Service fingerprint update / fix for libssh (patch)
Brandon Enright via dev <[email protected]> Tue, 16 Oct 2018 23:38:50 +0000
| Newsgroups | gmane.comp.security.nmap.devel |
|---|---|
| Organization | Cisco Systems |
| Message-ID | <20181016233850.2ac3388f@lambda> |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi folks, There is a fun authentication bypass (CVE-2018-10933) for libssh out today: https://www.libssh.org/security/advisories/CVE-2018-10933.txt https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/ I did some scanning and noticed the fingerprint in the nmap-service-probes file doesn't match any of the services I could find. It seems some versions of libssh use an underscore as the separator character for the version like so: SF:L,16,"SSH-2\.0-libssh_0\.7\.5\r\n"); Attached is a patch that allows both an underscore and hyphen so that the fingerprint matches more versions. Regards, Brandon -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQQsPI0+tjl0LJJzd/apoY/MCyX3ggUCW8Z2igAKCRCpoY/MCyX3 guyiAKCSdZiV+QvPQcbLvQsa4rXXs0csvACdFPV84uPbtyTHWSnb3B57fH6n7Jo= =S9dX -----END PGP SIGNATURE----- _______________________________________________ Sent through the dev mailing list https://nmap.org/mailman/listinfo/dev Archived at http://seclists.org/nmap-dev/
libssh_sv.diff
(text/x-patch, 1 KB)
Index: nmap-service-probes =================================================================== --- nmap-service-probes (revision 37464) +++ nmap-service-probes (working copy) @@ -3601,7 +3601,7 @@ match ssh m|^SSH-([\d.]+)-WeOnlyDo(?:-wodFTPD)? ([\d.]+)\r?\n| p/WeOnlyDo sshd/ v/$2/ i/protocol $1/ o/Windows/ cpe:/o:microsoft:windows/a match ssh m|^SSH-([\d.]+)-WeOnlyDo-([\d.]+)\r?\n| p/WeOnlyDo sshd/ v/$2/ i/protocol $1/ o/Windows/ cpe:/o:microsoft:windows/a match ssh m|^SSH-2\.0-PGP\r?\n| p/PGP Universal sshd/ i/protocol 2.0/ cpe:/a:pgp:universal_server/ -match ssh m|^SSH-([\d.]+)-libssh-([-\w.]+)\r?\n| p/libssh/ v/$2/ i/protocol $1/ cpe:/a:libssh:libssh:$2/ +match ssh m|^SSH-([\d.]+)-libssh[_-]([-\w.]+)\r?\n| p/libssh/ v/$2/ i/protocol $1/ cpe:/a:libssh:libssh:$2/ match ssh m|^SSH-([\d.]+)-HUAWEI-VRP([\d.]+)\r?\n| p/Huawei VRP sshd/ i/protocol $1/ d/router/ o/VRP $2/ cpe:/o:huawei:vrp:$2/ match ssh m|^SSH-([\d.]+)-HUAWEI-UMG([\d.]+)\r?\n| p/Huawei Unified Media Gateway sshd/ i/model: $2; protocol $1/ cpe:/h:huawei:$2/ # Huawei 6050 WAP