PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-06 04:31:29 +00:00
Code Issues Projects Releases Wiki Activity

Spelling fixes for Lua files

Browse Source 
Mostly in documentation/comments, but a couple code bugs were caught,
including a call to stdnse.pirnt_debug and a mis-declared variable.
This commit is contained in:
dmiller
2014-02-19 04:15:46 +00:00
parent 54fa265f5c
commit 1b71f75aad
202 changed files with 532 additions and 532 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
scripts/samba-vuln-cve-2012-1182.nse
View File

@@ -17,12 +17,12 @@ CVE-2012-1182 marks multiple heap overflow vulnerabilities located in
PIDL based autogenerated code. This check script is based on PoC by ZDI
marked as ZDI-CAN-1503. Vulnerability lies in ndr_pull_lsa_SidArray
function where an attacker is under control of num_sids and can cause
insuficient memory to be allocated, leading to heap buffer overflow
and posibility of remote code execution.
insufficient memory to be allocated, leading to heap buffer overflow
and possibility of remote code execution.
Script builds a malitious packet and makes a SAMR GetAliasMembership
Script builds a malicious packet and makes a SAMR GetAliasMembership
call which triggers the vulnerability. On the vulnerable system,
connection is droped and result is "Failed to receive bytes after 5 attempts".
connection is dropped and result is "Failed to receive bytes after 5 attempts".
On patched system, samba throws an error and result is "MSRPC call
returned a fault (packet type)".
@@ -121,7 +121,7 @@ from an anonymous connection.
status, result = msrpc.samr_getaliasmembership(smbstate,marshaledHandle, data)
stdnse.print_debug(2, "msrpc.samr_getaliasmembership: %s, '%s'", status, result)
if(status == false and string.find(result,"Failed to receive bytes after 5 attempts") ~= nil) then
samba_cve.state = vulns.STATE.VULN -- connection droped, server crashed
samba_cve.state = vulns.STATE.VULN -- connection dropped, server crashed
end
return report:make_output(samba_cve)