Mailing List Archive: Symantec Anti-Virus Corporate plugin

Symantec Anti-Virus Corporate plugin

Jun 5, 2006, 12:13 PM

Post #1 of 4 (1878 views)

Using the nav_installed.nasl plugin, I have rewritten a Symantec
Anti-Virus Corporate plugin which will detect
version/parent/signatures/running/etc and set appropriate kb entries for
each.

I am so close to have a working plugin, however the version and parent
strings are not getting detected correctly even though the registry
entries are valid. I am getting the following in the nessusd.dump log:
[334](savce_installed.nasl:0x4e12) add: bad type for instruction
[334](savce_installed.nasl:0x4e36) add: bad type for instruction
[334](savce_installed.nasl:0x4e5b) add: bad type for instruction

Since this line does not appear in the Nessus open source version, and a
Google search turned up nothing, I don't know what the errors mean.
Anyone have an idea or see an obvious bug in my attached script?

By the way, this is under Nessus 3.0.3 on RedHat Enterprise.

Cheers,

--Keith

Keith Young, Security Official
Department of Technology Services
Montgomery County, Maryland
phone - (240) 777-2955

Re: Symantec Anti-Virus Corporate plugin [ In reply to ]

deraison at nessus

Jun 5, 2006, 1:48 PM

Post #2 of 4 (1781 views)

Permalink

On Jun 5, 2006, at 9:13 PM, Young, Keith wrote:

>
> Using the nav_installed.nasl plugin, I have rewritten a Symantec
> Anti-Virus Corporate plugin which will detect
> version/parent/signatures/running/etc and set appropriate kb
> entries for
> each.
>
> I am so close to have a working plugin, however the version and parent
> strings are not getting detected correctly even though the registry
> entries are valid. I am getting the following in the nessusd.dump log:
> [334](savce_installed.nasl:0x4e12) add: bad type for instruction
> [334](savce_installed.nasl:0x4e36) add: bad type for instruction
> [334](savce_installed.nasl:0x4e5b) add: bad type for instruction
>
> Since this line does not appear in the Nessus open source version,
> and a
> Google search turned up nothing, I don't know what the errors mean.
> Anyone have an idea or see an obvious bug in my attached script?

It means you're adding an array (directory). RegQueryValue() returns
an array with the type as index 0 and the value at index 1.
Therefore, instead of using 'directory' use 'directory[1]' in
check_product_version()

-- Renaud
_______________________________________________
Plugins-writers mailing list
Plugins-writers@list.nessus.org
http://mail.nessus.org/mailman/listinfo/plugins-writers

Re: Symantec Anti-Virus Corporate plugin [ In reply to ]

theall at tenablesecurity

Jun 5, 2006, 1:51 PM

Post #3 of 4 (1783 views)

Permalink

On Mon, Jun 05, 2006 at 03:13:50PM -0400, Young, Keith wrote:

> I am so close to have a working plugin, however the version and parent
> strings are not getting detected correctly even though the registry
> entries are valid.
...
parent = RegQueryValue(handle:key_h, item:item);
...
set_kb_item(name: "Antivirus/SAVCE/parent", value:parent);

Here's one problem -- ReqQueryValue() returns an array while set_kb_item
wants a string for the value parameter. You may want to do something
like this to get 'parent':

value = RegQueryValue(handle:key_h, item:item);
if (isnull(value)) parent = NULL;
else parent = value[1];

George
--
theall@tenablesecurity.com
_______________________________________________
Plugins-writers mailing list
Plugins-writers@list.nessus.org
http://mail.nessus.org/mailman/listinfo/plugins-writers

RE: Symantec Anti-Virus Corporate plugin [ In reply to ]

Keith.Young at montgomerycountymd

Jun 5, 2006, 1:55 PM

Post #4 of 4 (1789 views)

Permalink

> Here's one problem -- ReqQueryValue() returns an array
> while set_kb_item wants a string for the value parameter.

Doh!

Thanks George and Renaud.

--Keith

Keith Young, Security Official
Department of Technology Services
Montgomery County, Maryland
phone - (240) 777-2955
_______________________________________________
Plugins-writers mailing list
Plugins-writers@list.nessus.org
http://mail.nessus.org/mailman/listinfo/plugins-writers

Mailing List Archive

Mailing List Archive

Attached Files: