PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-14 03:39:02 +00:00
Code Issues Projects Releases Wiki Activity

o [NSE] Small improvements on the smtp-vuln-cve2011-1764 script:

Browse Source 
- Check the port.version.product in the portrule to see if it matches
    the 'Exim smtpd'
  - If the script was not able to confirm the vulnerability but the Exim
    version is between 4.70 and 4.75, then report: "LIKELY VULNERABLE".
This commit is contained in:
djalal
2011-07-18 11:42:41 +00:00
parent 2c7cad079b
commit 01f4cdd83e
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
scripts/smtp-vuln-cve2011-1764.nse
View File

@@ -40,6 +40,9 @@ require "smtp"
require "stdnse" require "stdnse"
portrule = function (host, port) portrule = function (host, port)
if port.version.product ~= nil and port.version.product ~= "Exim smtpd" then
return false
end
return shortport.port_or_service({25, 465, 587}, return shortport.port_or_service({25, 465, 587},
{"smtp", "smtps", "submission"})(host, port) {"smtp", "smtps", "submission"})(host, port)
end end
@@ -121,7 +124,7 @@ local function check_exim(smtp_opts)
local exim_ver_min, exim_ver_max = 4.70, 4.75 local exim_ver_min, exim_ver_max = 4.70, 4.75
local cve = 'CVE-2011-1764' local cve = 'CVE-2011-1764'
local exim_dkim_str = "Exim DKIM Signatures Format String ("..cve.."):" local exim_dkim_str = "Exim DKIM Signatures Format String ("..cve.."):"
local exim_dkim_result = "" local exim_dkim_result
local socket, ret = smtp.connect(smtp_opts.host, local socket, ret = smtp.connect(smtp_opts.host,
smtp_opts.port, smtp_opts.port,
@@ -176,7 +179,7 @@ local function check_exim(smtp_opts)
return smtp_finish(socket, status, ret) return smtp_finish(socket, status, ret)
elseif ret then elseif ret then
exim_dkim_result = string.format(" Exim (%s): VULNERABLE", cve) exim_dkim_result = string.format(" Exim (%s): VULNERABLE", cve)
else elseif not exim_dkim_result then
return smtp_finish(socket, false, 'Exim server seems NOT VULNERABLE.') return smtp_finish(socket, false, 'Exim server seems NOT VULNERABLE.')
end end