Mailing List Archive: openssl_overflow.nasl vs. openssl_overflow_generic

openssl_overflow.nasl vs. openssl_overflow_generic_test.nasl

Aug 6, 2002, 8:30 AM

Post #1 of 3 (622 views)

Yesterday, the script openssl_overflow_generic_test.nasl was released.
Basically, this script connects to all the SSL enabled ports of the
remote host, advertizes itself as a SSLv2 client, sends a malformed key
and observes the behavior of the remote host.

So far, every SSLv2-compatible service I've tested with script script
have been shown as vulnerable when they were, so I'm now considering
removing the lame openssl_overflow.nasl which just relies on the banner
version (and is subject to a false positive on RedHat and possibly
Debian).

Before I do that, I'd appreciate to get some feedback concerning
openssl_overflow_generic_test.nasl. Since the protocol is not really
negociated, I fear that there is some case were we might miss a
vulnerability.

So please, report to me any false positive / false negative.

(the script is on www.nessus.org/scripts.php or obtainable via
nessus-update-plugins)

-- Renaud

Re: openssl_overflow.nasl vs. openssl_overflow_generic_test.nasl [ In reply to ]

scheidell at secnap

Aug 6, 2002, 8:45 AM

Post #2 of 3 (596 views)

Permalink

>
> Before I do that, I'd appreciate to get some feedback concerning
> openssl_overflow_generic_test.nasl. Since the protocol is not really
> negociated, I fear that there is some case were we might miss a
> vulnerability.

do you want to do a safe_checks() banner vs real test?

--
Michael Scheidell, CEO
SECNAP Network Security, LLC
Sales: 866-SECNAPNET / (1-866-732-6276)
Main: 561-368-9561 / www.secnap.net
Looking for a career in Internet security?
http://www.secnap.net/employment/

Re: openssl_overflow.nasl vs. openssl_overflow_generic_test.nasl [ In reply to ]

deraison at nessus

Aug 6, 2002, 8:52 AM

Post #3 of 3 (601 views)

Permalink

On Tue, Aug 06, 2002 at 11:45:28AM -0400, Michael Scheidell wrote:
> >
> > Before I do that, I'd appreciate to get some feedback concerning
> > openssl_overflow_generic_test.nasl. Since the protocol is not really
> > negociated, I fear that there is some case were we might miss a
> > vulnerability.
>
> do you want to do a safe_checks() banner vs real test?

The check is not aggressive (it only overwrites one byte on the tested
host, a variable on the stack), so no. OpenSSL being different from
Apache, it makes no real sense to read the banner.

-- Renaud