Hi,
I wrote a nasl to check for the awstats vulnerability bugtraq ID# 12543.
The nasl is shown below. While this is my first nasl I would appreciate
any feedback. How do I submit this nasl for inclusion in nessus?
--
- Josh
#
# This script was written by Josh Zlatin-Amishav <josh at tkos dot co dot il>
#
# This script is released under the GNU GPLv2
#
if(description)
{
script_id(99999);
script_bugtraq_id(12543);
script_version ("$Revision: 1.0 $");
name["english"] = "AWStats Plugin Multiple Remote Command Execution
Vulnerabilities";
script_name(english:name["english"]);
desc["english"] = "
The remote host is running AWStats, a free real-time logfile analyzer.
quoted from: http://www.securityfocus.com/bid/12543/discussion/
Multiple remote command execution vulnerabilities reportedly affect AWStats.
These issues are due to an input validation error that allows a remote attacker
to specify commands to be executed in the context of the affected application.
An attacker may leverage these issues to execute arbitrary commands with the
privileges of the affected web server running the vulnerable scripts. This may
facilitate unauthorized access to the affected computer, as well as other
attacks.
Solution : Upgrade to Awstats 6.4
Risk factor : High";
script_description(english:desc["english"]);
summary["english"] = "Checks for vulnerable versions of Awstats";
script_summary(english:summary["english"]);
script_category(ACT_GATHER_INFO);
script_copyright(english:"Copyright (C) 2005 Josh Zlatin-Amishav");
script_family(english:"CGI abuses");
family["english"] = "CGI abuses";
script_family(english:family["english"]);
script_dependencie("http_version.nasl");
script_require_ports("Services/www", 80);
exit(0);
}
#
# The script code starts here
# Based on awstats_configdir.nasl by David Maciejak
include("http_func.inc");
include("http_keepalive.inc");
port = get_http_port(default:80);
if(!get_port_state(port))exit(0);
function check(url)
{
req = http_get(item:url +"/awstats.pl?debug=2", port:port);
res = http_keepalive_send_recv(port:port, data:req);
if ( res == NULL ) exit(0);
#
# Note AWstats 5.6 and 6.4 are not vulnerable
#
if ( egrep(pattern:"Advanced Web Statistics
(4\.0|5\.[0-5]|5\.[7-9]|6\.[0-3])", string:res) )
{
security_hole(port);
exit(0);
}
}
check(url:"/awstats");
foreach dir ( cgi_dirs() )
{
check(url:dir);
}
I wrote a nasl to check for the awstats vulnerability bugtraq ID# 12543.
The nasl is shown below. While this is my first nasl I would appreciate
any feedback. How do I submit this nasl for inclusion in nessus?
--
- Josh
#
# This script was written by Josh Zlatin-Amishav <josh at tkos dot co dot il>
#
# This script is released under the GNU GPLv2
#
if(description)
{
script_id(99999);
script_bugtraq_id(12543);
script_version ("$Revision: 1.0 $");
name["english"] = "AWStats Plugin Multiple Remote Command Execution
Vulnerabilities";
script_name(english:name["english"]);
desc["english"] = "
The remote host is running AWStats, a free real-time logfile analyzer.
quoted from: http://www.securityfocus.com/bid/12543/discussion/
Multiple remote command execution vulnerabilities reportedly affect AWStats.
These issues are due to an input validation error that allows a remote attacker
to specify commands to be executed in the context of the affected application.
An attacker may leverage these issues to execute arbitrary commands with the
privileges of the affected web server running the vulnerable scripts. This may
facilitate unauthorized access to the affected computer, as well as other
attacks.
Solution : Upgrade to Awstats 6.4
Risk factor : High";
script_description(english:desc["english"]);
summary["english"] = "Checks for vulnerable versions of Awstats";
script_summary(english:summary["english"]);
script_category(ACT_GATHER_INFO);
script_copyright(english:"Copyright (C) 2005 Josh Zlatin-Amishav");
script_family(english:"CGI abuses");
family["english"] = "CGI abuses";
script_family(english:family["english"]);
script_dependencie("http_version.nasl");
script_require_ports("Services/www", 80);
exit(0);
}
#
# The script code starts here
# Based on awstats_configdir.nasl by David Maciejak
include("http_func.inc");
include("http_keepalive.inc");
port = get_http_port(default:80);
if(!get_port_state(port))exit(0);
function check(url)
{
req = http_get(item:url +"/awstats.pl?debug=2", port:port);
res = http_keepalive_send_recv(port:port, data:req);
if ( res == NULL ) exit(0);
#
# Note AWstats 5.6 and 6.4 are not vulnerable
#
if ( egrep(pattern:"Advanced Web Statistics
(4\.0|5\.[0-5]|5\.[7-9]|6\.[0-3])", string:res) )
{
security_hole(port);
exit(0);
}
}
check(url:"/awstats");
foreach dir ( cgi_dirs() )
{
check(url:dir);
}