchema" =
xmlns:sub=3D"http://schemas.microsoft.com/sharepoint/soap/2002/1/alerts/"=
xmlns:ec=3D"http://www.w3.org/2001/04/xmlenc#" =
xmlns:sp=3D"http://schemas.microsoft.com/sharepoint/" =
xmlns:sps=3D"http://schemas.microsoft.com/sharepoint/soap/" =
xmlns:xsi=3D"http://www.w3.org/2001/XMLSchema-instance" =
xmlns:udcs=3D"http://schemas.microsoft.com/data/udc/soap" =
xmlns:udcxf=3D"http://schemas.microsoft.com/data/udc/xmlfile" =
xmlns:udcp2p=3D"http://schemas.microsoft.com/data/udc/parttopart" =
xmlns:wf=3D"http://schemas.microsoft.com/sharepoint/soap/workflow/" =
xmlns:dsss=3D"http://schemas.microsoft.com/office/2006/digsig-setup" =
xmlns:dssi=3D"http://schemas.microsoft.com/office/2006/digsig" =
xmlns:mdssi=3D"http://schemas.openxmlformats.org/package/2006/digital-sig=
nature" =
xmlns:mver=3D"http://schemas.openxmlformats.org/markup-compatibility/2006=
" xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns:mrels=3D"http://schemas.openxmlformats.org/package/2006/relationshi=
ps" xmlns:spwp=3D"http://microsoft.com/sharepoint/webpartpages" =
xmlns:ex12t=3D"http://schemas.microsoft.com/exchange/services/2006/types"=
=
xmlns:ex12m=3D"http://schemas.microsoft.com/exchange/services/2006/messag=
es" =
xmlns:pptsl=3D"http://schemas.microsoft.com/sharepoint/soap/SlideLibrary/=
" =
xmlns:spsl=3D"http://microsoft.com/webservices/SharePointPortalServer/Pub=
lishedLinksService" xmlns:Z=3D"urn:schemas-microsoft-com:" =
xmlns:st=3D"" xmlns=3D"http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<meta name=3DGenerator content=3D"Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Courier New";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3DEN-US link=3Dblue vlink=3Dpurple>
<div class=3DSection1>
<p class=3DMsoNormal><span =
style=3D'font-size:10.0pt;font-family:"Courier =
New"'>Question..<o:p></o:p></span></p>
<p class=3DMsoNormal><span =
style=3D'font-size:10.0pt;font-family:"Courier =
New"'><o:p> </o:p></span></p>
<p class=3DMsoNormal><span =
style=3D'font-size:10.0pt;font-family:"Courier New";
color:black'>Vulnerability Nessus ID 34820 shows that a server has the =
vulnerability:<o:p></o:p></span></p>
<p class=3DMsoNormal><span =
style=3D'font-size:10.0pt;font-family:"Courier New";
color:black'><o:p> </o:p></span></p>
<p class=3DMsoNormal style=3D'background:white'><b><span =
style=3D'font-size:11.5pt;
font-family:"Arial","sans-serif";color:black'>Symantec Backup Exec
Authentication Bypass and Potential Buffer Overflow </span></b><span
style=3D'font-size:10.0pt;font-family:"Arial","sans-serif";color:black'><=
o:p></o:p></span></p>
<p class=3DMsoNormal style=3D'background:white'><b><span =
style=3D'font-size:10.0pt;
font-family:"Arial","sans-serif";color:black'>ID</span></b><span
style=3D'font-size:10.0pt;font-family:"Arial","sans-serif";color:black'>:=
<a
href=3D"https://128.42.174.70/sc3/console.php?psid=3D8000&ctxid=3D800=
1%5enewscan%5epluginid:34820"
title=3D"Launch Scan using this plugin">34820</a><b>Family</b>: Gain =
root
remotely <b>NASL</b>: <a
href=3D"https://128.42.174.70/sc3/console.php?view_nasl=3DPLUGIN.nasl"
target=3D"_blank" title=3D"View Plugin =
NASL">PLUGIN.nasl</a><o:p></o:p></span></p>
<p class=3DMsoNormal><span =
style=3D'font-size:10.0pt;font-family:"Arial","sans-serif";
color:black'><br>
Synopsis :<br>
<br>
It is possible to bypass the backup agent authentication.<br>
<br>
Description :<br>
<br>
The remote host is running a version of VERITAS Backup Exec Agent which =
is
vulnerable to multiple authentication bypass issues.<br>
<br>
An attacker may exploit this flaw to manage the backup agent and/or to =
execute
commands with high privileges.<br>
<br>
Solution :<br>
<br>
<a =
href=3D"http://www.symantec.com/avcenter/security/Content/2008.11.19.html=
"
target=3D"_blank">http://www.symantec.com/avcenter/security/Content/2008.=
11.19.html</a><br>
<br>
Risk factor :<br>
<br>
Critical / CVSS Base Score : 10.0 =
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)</span><span
style=3D'color:black'><o:p></o:p></span></p>
<p class=3DMsoNormal><span =
style=3D'color:black'><o:p> </o:p></span></p>
<p class=3DMsoNormal><span =
style=3D'font-size:10.0pt;font-family:"Courier New";
color:black'>But, this fix was to install the latest and greatest =
version of
BES, which it already has the newest version/the fix for this =
vulnerability.</span><span
style=3D'color:black'><o:p></o:p></span></p>
<p class=3DMsoNormal><span =
style=3D'font-size:10.0pt;font-family:"Courier New";
color:black'> </span><span =
style=3D'color:black'><o:p></o:p></span></p>
<p class=3DMsoNormal><span =
style=3D'font-size:10.0pt;font-family:"Courier New";
color:black'>So, why does the vulnerability still show positive? I =
was
not able to open the .nasl to see what the scan is doing:</span><span
style=3D'color:black'><o:p></o:p></span></p>
<p class=3DMsoNormal><span =
style=3D'font-size:10.0pt;font-family:"Courier New";
color:black'> </span><span =
style=3D'color:black'><o:p></o:p></span></p>
<p class=3DMsoNormal><span =
style=3D'font-size:10.0pt;font-family:"Courier New";
color:black'>But, I was not able to open the =
“PLUGIN.nasl” </span><span
style=3D'color:black'><o:p></o:p></span></p>
<p class=3DMsoNormal><span =
style=3D'font-size:10.0pt;font-family:"Courier New";
color:black'> </span><span =
style=3D'color:black'><o:p></o:p></span></p>
<p class=3DMsoNormal><span =
style=3D'font-size:10.0pt;font-family:"Courier New";
color:black'>Please advise. Thanks!</span><span =
style=3D'color:black'><o:p></o:p></span></p>
<p class=3DMsoNormal><span =
style=3D'font-size:10.0pt;font-family:"Courier New";
color:black'> </span><span =
style=3D'color:black'><o:p></o:p></span></p>
<p class=3DMsoNormal><span =
style=3D'font-size:10.0pt;font-family:"Courier New";
color:black'>Dee</span><span =
style=3D'color:black'><o:p></o:p></span></p>
<p class=3DMsoNormal><span =
style=3D'font-size:10.0pt;font-family:"Courier =
New"'><o:p> </o:p></span></p>
</div>
</body>
</html>
------=_NextPart_000_15E4_01C987A1.AFE143F0--
--===============1824671216==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Nessus mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus
--===============1824671216==--